d1dd238545c420ea8fea963df4a0f2d7c89e7f6faafe246d9cb35d5f1c334632

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Size 5.2MB
Sample260724-latjpswtfs
SHA256 d1dd238545c420ea8fea963df4a0f2d7c89e7f6faafe246d9cb35d5f1c334632
MD5 759fa31baec1ed12384a819cfce64018
SHA1 b1c022c853472d34adb6476005b42bf59d330d8d
SHA512 88945252000c7edf2e42be2bf660c40b994f3e0c5f1e7309bb23a00007733cf39db808fc1ba32e751ba77b1cfa233b26088075ac27b676abd0a9564c10832abe
SSDEEP 98304:vejvrSd4Skl3Jfy/gsypOe5qRZZXYz8mOzwOVaK2Tc5:mjmkFJqhypG9kdmw
TLSH
T1BA462312BD868133D66802B96D7FDA99806EBD409B2560C3F798779B0D307D3A237F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6028	elevation_service.exe
2592	elevation_service.exe
5792	maintenanceservice.exe
1964	OSE.EXE
3216	PerceptionSimulationService.exe
5464	perfhost.exe
5352	ReFsDedupSvc.exe
3724	SensorDataService.exe
2068	ssh-agent.exe
3728	AgentService.exe
3584	SearchIndexer.exe

Loads dropped DLL 27 IoCs

pid	Process
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92393143e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e929a7b14d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b179cb34d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf42acb04d1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cda7eb54d1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
2592	elevation_service.exe
2592	elevation_service.exe
2592	elevation_service.exe
2592	elevation_service.exe
2592	elevation_service.exe
2592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3364	2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3728	AgentService.exe
Token: 33	3584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3584	SearchIndexer.exe
Token: SeDebugPrivilege	6028	elevation_service.exe
Token: SeDebugPrivilege	2592	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1856	3584	SearchIndexer.exe	101
PID 3584 wrote to memory of 4756	3584	SearchIndexer.exe	102
PID 3584 wrote to memory of 2532	3584	SearchIndexer.exe	103
PID 3584 wrote to memory of 5108	3584	SearchIndexer.exe	104
PID 3584 wrote to memory of 3644	3584	SearchIndexer.exe	106
PID 3584 wrote to memory of 1108	3584	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_759fa31baec1ed12384a819cfce64018_coinminer_darkgate_elex_maze.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5464

