Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe
- Size 5.2MB
- Sample260724-w2gpbswcnc
- SHA256 c73c5c94959a27fbebc64d47cdfa47a9c81bb154bd7055f26076e527caf8e7c9
- MD5 02b8ea03771cf4b830722b073dfeb9fb
- SHA1 21ad70248633777ff4dcdcf56a0ef72941ad00c9
- SHA512 63c90efd57d826ae40746794bf419d7a8ceba932d2b40191b4adcf35c691fb40975ae47da743f0aadd01e8988668f18ef9e4899460d3bf6b101f268fdc9a5a2d
- SSDEEP 98304:HejvrSd4Skl3Jfy/gsypOe5qRZZXYz8mOzwOVa+2Tc5:+jmkFJqhypG9kdm4
- TLSH T12A462312BD868133D66802B96D7FDA99806EBD409B2560C3F798779B0D307D3A237F46
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5508 elevation_service.exe 5888 elevation_service.exe 3956 maintenanceservice.exe 1936 OSE.EXE 1692 PerceptionSimulationService.exe 3632 perfhost.exe 6044 ReFsDedupSvc.exe 2364 SensorDataService.exe 4536 ssh-agent.exe 3692 AgentService.exe 6036 SearchIndexer.exe - Loads dropped DLL 27 IoCs
pid Process 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbengine.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fa2a1b5583806d8d.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea1aabc6991bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006527a5c7991bdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c6bb7c8991bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fd0e5069a1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000356efc6991bdd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5508 elevation_service.exe 5508 elevation_service.exe 5508 elevation_service.exe 5508 elevation_service.exe 5508 elevation_service.exe 5508 elevation_service.exe 5508 elevation_service.exe 5888 elevation_service.exe 5888 elevation_service.exe 5888 elevation_service.exe 5888 elevation_service.exe 5888 elevation_service.exe 5888 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3868 2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe Token: SeBackupPrivilege 6044 ReFsDedupSvc.exe Token: SeRestorePrivilege 6044 ReFsDedupSvc.exe Token: SeBackupPrivilege 6044 ReFsDedupSvc.exe Token: SeRestorePrivilege 6044 ReFsDedupSvc.exe Token: SeBackupPrivilege 6044 ReFsDedupSvc.exe Token: SeRestorePrivilege 6044 ReFsDedupSvc.exe Token: SeBackupPrivilege 6044 ReFsDedupSvc.exe Token: SeRestorePrivilege 6044 ReFsDedupSvc.exe Token: SeBackupPrivilege 6044 ReFsDedupSvc.exe Token: SeRestorePrivilege 6044 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 3692 AgentService.exe Token: 33 6036 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6036 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6036 SearchIndexer.exe Token: SeDebugPrivilege 5508 elevation_service.exe Token: SeDebugPrivilege 5888 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 6036 wrote to memory of 2144 6036 SearchIndexer.exe 101 PID 6036 wrote to memory of 3276 6036 SearchIndexer.exe 102 PID 6036 wrote to memory of 4552 6036 SearchIndexer.exe 103 PID 6036 wrote to memory of 3944 6036 SearchIndexer.exe 104 PID 6036 wrote to memory of 1080 6036 SearchIndexer.exe 108 PID 6036 wrote to memory of 3216 6036 SearchIndexer.exe 109 PID 6036 wrote to memory of 1088 6036 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_02b8ea03771cf4b830722b073dfeb9fb_coinminer_darkgate_elex_maze.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5508
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3956
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1936
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1692
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6044
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2364
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4536
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2144
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3276
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4552
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3944
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1080