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ad4f6b9ae9d91b7d44a999ef796830715ba846c6a8f2f287e81ac0bf38563e0
MD5 931ae5fdd777663ce7d13906a2837a71
SHA1 ead00e51535d8db45da862f486ff57149fd47967
SHA512 ad06f09616be9b9f833736ab7b049baa35ed115c0ee28497032cf81999c41a9260aefe1ea63e241598d6bdb04ed55cddceb7374bb0f83b62f60d03aa9d375fbe
SSDEEP 49152:xb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn4R2TPod5:33q60jB52Tc5
TLSH
T1B6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9b8911cd9064ef372b88af043ee0fe04682aa7d93d839388a2617e0d12ee8b09
MD5 0afce96090f8e491a285a77f00acb674
SHA1 515ddbb67ce24c57b7f75af616170b6bbf6d253d
SHA512 ed35fb591a500dbd1e217fc498c6375edda709c9cc9c6ad0d56939a7986344633ab3c67254625c4933ee4f5f70bd62b9312e2ef1d3def22d416eccdb920c34e0
SSDEEP 24576:9XYfDtczAjPne87HtO/DF1+9codjeWyZxeCE0:otcOR2TPod5
TLSH
T14F05F128B7E408F9ED678139C9F28501E6737C9147A4F78B03E4A9291E336D85E3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c86bcdaa1b3f6c27385c454ca09e1a68ddb01277a4b134f8f55f3d0b4f535135
MD5 d28e2f71c400f0438270944290df37dd
SHA1 3ca75af610a25273b32e0281d33472e4bc86ece8
SHA512 98d146ff04260e7a21f074e41c198832286d90aa328a4593400b22b475bdd99d8d741cd43c74fb96261bf85263d08254ccbd436b3df96372563ba64df5a0341e
SSDEEP 24576:M0Le5ji0hmxNrMwPne87HtO/DF1+9codjeWyZxeCE6:MPji0A7NR2TPod5
TLSH
T125359E55F6748331D073C0B9C5D2A68EE97230825B308ACB5286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 40642b47d00154ae633928c21b03dce700958ead3b08ef6f1cc2ecdde5c56d8d
MD5 0a08a4488de1277945588561012e1600
SHA1 42258da316e256544f585c60a94b529724b42e34
SHA512 227210249c315f42978f30c3bfcc08ce34e83ae711d44b26091542f0462ecf11a282136b0d9407fcbf316fd82b5eea478a34efb9b164f80612508ca279837c3c
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWr6q8wyuePne87HtO/DF1+9codjeWyZxeCEp:1/ezSC6vUzPviHjyxR2TPod5
TLSH
T1FD755C25F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cf012011b863d08742011a77f089019983b87d1b75f7d1b43442c80b2ea49803
MD5 07a83164c3b74c89e0b7fba6c6dfefa5
SHA1 13c5b3f9971cd3337518cd1585da5a5accb78eb6
SHA512 077cf1bbf44e166ba3e7ce5a3881f0bcf1185abd114454b1c92ce4065ca848542633baf751a9f94937a2475e70973323d193863ccf844eb2a967c1a8caebe954
SSDEEP 24576:AVbqPb88hv/l+bvPne87HtO/DF1+9codjeWyZxeCEd:AVO88hXl+LR2TPod5
TLSH
T1CB55AE65F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E67BE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 840a026b13f5cb86cd59e719ed70b78fcf058bcce29ef8f11636078cd1449082
MD5 0843d070fa2714ea92a133e517241f06
SHA1 51f7248cf594bbca7bc5702f88658714bd7af29a
SHA512 480d0cf5fc312a7e692662fbc80500c6440ecd19abd0c270bf6501cba32a81e375de30f7497c591a4dd05ce1a9b3aa482f2aab5d638c3d1a6b7225fc94a481ac
SSDEEP 12288:GjcPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ya:GjcPne87HtO/DF1+9codjeWyZxeCES
TLSH
T155C42394EBA901B1F7B7063306FE894521B15CD0A8FEB75BF5867E5D4038D28D68A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1fd897250715539ea690451f83c9ec4d5e250bca97d74b4a88f1ea4e4ef11758
MD5 62cc835fb9aa554e5f2053d29ac24f39
SHA1 2456fc4b1a4ce5288cfa606fe221c179823d9e81
SHA512 03071bf9aa55ccaf02b568ab79fbaa7b910bc7ec08617bd32af783eb7610f51be2251eaa2023cba7cb9acde51f3cab6c76c578d88c98a8b246cd018daa2d0f5b
SSDEEP 24576:zJIUHPne87HtO/DF1+9codjeWyZxeCEj:zJIUHR2TPod5
TLSH
T16C05C07BEE28FCE2C27A4D795791C600E77278704F62A3CBD165820EDE235E05E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12fef5d326473d0a53f1cadd1016b3eaf260ad5a1fd08d8060810615a42d0650
MD5 9adc1968e5267e139e4f2319ef8876f9
SHA1 6952313ef87a641feb0fce4e7b5bdede1ac1fa3e
SHA512 ff95914b9d28d84f5bf4692a70913c29a98ba9e185035cb3ea5be15e4f4f8c0f7be30a2256bfbf1ad6e5eae93eacc8428f1206e69510e5bd41dde8049ed7f3ed
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH7:xQvGAdlCEL8c/RRNw5CM2Tc5
TLSH
T1AC266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 08bc2a0e376fbbb148324e1b26e539a5e7f1291e75ab3da2602c6f9d0580c0fd
MD5 5468e8c5f28f26d17d0bcf2071c327bc
SHA1 d50a3ac0821104ab35ca757cb6c1149a107b0b15
SHA512 18f5d7f5dcf6fe92cebdd833f019128cc7e66fa363ef54d7ad11cea18b9aabaee165c04be0002e591ad67be60d8bde059e3f93ec485ca45cd816c9a97c26cbf4
SSDEEP 24576:bSewsAjdPne87HtO/DF1+9codjeWyZxeCEq:WljdR2TPod5
TLSH
T12115E030FE74D032D3BB0D721B76C716147C79604BA62AC3E3A89E9E58306D16776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c20d659cb001a06f3b457b4edb440faa2e275a1be1cacdca03baa127bd25c53f
MD5 3cbbcb6913acc20dfa89f6c014d83220
SHA1 0abdfe8090ca1d626f09f39bc30aa891d0323645
SHA512 d815c319af89a217b8193024252546e4388fb423a25d47533fb8a174e005f984b1f1aa0b12b8b70748850c9eaad71dea73daaaf274dede71b12fe3920a59b033
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHu:nUEtQevvqc2W1cpV2RI32
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7ccb0557a65cbb42ee7530d948912eeaa5a7b7307c5202088de4fc481006d586
MD5 ae46318c6be1a708f7675248bedfac42
SHA1 23af13657c69416b4b9587113eb7474363f10a07
SHA512 4a945cd2b540883186b80f2f8e39fa6eb9bbfb6807724bc5a986504ed536633517dc16ad5f01af53b55c7292f5b99a772b8c7474ec10a0d4733c575f02502001
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/z9R2TPod5:Doq2VjnmI2Tc5
TLSH
T177D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266461E2D33AE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 34cc5c732a61a0365bd9165d6ec24f4d5a4248af8dd7f64f17181abcdf0a8912
MD5 2bb7af4fa342f8002b6e66f2f3f9bc8d
SHA1 8c9c5b8f28df1dad3b2313784a8ec5835b2e1a31
SHA512 64d53e7fa191295cec5927cc73efd16e1f5a6f91c5920fa4f735c2a30d41b80a431110cfafb06b8a19515da51fc2cea03f0eb7b0fdaedb2309b95eee8b062341
SSDEEP 24576:BAhGL2IFoiwtA5l7S53SPne87HtO/DF1+9codjeWyZxeCEq:BAM1Foiq5CR2TPod5
TLSH
T10B359D80EBF945D4F5B3AA7899B68171EAB6BCA65E31D20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ee495430b32e0127589bd86392de61e3aaa5532290f7c151357205a4b1a74cc7
MD5 515a24af0b852a50072651820e4d694b
SHA1 7f4d2b821a4f6757a39fe378b857a32421edbb05
SHA512 bcde1f67ab8f9cf5fcfd883ae27ae1e005c204b47f8def15ac006b6c0eaecb193f8164fc9b36eb6c0985f7be66a588efa6334f080d4d82e2b08c2fd7f727b298
SSDEEP 24576:cwuXOWRPne87HtO/DF1+9codjeWyZxeCER:cwsOWR2TPod5
TLSH
T1B505F14977A80CF9EA67423985A7C136F7F2BC012A65E71F5760C65B5F33220AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6bec4b4fe39718ff98dbfb55933b75e6afc6ef09379084dea630a53001f2df59
MD5 6b248922305b47863ef83f0c86dc7e1e
SHA1 fdddee998a67400865237e1832f405ee2e45c031
SHA512 07f0b15559633389615d93e6f53178c353bd0557830c568e9237cd4c3c3473b419e3bb9cbc5c3b8263d5f8e075af459ac8ce980950d83b9999e3ecf3c63e539a
SSDEEP 12288:G/Z1IytPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yH:aZuIPne87HtO/DF1+9codjeWyZxeCEf
TLSH
T143E4139833E820F5F3A3423989F58605E3B17C9123BA63CF655566691E32ED49E39333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 766ad44a499265d3ef66121e8638378a9dcdfe2b0fa984cd857bf272de6eb16d
MD5 e1a2dcc07ec77c7f4b4791d946ddc5a9
SHA1 47e843b48ecd5796e15f2b1e0b8de8b43d6e4927
SHA512 f8c057d3549b5934cebb7baa78062c35a9645774267e90baa4caa909413bb167e4ff5df63092ae527b33bcab09de01210a417d742cbda25628aa0f3b99de9a50
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:CQRQyi36YOcPhLvw2gAf+PN3N2Tc5
TLSH
T1F3667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d066ac984e99805c6c7748cbf9f525d20f154031eeef8e737defa6de7b79bccb
MD5 ba58d59e129af1d1d06e6157bbf9237c
SHA1 9a9636d5210a0e153a6a360b902bde9ec1162bfd
SHA512 48f0cc574ef61a89997cc1f7a773a719fbe2be8c0e827c0367eec562d4eba220914ea0f0898852f131aeaf561a7f98ec1c9836127391cbd5fd7046b077ac387f
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:cQRQyi36YOcPhLvw2gAf+PN3N2Tc5
TLSH
T1FE667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f9327176ae939b255a912fd30464ef13aed5e8631130f0f41fab1f0627dd9e7
MD5 3fcda758732de9f0c78460b25c38eddd
SHA1 8a6e3bb7027c6fb74e13c90a85ecac99bf5710ce
SHA512 088a45202c760220ac9be399c5c49d48b106cf7e429b8b7123210009abd7659bc7ad691ec1b986393eaebd11fd8c61a641e35665042b41c24021bfc9a09f58c4
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL04Pne87HtO/DF1+2:o68Qg55nhceWu7PNU3/NR2TPod5
TLSH
T1D6B55A33B2F600A9D44DE1769F4A872196D17C718FE1E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a412955c2294fcd346a3ec5bfce6966afa54bb5d3e641856757ce09212045658
MD5 149247e9dec8c9e6577c2507eb723ea1
SHA1 477117284e184add32ae9a1abf102d11cb9674d1
SHA512 49f631fb6e82768d0fb3de465083f37c1fb1e2434c54b75b979cfc750833db965cae52df578be5d84720f1b4e391f7246c089c076157959ccffa58096e590181
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99h:Qy5112gYy5azzVva69nLKnhZq2Tc5
TLSH
T11E167B13F29900E8D05DD179878A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7bb28fd87bdc6a4789c440cca4ccb1c4bad5a566cb876c2b2d8e72eee619ed21
MD5 e69350c6c3a251492b0c6f847f45a6b5