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:3216
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1088
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 ab2588163a862e9e41fb2c722f7f830f5ca1235b42e53e5e56f5544885c708be
- MD5 188811ed4cf2aaf5594116f84d3c2e85
- SHA1 d4c4850dc0dc102709b2c7dee64ab629a6c78944
- SHA512 f770bf420e869c2c75a246eb3fcaccb90220b46b16105d48f87eab6f4bd1b6d94180bae508298e9fac8d1a9d04465feb5235c3aa8b1faf523ea75cd1e4b982bf
- SSDEEP 49152:1b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnGR2TPod5:L3q60jBP2Tc5
- TLSH T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 471146a49b7a0f470c2f8bdcc9d466021403775ee71c7cf804860ddd69e57097
- MD5 c5761c51dc808f6cac18251f4a4fa730
- SHA1 e3f3c3db7954db86dde4ffa4be2d68f76aceb2ca
- SHA512 b268be0fb493baa82292e8a559e0b509e9e25684c7977c28d93cbf586312f8e322125c5167ea9cb448eaa4695531e1bf31351a6a051aa211c1d7f4778f253349
- SSDEEP 24576:WXYfDtczA5Pne87HtO/DF1+9codjeWyZxeCEX:VtcMR2TPod5
- TLSH T12205F128B7E408F9ED678139C8F28501E6737C9147A4F78B03E4A9291E336D85E3E752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 74a9068e2a051ae9e6feb745c160d2f66b8b7cbf299383774b7a9171e67b9b8f
- MD5 f4c8a29af2eb8b3c7469cac4a37417c5
- SHA1 2b946d00eb21418fe150cb8f8b1731bd4a098696
- SHA512 f50ac187bb4f4ccdc7a520732fbfa2c3ab4a61b3665d0b334df4207278135359da70953cf52879396e1ae2d77980c0c849b2418f36389f3c008974cee4a53e97
- SSDEEP 24576:A0Le5ji0hmxNrM+Pne87HtO/DF1+9codjeWyZxeCEe:APji0A7LR2TPod5
- TLSH T13D359E55F6748331D073C0B9C5D2A68EE97230825B308ACB5286D77C7E67AE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1e16d5b11fe7762362be183ac08df0ed7a1773e179586e065241cb2caf8864f5
- MD5 c18dcf25d39e6ac97a166b4c54fcb0f4
- SHA1 8fe65fdc64e5e3c06b1bd3ac590ffdb5b80b846c
- SHA512 f372773be984572a21bcaf3e4f8ba05bc97d9e2fff0fb082abaec70a8dbb5790604318a0016721a58eb2e61b12e41a14ce1f561db6f0fe0a3187d0771aeb30b6
- SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWr6q8wyucPne87HtO/DF1+9codjeWyZxeCEy:D/ezSC6vUzPviHjy/R2TPod5
- TLSH T1A2755C25F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E5C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 264b1fc2a9e7008d0569871972a28fa5159103d5879d48b2d3ce8a7bb353cdb5
- MD5 42c44fcdd5a02302b87f163cef478143
- SHA1 400e7024ebe7e08312a515a7200b176ba58f3659
- SHA512 9f12bd31832be91dade7a2e9e66b8ee0c0afe395fc863b3d9d476c13e535c34367856e6dc11b7b9f41954cc8e507ef702ecd7ee57de5de6fa490cf00d89afe86
- SSDEEP 24576:WVbqPb88hv/l+blPne87HtO/DF1+9codjeWyZxeCE6:WVO88hXl+hR2TPod5
- TLSH T10055AE65F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE5D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 7590b776e08e0d18e1021f094c5fd503f38a9d3813766c6a0c001b3234083a0e
- MD5 2a42d2ed8a9a666abcd8b4a11359be25
- SHA1 cd47db9d0365d9a4e3cd36fb71006ad23331eea7
- SHA512 f048736edc8f542bd7b7e63cde4dd4b4dd9f395d53175adb04bdd85ff88bdf49b7520c0ac088de6f3f12b10c9cae677c98f45830c64576c9f35dfddf4421a350
- SSDEEP 12288:RjqPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yM:RjqPne87HtO/DF1+9codjeWyZxeCEE
- TLSH T1B5C42394EBA901B1F7B7063306FE894521B15CD0A8FEB757F4867EAD5034D28D6CA223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 5ae3baf8640e53549d8d3ea9c67de0f23d8f0fae9e3272a2bf0c865e7a95bf5f
- MD5 06e23b04139007f1b9d0686272fdc728
- SHA1 a77c72b9ab63e1fa34346f009513e7305260cd0c
- SHA512 b7b251d58289650b35dde371bba0594916eddd8fd244f86a4f5ee248750d6cbbc3b512b5d7b8b3fddc0243a22d7c403ea72ec8e85ae0eb0d6d07612422920c0c
- SSDEEP 24576:mJIUdPne87HtO/DF1+9codjeWyZxeCEh:mJIUdR2TPod5
- TLSH T12905C07BEE28FCE2C27A4D795791C600D77278704F62A3CBE165820EDE235E05E79825
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 de1de0fc52a9511fd46f57d9acce26db32b8a304fb0801ccffd0a355e5e3cd0f
- MD5 669198ec3ad32bf766a6e6a7408d46a8
- SHA1 15a72bc05d83198ab037f6484c2406caa2706f0f