SHA1 cabdc05c69e9c69b539f91524af48dabcb70d280
SHA512 7e5c00de98d57d5ecb58ec64e1b14d2a939850c23256efee252c381cfa459222d9b699fe13243855e9e23085ee75270875fd1114e45390591c32fe18be2efff9
SSDEEP 49152:QB+taZ3usBWOBr4tEG20bqx0z+n217aau1glTR2TPod5:Ku6JmUxd2dV2Tc5
TLSH
T19FD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 53f050c5d3c4849ff7abd113ba646338367e0dcd6defcf1240f303a3983aa21e
MD5 893a8450bde5fbb67f749a439d84580b
SHA1 f253ab7aa5769013a212df44a8299299bb76b62a
SHA512 cb4d500564c9f7bc9d9eda964c5f01d2c0dfdc738072b1b825098187b1eec555ba4a1cdc4519d5fc46cab2bd5557d525b72b45f4df46b14502c669561a48faf7
SSDEEP 49152:Z1hpsNoJpF1A6BU44CwH7R4xnR2TPod5:ZmifPkRI2Tc5
TLSH
T17AB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7054000490068e3bf44a635bc95f7984224de6ac48abc38bd4f015e94e84ed58
MD5 ce7cc950f490c5c7a33bd8e04fbcc88c
SHA1 ac84975c7f8c2f7f994b35ec9e7f265104303bd7
SHA512 189609f7924d7712262a232e88bc699667997ea361b40ee4ecc63bde076c5d81deea5f79eec608a7cd2ca5d3ae65c71561d026ed505f4eb0c47a164c76044e95
SSDEEP 24576:ufwvok9RX6wkyAI8Pne87HtO/DF1+9codjeWyZxeCEO:6MnYI8R2TPod5
TLSH
T15F35CF29EBD804E5E177923C89F7460AF2B178591B31D2CF129A536D0E33ED49E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6a831480879e62130abf170364efe7818cfefd70f1a143e71802d988783c94ff
MD5 5f392759c23b03e82f25d648a55c91ac
SHA1 486e9a8236cc1b3f03b62e4d26c418bc116f277e
SHA512 a773dc45a2dcaccdf7d2682ffeef95a3719ff3a637dce69b489e47e72c7fd024daeb2c19ba4b07a5215c941ac5d06a3c0dbdd656ec03221a1d8a7be0f1b2256d
SSDEEP 49152:dYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DR2TPod5:bySzPt2Tc5
TLSH
T1A4066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0e4f1c02990f2c38617847b8a2d2f2f36478a14979a86204e75885bf05392957
MD5 cb01a73d195642a19ea73fe0d01a9a98
SHA1 f030b86036c9ea9941e60cd7b2b62b539456f8fd
SHA512 f1da509a859ac603f555af34f2f4a04ffabd3a9b135afcf91f8f62510b2eb5a968a61b4a30e0fd138c17f632decea152901107196c00f01e1df48b4b3426d951
SSDEEP 24576:l47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYJPne87HtO/DF1+9codjeWyZxeCEi:l47JUQj4irIhCnDHUPfF/TR2TPod5
TLSH
T1EA65AE1DA3EC01E5E1BA823885554A1AEA71782D1F31DACF2270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c5e76ab762a597fe68e5c755484fc00d42c732188798b337d6ddfb05aa30b881
MD5 b2aa53a453393227e05ffb68242b01e6
SHA1 cf2655e8bb80666a2ba211e27cfe5844d7ec32e2
SHA512 f0f2f1c2570d999a631b16af7bb9544c85b0a3cb5b8da467161ffe03b0f19b9aca1d930a7d70704d8f5636873be4f958e7fe2ec76b34519618f839cf5304b731
SSDEEP 12288:dGsfIPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yK:XIPne87HtO/DF1+9codjeWyZxeCEC
TLSH
T134E40158E29802E4D16E5235C7A68641B3737C6197F6E3CB62C0F93E1F35A909DEA313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\ar-SA\IntelCommon.dll
Size 14KB
SHA256 d0db89c31a6f31e8579cc988dbc46269dc593673a0b3f5b13cc536bb58478f70
MD5 347cd783a6935f82c3b0427ac147f945
SHA1 c811b7c1c486437a0190ebd4dcfb5143b456e050
SHA512 361f5fae3d44422bb355fba058505d4b29a7675431386d409d78b688fcedf9f491bde457420f780c32099ada70e06af468d4bbe3c1fad4462dab212c14ee0866
SSDEEP 192:rBff6gmTCy9AI89kiLmEoXugAA2IMFekMh/0l:t8TCyi9JaXu42Nw/i
TLSH
T1246297519EA8D23CF083D374C557CA136218945BACED323E4A708F2969E46708F1FAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\cs-CZ\IntelCommon.dll
Size 16KB
SHA256 deb94557bd091d6bd78d791e9b7efe58f93afbc5c5ba7003409148fc32a07346
MD5 397f7ccdb2b5e067bb671e6ca61bcadb
SHA1 10bd858750fd8810d6158e813c0b54aeb4304fb3
SHA512 677965edb8f52e880e0528430e8a489f95cffd27deda22bd00c70e056e4a95eec4678300c939b4fea4fcc8b5823ba2ec733ba4044a13ef5c19e4acd2f5f49e9e
SSDEEP 192:3JMkF43WgxRKBgY6zxx7zypdYg6wLjp7:ZMkFWWgxQBH4Tzypag6+7
TLSH
T1B5721301A7FC0665F1F76F7279B206A25E7BBCA27A35D60F4650069D1870AC0EDA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\da-DK\IntelCommon.dll
Size 16KB
SHA256 100a77ce27129a8ab8de37eef14751cdc460bd390d6d647575694d0e130becf5
MD5 37d91b8b5111fd7924d8d849ef431d21
SHA1 0b259cb9c842503fc99a14ad5411076efd054f2d
SHA512 9c36db47da58ef640dd61a3d2b9cb688fe30e47e9c8042bd871e216ac8fb34fc5da570565804df07a3655eadc6765676d7d5046f3f39c151724ac12c0360ac26
SSDEEP 96:p7Fjk30XwndHkHSiV1pn2ur0brHmyWBkw71l3ok9FnuncdKw52afLNzO0GxziP8a:paMrbnV8TggnVqERq+s
TLSH
T17572F361A7FC1629F1F32F30BCBB0655597ABCA6AE39E21D0600149D1C71798DAB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\de-DE\IntelCommon.dll
Size 17KB
SHA256 c844ddc55e22df5d410e08c2e3d7cadbe05080d899a9091883fc120b714971e2
MD5 ca046b8ddd9cfdebc2d1ae29cdddf2d0
SHA1 1c846ad4dcd7ed318b3e4046de20bd2c3c222c73
SHA512 a81db34bb902ed7aedd9b07fd6b6a56ead22a3c2ebe1ff30e265f7dc0c1e0abb8a1c0ba371b145579c2085f61c6c1af3b816984b9021021f4fbd1802d9290279
SSDEEP 192:DWcQKuO6wIfJY29EP0txfimGd0YoABvR3Q/u8:2KuO6wIRpimGd0YoABvhQ/u8
TLSH
T19082EE10A7E95629F1F36B707DBA02946E76BCE6BE75E61E1700249D2C31B40D9B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\el-GR\IntelCommon.dll
Size 18KB
SHA256 8b531564af5548b8aae3ad6715f2c9fddd348a388f04ae2797cac085beae2d6e
MD5 5aefda25a95f3db045590c68de0f26bb
SHA1 82d986b0248d423ea2f71e84c554bea667803b38
SHA512 087df953084595bc329fcc6ca44d7e18c21e8676c1b34894135e2258bf6c4a8645278668ef721479fc4919bd0b7ade7340d088c598fb716c56e84e510bd12cde
SSDEEP 384:nCB38MJR0OP6fycEHApljyZwm1Rl36taTM:nCiIW9
TLSH
T1BA82398D8EAF1721DEF55DF2547385274A6EF9821420EE7B72F03049E86D8118DC3E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\en-US\IntelCommon.dll
Size 16KB
SHA256 a644cf1ac35d45db5dcc7903e7bdbf52d4e8c699e957fd00434d0a44cecf18f3
MD5 563bc33c2001879f50df328616dee894
SHA1 6ad68bf792e10db6604d77538d00f7e49b8c9515
SHA512 0681fc29833a211d54591d34a371f4eb8827fe70d86bc05dddd0dc03666650b515fbedf0a11625a2338e9c9c5a091fd12f2559014545b25e4e67e2255c6aa634
SSDEEP 96:3e01cAZwiw2u4p5DRI8qx1V1wo1g21yCOBTdv0EJjwxOLvdZuiyr/EWix29tgy3V:3eGR8/X3iNGs2zdr5Gnla1IUf
TLSH
T13472DE41A7F90628F2F73F71AEB616A44E7ABC62AD39D74E4600004E5975B44DDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\es-ES\IntelCommon.dll
Size 17KB
SHA256 6608618569df2cdb40380e768fc6c837cd46d45ebcceafadad86c4dcf2da9181
MD5 7535902dd0bd3f00ed3afb1cb77529a1
SHA1 c8564b13e43cd0c2aa9f9248fb61a27c1c894463
SHA512 a476f314da38965383cdabd77b1c1ac9a9d92ec3bff0ac8093abe3271b22af2d6b0f21912fef2c941729087d6bcd3f0fa6fc80c616912cd78265b216d0456976
SSDEEP 96:DydXkZMX1WxBG3wgcMuorFYUtmWnezlg5yuog9PPjsFYXkqT4m7qehgau3bRenKR:DydXkZuUJqQKPrBAL9cp7GDJE/Ql
TLSH
T1B582BE40ABF91266F1F37F35A9BA1A654E7ABC52AC39D10E8710156E18B0F44DE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\fi-FI\IntelCommon.dll
Size 16KB
SHA256 42de99c1f274ba5306067e4d7feed66015eb13d9ec1f306ee4a118a3283f9487
MD5 01117b33b2d3bd87072a595e1e57bf1f
SHA1 5121d5f8acaf052e313b31b42966cfb0c79a89f9
SHA512 c689c2478c70ba14cc484a1918a7f1861e1e4324e985d298f1871bfa172f69cb6df51decac6e70e3ff457372b9cc5918b691b406019c57405e39adb6f26aef7f
SSDEEP 192:pAy6lT6jKBQGEWy+JdD8PEEkrW9MXhzqTLDJ8qa/PNyRo:X2Wu5dDZYDuJ0Ro
TLSH
T14472D09497FD8664F2F78F70A9B656414A77BCE37DB9E25E0B00541DA830680E8B0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\fr-FR\IntelCommon.dll
Size 18KB
SHA256 1edd1c3e3d985a4d6b34d027fcd4da222b84c8485d38ca41fbabb2d666f19dbe
MD5 59f90679233993a80a4718611bc1a693
SHA1 cc9840b6a6efccecd65074b2e33e64d4cac99425
SHA512 824764299965158ced2df84e72e23d1512eee59c5248582ee88cfa0b4d2ef87e3de60df40738ea8270c62e897dec2e473cf5a9d9bab18ee6c97d0bc721fafe39
SSDEEP 192:fxH+rbZNs0CkyMkF8osnMkBCkspkI1kZUK/yOK5OdxNK2GuVVEbETXJaAh1G1q1w:5HcbZNu/4nL7ZU2FdxNKujwq1BpY
TLSH
T1C9826951A3E90652F6F33F31A8BA16514E7BBC9BAD35D61D0610548E2C70F58C9B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\he-IL\IntelCommon.dll
Size 14KB
SHA256 4525a9aa73ce85d70f279016bc0b85de1fd97367d8bd1d432651efa68889b04b
MD5 b32f73d43ef642b276aeea754c315fc9
SHA1 06af1f936cd1e387576876d70378d13aa51caba5
SHA512 0bb5d63878e6a3e41b25b8a1192dad028d393ea65d02d3409e2cb7a01805f080c358781233e0e691ce14d881fa63297370c423c22c797260854efe220a474395
SSDEEP 96:No9tYai3TSivcXgXLOzGXDjr3ELnu66HzK+ElZ6sfMF+KcShizF1:No9tocXg3TjcH7ff
TLSH
T16D529C81AB81C5FDF864EF33D76B0A2E9A64DD4825AD771B981818543DBC7908B1CB3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\hu-HU\IntelCommon.dll
Size 16KB
SHA256 61e14ba9957e9fdb8358a55a031fe109e464852d4b8471b1c2787cc07bad1697
MD5 b0ddff4f7a3db4217ace00ffc026cf90
SHA1 d5bced50e9a14f2b5bad5edc3c8367d0f1e82113
SHA512 76db8b4a3146c6f2e2471df3cac4d68e73ceaaaa35f4e9e617cdc369bc8381dd004ae5e00cecce7a441f418e1ec4bb28e5ef70fd2d5d7ae8e5d050b66c96dc1a
SSDEEP 384:bYJXxyMxRJ1JGiGqMs3ehgmfbOSMlgNh0sc:bYJXcMxRJ1JGiGqMs3ehgJSMAh0sc
TLSH
T13B72E341A3EC1556F4F38F727DF657960A3AFC71BA3DE30F8940928C2975680D9A0B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\it-IT\IntelCommon.dll