- SHA512 4935900d911267d260e5f5f50f30cf82b12d39b489b5257d239db60c520c39dd1674c4175357ad6c9104f35a5d6cb9b27d4ddb5231e4e6b2e728a95e898ca6d0
- SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THp:0QvGAdlCEL8c/RRNw5C62Tc5
- TLSH T1CC266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 55e08cf06897f4f6826a26a10be7a254b1956145b2b298549c7c8c60d83dbc4f
- MD5 50d8d1e3660fab5514ba179b6b278082
- SHA1 954b7216f4b1fb0c1973fbef554a53635fc34ac2
- SHA512 54def1a8ddd20f6669e10980fff57541e4daa76f76c65b65807473380f74aafc6c8b4c17020826c036717a04b5969634f56b5fab7917a54c4feceb7153b5da6d
- SSDEEP 24576:kSewsAjbPne87HtO/DF1+9codjeWyZxeCEQ:3ljbR2TPod5
- TLSH T16615E030FE74D032D3BB0D721B76C706147D79604BA62AC3E3A89E9D58306D16776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ba5eb661e9120808a942d5572db8a10d4871e428ce5faf7d65eeadae73fad9b7
- MD5 205be8e94f1583327f247f4ad9300e91
- SHA1 53f51c5581e1e87ab6e7bdfbeb7c4a5410e8a9cd
- SHA512 6e6eeb609bb156d8926ccfee173da4a2f445a77929758027de1f5275c081e8209d9a4fcf58b675770289cbd4b4a291bd03020455ce17ceb0689af0a13a06febf
- SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHk:yUEtQevvqc2W1cpV2RI32
- TLSH T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 40462b52c13de9abae36299b8f94237476f529332890251d2462bea73660d74c
- MD5 8d3d24a44bfa9c255476cb0cfd36fa51
- SHA1 083ce5557511cbd3c441ab1e4e93cfdeaba4f16d
- SHA512 2d46ca9b35c6805f17ff0b45e5105acc5ff2e57fd21beeaca62b9ff5e4d936804de87f248f25936dc6fa522d6a02c7d72961198bca69fb59b85f120c622cced7
- SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/z7R2TPod5:boq2VjnmW2Tc5
- TLSH T11FD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266461E2D33AE48E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d997cfcaa0d561f5548741cced1cbd1b018f110b2b3adcb06b533e032f68d7c7
- MD5 f23d79ddec89ee90df1b7839c74145a5
- SHA1 3e554f53879cfb1911dd99c98adcc78f24f7f298
- SHA512 dbc89b9a66b920a70dd43ff8d99cd49c8b98805756ac5068e76767880522ae731f6d0532a75520580bf96dda9c3e803157bfe95be7069fc34837ca8460239763
- SSDEEP 24576:4AhGL2IFoiwtA5l7S53APne87HtO/DF1+9codjeWyZxeCEe:4AM1Foiq5wR2TPod5
- TLSH T19D359D80EBF945D4F5B3AA7899B68171EAB6BCA65E31D20F2150D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 2bd44177545967ea48fc96c7194cfc457a40fdbddabe359595f056ed3d41dfcc
- MD5 aaea97149d020546b5d39962a41e6388
- SHA1 81e3ca0a3906d3addf6e24061640acd6d18938be
- SHA512 eaa961e1bc09c517e167ca34e22e00df2e41e6d4180fefb61ccfdb85b022ce903fe760369dba937129736b5d5430f6dd97b45967f0ff4d62903ae6787e673f25
- SSDEEP 24576:HwuXOWfPne87HtO/DF1+9codjeWyZxeCEg:HwsO0R2TPod5
- TLSH T1C405F14977A80CF9EA67423985A7C136F7F2BC012A65E71F5760C65B5F33220AD2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 2dfb5726b192843fbd45dd8b2dfaf258e94e97d72223314781784b34bec20d99
- MD5 9e6d8479d9745523be45b1fedb6af6b2
- SHA1 7a47ddcceb1315257cd06ee59c576248ffbf0933
- SHA512 d951ad1a0e4b8468b589a8770ef6011aa72c2e9ceba1e361421943e12987235d9ead04a0b171c8ee876a7fb65ce44f46fa2e8b4587e0310e23058b4d28e7e234
- SSDEEP 12288:4/Z1IyrPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yX:8ZuWPne87HtO/DF1+9codjeWyZxeCEv
- TLSH T1A5E4129833E820F5F3A3423989F58605E3B17C9163BA63CF655566691E32ED09E39333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 81a0739adee214f07f98a5c482c0c258a115715be931e123337cac80b75933cb
- MD5 6ab5e42c5dae80dd5883b3ead5bac91f
- SHA1 9ec4332fbea4b568a0dcabc8a6ba25f93a80c348
- SHA512 e18b8e115e3a9239056f13fe633a25c17087d402d5f3bfb56cd198313b644c0455c6ab3dcec5685008d20c99b54841008ca0a1eb51d74c2535cc562620cdb9d3
- SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UN:AQRQyi36YOcPhLvw2gAf+PN3j2Tc5
- TLSH T19E667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 9cd197b277dcda9a8da050fb2a82de7923af3089fd7458b2579e2e4b2fcb6f5e
- MD5 2eeec4e34a0d4b5f957bf8a352d90d5e
- SHA1 27e3805d1999df6bafe6066aabc0a8f9489ccdd9
- SHA512 e208fcaca4034850ca5b58746fd0f1e2be99c57a42e0d0cef5e7c648a7a37be3fc845aa53882c54b8167e1a41e71bdb66bf5246e9850121c7e94f0ca3b64a978
- SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UN:dQRQyi36YOcPhLvw2gAf+PN3j2Tc5
- TLSH T156667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 506f3dcdf5429ae5186e95b0815765ab07370d25760244d744fa3f3df0aec0d0
- MD5 96eefbd1acadc0a09fa7798586cb0489
- SHA1 af8c99db9e4cc9ac3ea5b574feecdd7bff93f9b0
- SHA512 e20f6afe9bb49ad4e3d5a594182fc8e985d6911cd80240598a4759b17b6c7029e0e42460a50ab636c691b8e57cc7ecd3c20a466210968a663c4636400d9f9c26
- SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0GPne87HtO/DF1+c:r68Qg55nhceWu7PNU3/LR2TPod5
- TLSH T12BB55A33B2F600A9D44DE1769F4A872196D17C718FE1E3DB8501721A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 146e4e299e39fbd23f4bc9c5810e5286d77f57d8a92feb6bbee79c6e596c538e
- MD5 d72b780dc7d8c34943594b30e5a6f441
- SHA1 573cbf321856c078b919754e1bf66820aa40917f
- SHA512 e3986c2bbf6230937561d00971c77bf3ebef1899ae69d3f42807c5cfdea3126ac1e06189386767c1bef5bc1a2c137af9e68008f3aa74426b69d8020ef67ff081
- SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99n:Ny5112gYy5azzVva69nLKnhZQ2Tc5
- TLSH T122167B13F29900E8D05DD179878A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 3622590f996bc7b186eb387b19b4d088b7576cbfc17c150c72f2aacd86b10aed
- MD5 a0e4d8fc0154958f45ee532ba2812772
- SHA1 1b4c4f9492574d58f34ffb2db4a069767da6eb7f
- SHA512 209683c0ce2eb089f6824e73504e32f7c6b1ac245056af9f0484b12e9ad1ad9206b8150a0ec42087ae84b0102d0a3f0c4e9cf59e157964906cd157cbbde16dd7
- SSDEEP 49152:qB+taZ3usBWOBr4tEG20bqx0z+n217aau1glpR2TPod5:4u6JmUxd2dr2Tc5
- TLSH T134D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 46faa3c3cf82f206627feb908fc7c4c5fd05196d3dcab462a84dd1d8d7148440
- MD5 4de6b2dddb43d087a2ddac0ccae76903
- SHA1 f8b361d99237a6c9a2bb0b6bc8c9ebe28c63ad43
- SHA512 47cdf203b03084cc4cbf8d13875807f1de449a2dd47d31756c637b9e8d6de6a4b1df79547b4055a0f8d749ff0f97d92193da6602b3a3e7f0e9113380d4d7f165
- SSDEEP 49152:Z1hpsNoJpF1A6BU44CwH7R4x9R2TPod5:ZmifPkRW2Tc5
- TLSH T192B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 a7ff4626c9e605509a1bbf30b9b731e47b16d4ee0a69398a585c59ad2b75c72b
- MD5 bf8c4ad4ef0b394e92b92e85c72e5751
- SHA1 c1f91b98481ca15f48ba39a4c28ca90854d4b285
- SHA512 558f8e1b97912536b69f9e0cb4b3aad4cc58e8a52c66cb2bda2fd1ee3861420102a535839b2b91517705ba989956e234e23754baf73fe688edc3d72aa45501c8
- SSDEEP 24576:bfwvok9RX6wkyAIKPne87HtO/DF1+9codjeWyZxeCEz:9MnYIKR2TPod5
- TLSH T10C35CF29EBD804E5E177923C89F7460AF2B178591B31D2CF129A536D0E33ED49E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 0046ebea26f83e7f849e370be409bd6e7fd5f5cecf95517c2fd4b169943214b5
- MD5 0a6a8e0b66cf1ee1e3bf1b54f18a2c69
- SHA1 135c3d59516f0e62861bff1c903a360a77cfec3b
- SHA512 290f35c231ca85bcc6151a7add377354b1290285b76f60cefb47a37716855f37a75ca01e9d96b8d3c6cb0bc8ecfbef8ffae560368b0e861c2816e91fba3f502a
- SSDEEP 49152:QYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZR2TPod5:IySzPD2Tc5
- TLSH T10F066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 cac38d145bed2d7a24d85c4ffb8156bc8410c27bbcbf22b24a40471564bc41e1
- MD5 9a76b6ce092c62727e445511c6a9db58
- SHA1 1021e5627d3b65e02f38d1c573c09e5ffba3e2ef
- SHA512 bdc2c01a4a5e1f8d93b5595fd7a645633087071945e89b7f1e4fe57428b19169d5dd5ef49ad66f0d6a09632c329fee3b743f7cd7152489fbd9a83954ec2d34c4
- SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY3Pne87HtO/DF1+9codjeWyZxeCE7:p47JUQj4irIhCnDHUPfF/pR2TPod5
- TLSH T14A65AE1DA3EC01E5E1BA823885554A1AEA71782D1F31DACF2270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 6d7b41ca80c9891f7bce1ad0a26468c0f8b23749c73bb359ebd1642a7dc061da
- MD5 7e5d09a90991fb220cb6ae95311e3cf6
- SHA1 9bf49af4828056027afd8093059613e882b198df
- SHA512 6477ce20e668d7a16a0d988c81a01eb66bf797b09df44c860948ce15589baa34308806a07748125526e8c79bb72a62a2c3c1081e80ea1cab5564f33113e7a904
- SSDEEP 12288:9GsfWPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y3:3WPne87HtO/DF1+9codjeWyZxeCEf