Size 17KB
SHA256 44454a486c705ef91d4dde9ff1233fbed9062c919625f849199c9279a6c31491
MD5 01ff7377905bb67cbb85779440459d4f
SHA1 894811289b5d49d6497fba7f0883b506d22e2afa
SHA512 bcc77c411b1e80a77aeb1daa79c055141bfb2dcdf9a13f39a865c338a3329e19d52939e1721ccf66fd31be24210f5b98628a0b9eed46539f324f22db856559f0
SSDEEP 96:rEe2Z4i9ymxjtthUGBU9NtkvcVQBJjbpPVbPPnegqeDdpWQG7s1AMyfRPa8Nc+Km:rElT9tdeMdX15ypa8uCwSHOzz5C
TLSH
T15582DC51A7F91664F1F37F30BE7A4A984D3ABD66AC39E21E0610048D6871E94DDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\ja-JP\IntelCommon.dll
Size 12KB
SHA256 4b194030b5fa925422c8213e3015286ad6d176c77d5c342fd0dbc7884dd3a617
MD5 9ae70559ff271dc7a5862cedaf6f966a
SHA1 0db59bdaf332587238b18a5c689b0f63e651e7bb
SHA512 6d67a19860d9f128caa879dce7cff56dd91d79397f5e0941981b4b62b6689b0e1bf437183fec19bb27c8994ad1bfd50f6cd93d66536659af9c32a18dfebb7151
SSDEEP 96:5RmWG2ikl3C1iP/YGglBaq6voE6YxBUfR92rsV8qShizF1:50fDmZPwXlBaHvoEnxBUfR9R2e
TLSH
T127420188F7E14F2BF4B6C6B004E77AA17A68FC28B6A24B571F40580F745860D4F46B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\ko-KR\IntelCommon.dll
Size 11KB
SHA256 7c1f389aad184cea33f451488d9ecce5992e8ec6fcbc1a22a259b32bd4b61e50
MD5 b2831b8af391f8b65d88130110e44020
SHA1 d2b5552b8c3aa025b74880bfebcff4bb67168f6c
SHA512 e2d5474b8097d664fca5495c20aacfa461b2798fd5b44814a44ecf0e71d3061bde12fd7822d7c662ab5f9151e2a1e2692a4156aa235a9fac6f775df8a15ba674
SSDEEP 96:rE08wvYNTOSuz5P29+nJ9nrrm5a4GmVYRmdWymhrFstShizF1:rn8tNBuB29+J9nreYRmPgM
TLSH
T1A632411BD6B8D133E0E1BAF60AE74796D219A421FA47970FFB00905C7C197948FA07AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\nb-NO\IntelCommon.dll
Size 16KB
SHA256 b79b9bde4a2ec52f222008cb7f860d903a7d1d6ed329b5cfa11de4a485a373ee
MD5 70d651a17a5d753767e2bd2fd17d9070
SHA1 22913b8f40d8e2b5f0fca95c0ced3b751c9ac651
SHA512 bc04f5696029ee359c8e887a458bb13b1c154f85d3ffee5beeaf10fbf27a80525f19b67dc2e66039b4b8c28b3306b9facc6f248019b573331eed51e87a562d1e
SSDEEP 384:qZp6Kaq6Kaq6Kaq6Kaqv/Pfv/Pfv/Pfv/Pfo4IYo4IYo4eRn+/spHs2A1N8Q:zRn+/sp5A1N8Q
TLSH
T1AE721590A7F90619F1F72F717DBA06555A7ABCA2BE39E21E0600105D1C71BD8D9B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\nl-NL\IntelCommon.dll
Size 17KB
SHA256 fedf4f4bcd6aab2a877f791b73e529db5f2c05d6b9b3bd26ffdf692d79f091a2
MD5 7bc823cc4ce020d7e4d03371b4f00344
SHA1 ad655f8818b273669e65f9406b907c9b04185790
SHA512 00e2191e94a5f705130fc0e144c43103d20dcc4732519eb6f5cd34f87bdc850be269a028e54f35b991bb3b7b897f0dcfa4a68991adb5f0dec64719a73db0e276
SSDEEP 96:lNxfCtdVTQb4U0sxr9uRidjw1WnWiVgb4bITFv01jJr9bdGRGj37YwmIxMFdgB13:lNxqSb3bX6qx11RdTmIfBN
TLSH
T1A572E211A3F8462CF1F36B707EBA16509E7AFC96A972D25D061015AD5C30B80EEB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\pl-PL\IntelCommon.dll
Size 16KB
SHA256 4de30dae532bb9b9f32b96b7edcd12c8ab436d17d0105fc5023f5a1ead36195d
MD5 3ddaf155029120a4d77dafc0a3e783e5
SHA1 ff89f1873308bc3813f947625345ef47fc4f1702
SHA512 66ededb16a2192e989742d4fbb4f85e4f0c2eaf0f54d631577ddb8a14063fa8713ec9d7b45b1809b90277c0228d80f8f36bbfc7d36edfd938696527ba7b538ba
SSDEEP 192:jbqNYlpldK2Me2SKwHgi6fbeltjYgR49GIPz11OtAV:ncQ2VSLR4R1gtAV
TLSH
T1A672E201A7F806A5F2F79FB469B626944EBBBC32BA75D28F5640440D5870AD0ED70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\pt-BR\IntelCommon.dll
Size 17KB
SHA256 1bcf4ec144f963cad0c2df6b2ebb36d6d5c16a08ec14c3a000f838ec3b036d29
MD5 9d84389801612edf1180a8126f856e7b
SHA1 5d6df15ffeb9f56b1e7498216a2a4cf341f97465
SHA512 ab50e8827ffb8ce20b81d28951e02b3788d8c927774f41a5d6f13ae196ecf08ecb61f1510e738c373a10f9feb26a174625d35a588f8c63f12e53488b62c8653e
SSDEEP 96:J9Ns+sFM331eukPRP6BtgnZt6rSZGxX97WqFxRWRIl4QIVbDj51CeVPAeGmxwGgm:J9NsebusxVK7PTGsnr1v6OQpZ9Ux
TLSH
T19F729951E7F91264F5F36F726AB926558E7ABC52AD39D20E4610046E2CB0F40DEB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\pt-PT\IntelCommon.dll
Size 17KB
SHA256 25cd9be0399f4393bd0434ddbe23b21e4264caf14814b9ffb94c5cdc7d828db9
MD5 5ab8dd75771ad2a2705dc8cf5f755d95
SHA1 6c2f00aae34dcdfd29e845f72cfaccd2e4da142c
SHA512 90d3565a7ceaf4ea8d709fdc1e31f7d044189cb1b6e473a35e40492ca3d11ed15cb2e7a7da890bdefb2a504feffff5aefeb61394287036704824226116be50f1
SSDEEP 192:JAgx2ZY6Bi7luVEfOWLYKsaTeQOYLxyqU1/EU2:L6MlsNlK5TexCyz8U2
TLSH
T11472BE50A7F81628F5F76F7269B91A658E3BBC52AD39D24E0620049E2C74F40DE74733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\ru-RU\IntelCommon.dll