- TLSH T1C7E40158E29802E4D16E5235C7A64641B3737C6197F5E3CBA2C0F93E1F35A909DEA313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 952KB
- SHA256 fbc800180a60595a4fccc58e50edcd8fe71d6ebfe6f5c0b1900c15e7d3d78482
- MD5 5c683fad7e4e92d957a83a617b5554cd
- SHA1 43a1aefc0c603098c38e7ca60c6cd8202f92f91b
- SHA512 bd429b75d3c8c756c96616da90b0a8029ece30e7f96136880794d3607abafb90c472799018294b34eaf275aeeeb8e853c56fe73c8d71b17431120c8ef16c5934
- SSDEEP 6144:lQsBC2naEuKR9ysNcbPotMxW4DSU3fUkpT2uZvI5fxSM4MwpNtIAzEo/qRK0nOQ/:lhLqiU3fYuZQfxT4MC/p0nOQxL
- TLSH T170251801766BD75FC6AD40321E36D6CCA7707D01EE05AB0772C8972FC576668BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 ff9feb645847db9129203a129f444154889fa7a9fbf3b326c0f6608dbe28f22f
- MD5 cacb5d051987e0e5764b14feb4e0714a
- SHA1 bb4848ebdd9d10f4b6ecffe16015704f163ab1ed
- SHA512 938832f4473fbf8172fef9f78c09eda3078182296ec126295e41291ed47cf317d13bc283f35cebd9886bb3c4dfc85620981d054ad210378504cb7bf9c1ef240e
- SSDEEP 12288:uBQwRR+Z3At1tQrMbMIqULzy0RfMs4W/w/98Y06GpT3Jvs70:SPTJvs
- TLSH T11255B5819137A3DFE1FB6172072A9B4CA764EC4772495F2673C8043AD81BB25A0F93D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\ar-SA\IntelCommon.dll
- Size 14KB
- SHA256 d0db89c31a6f31e8579cc988dbc46269dc593673a0b3f5b13cc536bb58478f70
- MD5 347cd783a6935f82c3b0427ac147f945
- SHA1 c811b7c1c486437a0190ebd4dcfb5143b456e050
- SHA512 361f5fae3d44422bb355fba058505d4b29a7675431386d409d78b688fcedf9f491bde457420f780c32099ada70e06af468d4bbe3c1fad4462dab212c14ee0866
- SSDEEP 192:rBff6gmTCy9AI89kiLmEoXugAA2IMFekMh/0l:t8TCyi9JaXu42Nw/i
- TLSH T1246297519EA8D23CF083D374C557CA136218945BACED323E4A708F2969E46708F1FAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\cs-CZ\IntelCommon.dll
- Size 16KB
- SHA256 deb94557bd091d6bd78d791e9b7efe58f93afbc5c5ba7003409148fc32a07346
- MD5 397f7ccdb2b5e067bb671e6ca61bcadb
- SHA1 10bd858750fd8810d6158e813c0b54aeb4304fb3
- SHA512 677965edb8f52e880e0528430e8a489f95cffd27deda22bd00c70e056e4a95eec4678300c939b4fea4fcc8b5823ba2ec733ba4044a13ef5c19e4acd2f5f49e9e
- SSDEEP 192:3JMkF43WgxRKBgY6zxx7zypdYg6wLjp7:ZMkFWWgxQBH4Tzypag6+7
- TLSH T1B5721301A7FC0665F1F76F7279B206A25E7BBCA27A35D60F4650069D1870AC0EDA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\da-DK\IntelCommon.dll
- Size 16KB
- SHA256 100a77ce27129a8ab8de37eef14751cdc460bd390d6d647575694d0e130becf5
- MD5 37d91b8b5111fd7924d8d849ef431d21
- SHA1 0b259cb9c842503fc99a14ad5411076efd054f2d
- SHA512 9c36db47da58ef640dd61a3d2b9cb688fe30e47e9c8042bd871e216ac8fb34fc5da570565804df07a3655eadc6765676d7d5046f3f39c151724ac12c0360ac26
- SSDEEP 96:p7Fjk30XwndHkHSiV1pn2ur0brHmyWBkw71l3ok9FnuncdKw52afLNzO0GxziP8a:paMrbnV8TggnVqERq+s
- TLSH T17572F361A7FC1629F1F32F30BCBB0655597ABCA6AE39E21D0600149D1C71798DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\de-DE\IntelCommon.dll
- Size 17KB
- SHA256 c844ddc55e22df5d410e08c2e3d7cadbe05080d899a9091883fc120b714971e2
- MD5 ca046b8ddd9cfdebc2d1ae29cdddf2d0
- SHA1 1c846ad4dcd7ed318b3e4046de20bd2c3c222c73
- SHA512 a81db34bb902ed7aedd9b07fd6b6a56ead22a3c2ebe1ff30e265f7dc0c1e0abb8a1c0ba371b145579c2085f61c6c1af3b816984b9021021f4fbd1802d9290279
- SSDEEP 192:DWcQKuO6wIfJY29EP0txfimGd0YoABvR3Q/u8:2KuO6wIRpimGd0YoABvhQ/u8
- TLSH T19082EE10A7E95629F1F36B707DBA02946E76BCE6BE75E61E1700249D2C31B40D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\el-GR\IntelCommon.dll
- Size 18KB
- SHA256 8b531564af5548b8aae3ad6715f2c9fddd348a388f04ae2797cac085beae2d6e
- MD5 5aefda25a95f3db045590c68de0f26bb
- SHA1 82d986b0248d423ea2f71e84c554bea667803b38
- SHA512 087df953084595bc329fcc6ca44d7e18c21e8676c1b34894135e2258bf6c4a8645278668ef721479fc4919bd0b7ade7340d088c598fb716c56e84e510bd12cde
- SSDEEP 384:nCB38MJR0OP6fycEHApljyZwm1Rl36taTM:nCiIW9
- TLSH T1BA82398D8EAF1721DEF55DF2547385274A6EF9821420EE7B72F03049E86D8118DC3E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\en-US\IntelCommon.dll
- Size 16KB
- SHA256 a644cf1ac35d45db5dcc7903e7bdbf52d4e8c699e957fd00434d0a44cecf18f3
- MD5 563bc33c2001879f50df328616dee894
- SHA1 6ad68bf792e10db6604d77538d00f7e49b8c9515
- SHA512 0681fc29833a211d54591d34a371f4eb8827fe70d86bc05dddd0dc03666650b515fbedf0a11625a2338e9c9c5a091fd12f2559014545b25e4e67e2255c6aa634
- SSDEEP 96:3e01cAZwiw2u4p5DRI8qx1V1wo1g21yCOBTdv0EJjwxOLvdZuiyr/EWix29tgy3V:3eGR8/X3iNGs2zdr5Gnla1IUf
- TLSH T13472DE41A7F90628F2F73F71AEB616A44E7ABC62AD39D74E4600004E5975B44DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\es-ES\IntelCommon.dll
- Size 17KB
- SHA256 6608618569df2cdb40380e768fc6c837cd46d45ebcceafadad86c4dcf2da9181
- MD5 7535902dd0bd3f00ed3afb1cb77529a1
- SHA1 c8564b13e43cd0c2aa9f9248fb61a27c1c894463
- SHA512 a476f314da38965383cdabd77b1c1ac9a9d92ec3bff0ac8093abe3271b22af2d6b0f21912fef2c941729087d6bcd3f0fa6fc80c616912cd78265b216d0456976
- SSDEEP 96:DydXkZMX1WxBG3wgcMuorFYUtmWnezlg5yuog9PPjsFYXkqT4m7qehgau3bRenKR:DydXkZuUJqQKPrBAL9cp7GDJE/Ql
- TLSH T1B582BE40ABF91266F1F37F35A9BA1A654E7ABC52AC39D10E8710156E18B0F44DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\fi-FI\IntelCommon.dll
- Size 16KB
- SHA256 42de99c1f274ba5306067e4d7feed66015eb13d9ec1f306ee4a118a3283f9487
- MD5 01117b33b2d3bd87072a595e1e57bf1f
- SHA1 5121d5f8acaf052e313b31b42966cfb0c79a89f9
- SHA512 c689c2478c70ba14cc484a1918a7f1861e1e4324e985d298f1871bfa172f69cb6df51decac6e70e3ff457372b9cc5918b691b406019c57405e39adb6f26aef7f
- SSDEEP 192:pAy6lT6jKBQGEWy+JdD8PEEkrW9MXhzqTLDJ8qa/PNyRo:X2Wu5dDZYDuJ0Ro
- TLSH T14472D09497FD8664F2F78F70A9B656414A77BCE37DB9E25E0B00541DA830680E8B0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\fr-FR\IntelCommon.dll
- Size 18KB
- SHA256 1edd1c3e3d985a4d6b34d027fcd4da222b84c8485d38ca41fbabb2d666f19dbe
- MD5 59f90679233993a80a4718611bc1a693
- SHA1 cc9840b6a6efccecd65074b2e33e64d4cac99425
- SHA512 824764299965158ced2df84e72e23d1512eee59c5248582ee88cfa0b4d2ef87e3de60df40738ea8270c62e897dec2e473cf5a9d9bab18ee6c97d0bc721fafe39
- SSDEEP 192:fxH+rbZNs0CkyMkF8osnMkBCkspkI1kZUK/yOK5OdxNK2GuVVEbETXJaAh1G1q1w:5HcbZNu/4nL7ZU2FdxNKujwq1BpY
- TLSH T1C9826951A3E90652F6F33F31A8BA16514E7BBC9BAD35D61D0610548E2C70F58C9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\he-IL\IntelCommon.dll
- Size 14KB
- SHA256 4525a9aa73ce85d70f279016bc0b85de1fd97367d8bd1d432651efa68889b04b
- MD5 b32f73d43ef642b276aeea754c315fc9
- SHA1 06af1f936cd1e387576876d70378d13aa51caba5
- SHA512 0bb5d63878e6a3e41b25b8a1192dad028d393ea65d02d3409e2cb7a01805f080c358781233e0e691ce14d881fa63297370c423c22c797260854efe220a474395
- SSDEEP 96:No9tYai3TSivcXgXLOzGXDjr3ELnu66HzK+ElZ6sfMF+KcShizF1:No9tocXg3TjcH7ff
- TLSH T16D529C81AB81C5FDF864EF33D76B0A2E9A64DD4825AD771B981818543DBC7908B1CB3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\hu-HU\IntelCommon.dll
- Size 16KB
- SHA256 61e14ba9957e9fdb8358a55a031fe109e464852d4b8471b1c2787cc07bad1697
- MD5 b0ddff4f7a3db4217ace00ffc026cf90
- SHA1 d5bced50e9a14f2b5bad5edc3c8367d0f1e82113
- SHA512 76db8b4a3146c6f2e2471df3cac4d68e73ceaaaa35f4e9e617cdc369bc8381dd004ae5e00cecce7a441f418e1ec4bb28e5ef70fd2d5d7ae8e5d050b66c96dc1a
- SSDEEP 384:bYJXxyMxRJ1JGiGqMs3ehgmfbOSMlgNh0sc:bYJXcMxRJ1JGiGqMs3ehgJSMAh0sc
- TLSH T13B72E341A3EC1556F4F38F727DF657960A3AFC71BA3DE30F8940928C2975680D9A0B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\it-IT\IntelCommon.dll
- Size 17KB
- SHA256 44454a486c705ef91d4dde9ff1233fbed9062c919625f849199c9279a6c31491
- MD5 01ff7377905bb67cbb85779440459d4f
- SHA1 894811289b5d49d6497fba7f0883b506d22e2afa
- SHA512 bcc77c411b1e80a77aeb1daa79c055141bfb2dcdf9a13f39a865c338a3329e19d52939e1721ccf66fd31be24210f5b98628a0b9eed46539f324f22db856559f0
- SSDEEP 96:rEe2Z4i9ymxjtthUGBU9NtkvcVQBJjbpPVbPPnegqeDdpWQG7s1AMyfRPa8Nc+Km:rElT9tdeMdX15ypa8uCwSHOzz5C
- TLSH T15582DC51A7F91664F1F37F30BE7A4A984D3ABD66AC39E21E0610048D6871E94DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\ja-JP\IntelCommon.dll