Size 16KB
SHA256 5895ca4159ee04c0af5bf5c3fba4bd5b35afa37f60a17c19baff26e75e3e6033
MD5 407490adc33270c40851d8ab31923452
SHA1 a7d733d9b6b3d0282b0dda3df20b3a7a8569301c
SHA512 827af15014a2e33580bd48df6ef5bf42e409a19f3699a113186e2c53cc4443cb43f990bedb4f686314b1bd075c1ebff2581999e673af600a7211e04bfcea4f11
SSDEEP 192:JCFhhv9nBsKLmTs2Hb+ZLT7GYL2OpRanmxzNr:IpBsKLmY2Hb+Zn7hL2nmdl
TLSH
T15C72360FF6BD9960F458D2B50F6749E72069F710272692CAAA9FBC68602C33477346C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\sk-SK\IntelCommon.dll
Size 16KB
SHA256 686149d5acff54df46da37e205debd9041a038bc344bbf27b0a8d5271f2a8db9
MD5 85838cf8954c34c9812e1f42b1c54f7b
SHA1 f159cd42404658128925023ed5c20ffcacacd616
SHA512 5c87726a870a29aa437d36b15380c0ed98e8370ef4b146a31e8d2e72f295bbdec77153fda9cc26c1a079375a49144ab595a3e2adcfe57c6c07b6b6a7c0b55bc8
SSDEEP 192:TVS4QNBfhkuURzhe9se5k7kLHEOKD2NqMq3oDdxAUUL:sVfhkuCzhe935k7kLHE2Nqn3MdxAUe
TLSH
T10D722252A3FC16A6F5F37F75A9B206A54E7BBC66BA39D20F4500425D5830BC0D9A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\sl-SI\IntelCommon.dll
Size 16KB
SHA256 8d3b63196c735bab0117d7465f65ad17e47a719a79cba945d6283edd02c2dfef
MD5 cd97fb067d641840961efb66dc0f61c3
SHA1 1c8ea368ca2d86de9ecf3b415206d5fda3c65929
SHA512 b5b4ab2e55816f92864696657692d92204ec8ef5cef2f249d0254a2407700ae553ffd68585ffffcfe032aee793b065278b170f9a0e68334f2370e13469657171
SSDEEP 192:/l/In126m4OeR/+kZwAHG6USfBtREpkHqxSz8qJIpAd:m126mrB65tRbvWSd
TLSH
T131720042A3FC2259F4F76F7069B507A58B7EBC75BA3AC21F4200129D5862790D9B0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\sv-SE\IntelCommon.dll
Size 15KB
SHA256 b30c222193ea94918858ed74091b5abd39c1a98a4dad53bccad4ae44d083ec3c
MD5 4f9d858126f90b116302a9ea7ff154e1
SHA1 7af0a4f3e871735626215095b13597ed222fcdd7
SHA512 b612f60a7c9ad2eeac45d788347c521467ccb0e9ece04d1615487624ffa0d6e989b0985dcda1aba3195dc76d0a369a7edfbe1c401a04732f0153056a044b9a78
SSDEEP 192:nEh043AoyvpTzrsRevdm1bqtWCCU85d3TEG:541yWAdmqWhU8DEG
TLSH
T169622381A7FC1668F5F34F70BCBA566059BABCE5AE79E61E0600059C5C34B88D5B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\th-TH\IntelCommon.dll
Size 15KB
SHA256 69922d80cc4ba3e978da317e63fd2fde5eacd19cee0c1dad1ae3353f286d4a4b
MD5 ba49c78cc3a0783983d4f34d8b7b40ed
SHA1 973e182e859efd7302d8cf32d585d8e33287b889
SHA512 77ff9052dcfc603e3ffc66f07c1f6ef236f8025a6dcf511b462cba29cf8c503d23c3cc52f8e80f54dd4873e68a97810b388355ae646fe9978711e6b9013c4351
SSDEEP 192:7BzeO5P1U252kHCzg+cOWA/x5desFUJHW:VzhI2HCFcXApresFUJHW
TLSH
T19D62BD35E7B21302D04AC1F0D2D25EA37D2CB812E45B9246C56FEE28B560A746BF1D3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\tr-TR\IntelCommon.dll
Size 16KB
SHA256 0349fc3c102fab0613194479f0badeb6eedc617af5bdf82471f32d90fafe2183
MD5 03fc7c44a310ef67a72709a50e051c4d
SHA1 c260dcc15117ce6faa4feb1aa8706925a531ae8d
SHA512 5f1173d9b02dc907cbb03cc46b963b475ffcbb056d3bea388f13e8886b57286bc5f90171dce1f40d299744479a8011ef3dfc31372ab090953fb72fb51f19479f
SSDEEP 384:KtEtHk8ZMHqRDEbTovRIfoE6x1qRgk53iALmU2Cz1l:2+ZM2u8JIfoJxuZhiALmkl
TLSH
T18272750493DD5A2BF6F31F753DF6A6810AA6BCB6BE31835F1611601968302D48E64FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\zh-CN\IntelCommon.dll
Size 10KB
SHA256 f562b02692e8b2de189f67779902edb2c2b30c75c1bc84f71c44257f842a1fe3
MD5 3b563033bcad184154ba1ed9ec7081d5
SHA1 6e6cdc6dbc0706c1e765a2b0cee7dfecc4de712d
SHA512 c1fe813986ff01f49064173f4f5b8a01e3306500a50adb4a62937994130aa5bdca0a995d2ee7f05e461463a336d04b95f2ee7a3ca60212ac324f152881ce0769
SSDEEP 96:xZtJFiUOUg3T5bGmw/gqmfaf323cx+Le5TSnR1AHShizF1:xZD7eJGmwgqmfavVxYS
TLSH
T12C226385D7E00E3EF2A3463186F34A12B73AF8112A674F0F6D40699F388C7219EA5735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\IIF54DD.tmp\zh-TW\IntelCommon.dll
Size 10KB
SHA256 28050dc6ca7b6aea973692e61b7ef790ad656910acc7fddef4038dbd15eaf6a8
MD5 ab8d84de1e028787127e0197708fd65b
SHA1 26652850c5d2688ab0dbab4a69437d44f0b9fbb4
SHA512 ad95a3f6229a03aaaaa710fe0d0cc0a317a8f5ef615b62d4a9f748420e8680b74edb9b3a3627317ef706c2fa3a8a9682e82763cbc352e346bf5f5ff3edc59c34
SSDEEP 96:nf+/1GHhAGaNhuzmDRI/C2VkhW3a5lj3YlWd+uOU/HIlmLTvS4ShizF1:nf+9tBznDRIK2VkhW3uj3pqlmPSI
TLSH
T125228584D3CA052AF0129A349AE349F3AB7EBC133666A31FAF40485F78506049F55FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntelME.log