- Size 12KB
- SHA256 4b194030b5fa925422c8213e3015286ad6d176c77d5c342fd0dbc7884dd3a617
- MD5 9ae70559ff271dc7a5862cedaf6f966a
- SHA1 0db59bdaf332587238b18a5c689b0f63e651e7bb
- SHA512 6d67a19860d9f128caa879dce7cff56dd91d79397f5e0941981b4b62b6689b0e1bf437183fec19bb27c8994ad1bfd50f6cd93d66536659af9c32a18dfebb7151
- SSDEEP 96:5RmWG2ikl3C1iP/YGglBaq6voE6YxBUfR92rsV8qShizF1:50fDmZPwXlBaHvoEnxBUfR9R2e
- TLSH T127420188F7E14F2BF4B6C6B004E77AA17A68FC28B6A24B571F40580F745860D4F46B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\ko-KR\IntelCommon.dll
- Size 11KB
- SHA256 7c1f389aad184cea33f451488d9ecce5992e8ec6fcbc1a22a259b32bd4b61e50
- MD5 b2831b8af391f8b65d88130110e44020
- SHA1 d2b5552b8c3aa025b74880bfebcff4bb67168f6c
- SHA512 e2d5474b8097d664fca5495c20aacfa461b2798fd5b44814a44ecf0e71d3061bde12fd7822d7c662ab5f9151e2a1e2692a4156aa235a9fac6f775df8a15ba674
- SSDEEP 96:rE08wvYNTOSuz5P29+nJ9nrrm5a4GmVYRmdWymhrFstShizF1:rn8tNBuB29+J9nreYRmPgM
- TLSH T1A632411BD6B8D133E0E1BAF60AE74796D219A421FA47970FFB00905C7C197948FA07AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\nb-NO\IntelCommon.dll
- Size 16KB
- SHA256 b79b9bde4a2ec52f222008cb7f860d903a7d1d6ed329b5cfa11de4a485a373ee
- MD5 70d651a17a5d753767e2bd2fd17d9070
- SHA1 22913b8f40d8e2b5f0fca95c0ced3b751c9ac651
- SHA512 bc04f5696029ee359c8e887a458bb13b1c154f85d3ffee5beeaf10fbf27a80525f19b67dc2e66039b4b8c28b3306b9facc6f248019b573331eed51e87a562d1e
- SSDEEP 384:qZp6Kaq6Kaq6Kaq6Kaqv/Pfv/Pfv/Pfv/Pfo4IYo4IYo4eRn+/spHs2A1N8Q:zRn+/sp5A1N8Q
- TLSH T1AE721590A7F90619F1F72F717DBA06555A7ABCA2BE39E21E0600105D1C71BD8D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\nl-NL\IntelCommon.dll
- Size 17KB
- SHA256 fedf4f4bcd6aab2a877f791b73e529db5f2c05d6b9b3bd26ffdf692d79f091a2
- MD5 7bc823cc4ce020d7e4d03371b4f00344
- SHA1 ad655f8818b273669e65f9406b907c9b04185790
- SHA512 00e2191e94a5f705130fc0e144c43103d20dcc4732519eb6f5cd34f87bdc850be269a028e54f35b991bb3b7b897f0dcfa4a68991adb5f0dec64719a73db0e276
- SSDEEP 96:lNxfCtdVTQb4U0sxr9uRidjw1WnWiVgb4bITFv01jJr9bdGRGj37YwmIxMFdgB13:lNxqSb3bX6qx11RdTmIfBN
- TLSH T1A572E211A3F8462CF1F36B707EBA16509E7AFC96A972D25D061015AD5C30B80EEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\pl-PL\IntelCommon.dll
- Size 16KB
- SHA256 4de30dae532bb9b9f32b96b7edcd12c8ab436d17d0105fc5023f5a1ead36195d
- MD5 3ddaf155029120a4d77dafc0a3e783e5
- SHA1 ff89f1873308bc3813f947625345ef47fc4f1702
- SHA512 66ededb16a2192e989742d4fbb4f85e4f0c2eaf0f54d631577ddb8a14063fa8713ec9d7b45b1809b90277c0228d80f8f36bbfc7d36edfd938696527ba7b538ba
- SSDEEP 192:jbqNYlpldK2Me2SKwHgi6fbeltjYgR49GIPz11OtAV:ncQ2VSLR4R1gtAV
- TLSH T1A672E201A7F806A5F2F79FB469B626944EBBBC32BA75D28F5640440D5870AD0ED70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\pt-BR\IntelCommon.dll
- Size 17KB
- SHA256 1bcf4ec144f963cad0c2df6b2ebb36d6d5c16a08ec14c3a000f838ec3b036d29
- MD5 9d84389801612edf1180a8126f856e7b
- SHA1 5d6df15ffeb9f56b1e7498216a2a4cf341f97465
- SHA512 ab50e8827ffb8ce20b81d28951e02b3788d8c927774f41a5d6f13ae196ecf08ecb61f1510e738c373a10f9feb26a174625d35a588f8c63f12e53488b62c8653e
- SSDEEP 96:J9Ns+sFM331eukPRP6BtgnZt6rSZGxX97WqFxRWRIl4QIVbDj51CeVPAeGmxwGgm:J9NsebusxVK7PTGsnr1v6OQpZ9Ux
- TLSH T19F729951E7F91264F5F36F726AB926558E7ABC52AD39D20E4610046E2CB0F40DEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\pt-PT\IntelCommon.dll
- Size 17KB
- SHA256 25cd9be0399f4393bd0434ddbe23b21e4264caf14814b9ffb94c5cdc7d828db9
- MD5 5ab8dd75771ad2a2705dc8cf5f755d95
- SHA1 6c2f00aae34dcdfd29e845f72cfaccd2e4da142c
- SHA512 90d3565a7ceaf4ea8d709fdc1e31f7d044189cb1b6e473a35e40492ca3d11ed15cb2e7a7da890bdefb2a504feffff5aefeb61394287036704824226116be50f1
- SSDEEP 192:JAgx2ZY6Bi7luVEfOWLYKsaTeQOYLxyqU1/EU2:L6MlsNlK5TexCyz8U2
- TLSH T11472BE50A7F81628F5F76F7269B91A658E3BBC52AD39D24E0620049E2C74F40DE74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\ru-RU\IntelCommon.dll