Path C:\Users\Admin\Intel\Logs\IntelME.log
Size 7KB
SHA256 b74e78c6e1579fbfd2a046809e992cd658f44b8e55345341af8fc593646bb81c
MD5 b392abe8fc2d711e9809db47aa609727
SHA1 71626cb5aae0b861be730e3289de882e71af3b7f
SHA512 f91e286199324ae1a0f419f3123d2550ecf2e32a324f7a2f3e4ca3b8a9849e80e7c67085da0cfc7057eaa25a8333c2ae99a3ed0272f3262bb1cecca77eccb196
SSDEEP 192:66cHDUpzUlzAoLVvy8uL8vN5onH96MonHUMonHTMonHm7MonH2MonH5MZ5onHbM5:66cHDUp4l8oLVvy8uL8vN5oHcMoHUMoq
TLSH
T160F15C7F5AE2059EF0B2DA13CAF7822365B17E897534361C25C8834A4B93145B5C0BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f3d1c5e40f7f5cd67a2bed2cd4d6e9a5ecdd140bb46f288413482011afd0551f
MD5 7b2efc6a2d0c7124ae590cfd6069a9c3
SHA1 1ef427a62ba7db17cf48bd9ca96a56578477c29b
SHA512 f04e45ebee1161f425c5b39bf435c76dbcc5416992b24ceda0214ea28a527b753abda5d0ee3e1f410d8d6f42ed6ddb4f21ac17f71cc7895230901e256ff2155f
SSDEEP 12288:FF7QPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y5:zQPne87HtO/DF1+9codjeWyZxeCEB
TLSH
T1EBD42390FBAD05A1F776063205FEC11421A57CA06BFEB2CBF4467A5D5030DA4DEAA327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e46c94da36d0fb4068cb071509ee33de1d90b05b136d4e7d21de10e061937f95
MD5 62c7073e0aeecfc64dae79d102406d20
SHA1 b77a3f51d2d4c01977bc4c95e08f720450a3fd29
SHA512 77cf1a0ddd826aa8051c07f9cdc1bdf4358fc0aaee9bf3622dcad72cb21ad5206e40af69cc30d2c27616959512824613563c9906715fc5d19df2290927118f86
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYePne87HtO/DF1+9codjeWyZxeCE6:3gb4mBIBhGFJR2TPod5
TLSH
T1C765AE1E22EC02F5E1F6D2B88DAA4417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 2034ae31b531da66ee05e90962ca0819fa327b00dfa767329a6cd0e36eb2c4b5
MD5 4e5fb900b2cfa1572b47b5ff87171dd9
SHA1 e51e8c4ceaa103561cbee1d897fa20925611746d
SHA512 952fe28114435f01065b732ad14551f471750d72c7fbd96fae497e979aea68a12a6408f4a386e52cf01ac99700d0f13f60c41c1bc487ee2367adff58d93ffa0c
SSDEEP 24576:3G88u8FpJqH1Wzria7/m5Pne87HtO/DF1+9codjeWyZxeCEm:27ZFPqVha7/mR2TPod5
TLSH
T1D635F165B7E101F0E477D13889964663F6B2B8210374FBDF06A88A551F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4c6f0e258dbdf642093cd8cbfe185b4fdef5680d49f153f3dc90c42048601cad
MD5 02fa415a13c4e30bbc6394b45541fa08
SHA1 0399033715f4fc351599f14337db477184bf54a5
SHA512 d6f0a931285ab63795317f53e3c9f618775c3284e6bce2ca587f2161bb25ce8d806f7226155724ec9bace1e71ca1129977b92a083a3543437ce3c3c7ffea331f
SSDEEP 24576:APUr+NQlPne87HtO/DF1+9codjeWyZxeCEX:AJQlR2TPod5
TLSH
T15105F12E62AC18E5F676A13D85968709F37178621352E2CF02D1917E4E33EE8BD3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2c6387f829e9cc4ede14421297561e6e90fb2e56670a4286bd113dd5fca62cdf
MD5 ee9d28e30721f8899130778043e573fd
SHA1 85a2dfbc26788fa03b89c6d07d524212e9b27b4c
SHA512 5d7d91c8d7ddefc87de2a7ed694dacd75ded8f658352daa8de8129024c874784d35931ed8e5702268b63aa6d377d8721a10d43626acdc9872a8ade8212a31c70
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVR2TPod5:oG05lO43bC2Tc5
TLSH
T1F8D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 757c01a27f9f7d75dd6c8284f6e430f12ffef3e46e966153fbb6cbda5abc7c4b
MD5 9b2eb629f0642399adfcf9ee43baba1d
SHA1 97e001e8b01e26a289c7ba59b1d971c79d128e66
SHA512 fca042efd7b88f392a5f87bb947354449e0bfe5cef491a1e36c40204cd535c7683e072b70fd83c11ff941ca0ffe2645551c35562455ec69f4e9d869a3a065d19
SSDEEP 24576:zfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnDPne87HtO/DF1+9codjeWyZxeCE6:La5POZ39Jt2pasx2+mNR2TPod5
TLSH
T1F665AF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5b84a7e1918bb5ea089e8dd9cc979afc45db7280893c03416219e251895a4c49
MD5 4008a8fee0e70a0515f10dd2586abd66
SHA1 bd489c5d2599a594d810cd462cf65e547692b35a
SHA512 1b929eba4db382ccc10bbed608553d2a55cef35ceb84135d2ddb95ca76ca9fdff4eb3bc6419dae20498a367676d956bb171c9075f157957093dbd32b71d23b84
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkxPne87HtO/DF1+9codjeWyZxeCEv:oNc/zEOVHFGR2TPod5
TLSH
T14E857B1623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29afb7e0fb3096ea4eab6c040ba4ee9279fbb927ef9b1616c46fab4fab352ab9
MD5 7cc27811b108dd22b9c972fc34e1479e
SHA1 70a278d00cf14d4dea6f9ef8bef4645f29f970f9
SHA512 ddc6c8e78411bd907a9baa43da2f11a721820d9a1a929eafab08f51a28f6f7eefd1af14887d0ca58177bb26761e5ced39d79437ad1f44c451aa9a7292d101615
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBmXPne87HtO/DF1+9codjeWyZxeCEo:ZtMwBtOmXR2TPod5
TLSH
T1C455AF6EB6F806E4E1FEC6758D238512E6727861173293CB9290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 57fc23b9ae052f37ff7ef4fa2fcdec994ff09328272473e1d5e280b0fb712c30
MD5 f69145655fed17979deeb728dc869d9b
SHA1 9a628c1d9ed6e2e21a2a052dd27452ceaea430b5
SHA512 fd2c8c84d0c4f14a128b575fe2fc9c0001ff7c409d06efff9b5a2cce7cb69fdeab98613bcef9280f257c1a25b0cbe13e6129da898b86384016c5614527a199e8
SSDEEP 24576:7D3FHshBIYQgA0Pne87HtO/DF1+9codjeWyZxeCEk:7DVHeBIAA0R2TPod5
TLSH
T1E625E17DE79C04E4E57BC17C86A38A06E37138A9033666CB11D491BA1F2BEE46D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-423-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1964-417-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1964-162-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1964-599-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2068-495-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2068-854-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2068-493-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2068-501-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2592-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-505-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-124-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2592-116-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3216-447-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3216-445-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3216-453-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3216-765-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3364-2-0x00000000027D0000-0x0000000002836000-memory.dmp

Download

memory/3364-0-0x0000000000400000-0x000000000093D000-memory.dmp

Download

memory/3364-8-0x00000000027D0000-0x0000000002836000-memory.dmp

Download

memory/3364-6-0x00000000027D0000-0x0000000002836000-memory.dmp

Download

memory/3364-464-0x0000000000400000-0x000000000093D000-memory.dmp

Download

memory/3364-822-0x0000000000400000-0x000000000093D000-memory.dmp

Download

memory/3584-524-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3584-530-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3584-523-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3584-855-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3724-481-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3724-482-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3724-488-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3724-850-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3724-852-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3728-507-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3728-519-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-506-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3728-513-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3728-516-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5352-476-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5352-868-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-475-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-471-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5352-853-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-866-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5464-462-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/5464-465-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5464-849-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5464-457-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/5792-137-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5792-150-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5792-144-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5792-138-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5792-148-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/6028-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6028-468-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6028-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6028-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6028-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download