- Size 16KB
- SHA256 5895ca4159ee04c0af5bf5c3fba4bd5b35afa37f60a17c19baff26e75e3e6033
- MD5 407490adc33270c40851d8ab31923452
- SHA1 a7d733d9b6b3d0282b0dda3df20b3a7a8569301c
- SHA512 827af15014a2e33580bd48df6ef5bf42e409a19f3699a113186e2c53cc4443cb43f990bedb4f686314b1bd075c1ebff2581999e673af600a7211e04bfcea4f11
- SSDEEP 192:JCFhhv9nBsKLmTs2Hb+ZLT7GYL2OpRanmxzNr:IpBsKLmY2Hb+Zn7hL2nmdl
- TLSH T15C72360FF6BD9960F458D2B50F6749E72069F710272692CAAA9FBC68602C33477346C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\sk-SK\IntelCommon.dll
- Size 16KB
- SHA256 686149d5acff54df46da37e205debd9041a038bc344bbf27b0a8d5271f2a8db9
- MD5 85838cf8954c34c9812e1f42b1c54f7b
- SHA1 f159cd42404658128925023ed5c20ffcacacd616
- SHA512 5c87726a870a29aa437d36b15380c0ed98e8370ef4b146a31e8d2e72f295bbdec77153fda9cc26c1a079375a49144ab595a3e2adcfe57c6c07b6b6a7c0b55bc8
- SSDEEP 192:TVS4QNBfhkuURzhe9se5k7kLHEOKD2NqMq3oDdxAUUL:sVfhkuCzhe935k7kLHE2Nqn3MdxAUe
- TLSH T10D722252A3FC16A6F5F37F75A9B206A54E7BBC66BA39D20F4500425D5830BC0D9A0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\sl-SI\IntelCommon.dll
- Size 16KB
- SHA256 8d3b63196c735bab0117d7465f65ad17e47a719a79cba945d6283edd02c2dfef
- MD5 cd97fb067d641840961efb66dc0f61c3
- SHA1 1c8ea368ca2d86de9ecf3b415206d5fda3c65929
- SHA512 b5b4ab2e55816f92864696657692d92204ec8ef5cef2f249d0254a2407700ae553ffd68585ffffcfe032aee793b065278b170f9a0e68334f2370e13469657171
- SSDEEP 192:/l/In126m4OeR/+kZwAHG6USfBtREpkHqxSz8qJIpAd:m126mrB65tRbvWSd
- TLSH T131720042A3FC2259F4F76F7069B507A58B7EBC75BA3AC21F4200129D5862790D9B0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\sv-SE\IntelCommon.dll
- Size 15KB
- SHA256 b30c222193ea94918858ed74091b5abd39c1a98a4dad53bccad4ae44d083ec3c
- MD5 4f9d858126f90b116302a9ea7ff154e1
- SHA1 7af0a4f3e871735626215095b13597ed222fcdd7
- SHA512 b612f60a7c9ad2eeac45d788347c521467ccb0e9ece04d1615487624ffa0d6e989b0985dcda1aba3195dc76d0a369a7edfbe1c401a04732f0153056a044b9a78
- SSDEEP 192:nEh043AoyvpTzrsRevdm1bqtWCCU85d3TEG:541yWAdmqWhU8DEG
- TLSH T169622381A7FC1668F5F34F70BCBA566059BABCE5AE79E61E0600059C5C34B88D5B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\th-TH\IntelCommon.dll
- Size 15KB
- SHA256 69922d80cc4ba3e978da317e63fd2fde5eacd19cee0c1dad1ae3353f286d4a4b
- MD5 ba49c78cc3a0783983d4f34d8b7b40ed
- SHA1 973e182e859efd7302d8cf32d585d8e33287b889
- SHA512 77ff9052dcfc603e3ffc66f07c1f6ef236f8025a6dcf511b462cba29cf8c503d23c3cc52f8e80f54dd4873e68a97810b388355ae646fe9978711e6b9013c4351
- SSDEEP 192:7BzeO5P1U252kHCzg+cOWA/x5desFUJHW:VzhI2HCFcXApresFUJHW
- TLSH T19D62BD35E7B21302D04AC1F0D2D25EA37D2CB812E45B9246C56FEE28B560A746BF1D3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\tr-TR\IntelCommon.dll
- Size 16KB
- SHA256 0349fc3c102fab0613194479f0badeb6eedc617af5bdf82471f32d90fafe2183
- MD5 03fc7c44a310ef67a72709a50e051c4d
- SHA1 c260dcc15117ce6faa4feb1aa8706925a531ae8d
- SHA512 5f1173d9b02dc907cbb03cc46b963b475ffcbb056d3bea388f13e8886b57286bc5f90171dce1f40d299744479a8011ef3dfc31372ab090953fb72fb51f19479f
- SSDEEP 384:KtEtHk8ZMHqRDEbTovRIfoE6x1qRgk53iALmU2Cz1l:2+ZM2u8JIfoJxuZhiALmkl
- TLSH T18272750493DD5A2BF6F31F753DF6A6810AA6BCB6BE31835F1611601968302D48E64FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\zh-CN\IntelCommon.dll
- Size 10KB
- SHA256 f562b02692e8b2de189f67779902edb2c2b30c75c1bc84f71c44257f842a1fe3
- MD5 3b563033bcad184154ba1ed9ec7081d5
- SHA1 6e6cdc6dbc0706c1e765a2b0cee7dfecc4de712d
- SHA512 c1fe813986ff01f49064173f4f5b8a01e3306500a50adb4a62937994130aa5bdca0a995d2ee7f05e461463a336d04b95f2ee7a3ca60212ac324f152881ce0769
- SSDEEP 96:xZtJFiUOUg3T5bGmw/gqmfaf323cx+Le5TSnR1AHShizF1:xZD7eJGmwgqmfavVxYS
- TLSH T12C226385D7E00E3EF2A3463186F34A12B73AF8112A674F0F6D40699F388C7219EA5735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF328F.tmp\zh-TW\IntelCommon.dll
- Size 10KB
- SHA256 28050dc6ca7b6aea973692e61b7ef790ad656910acc7fddef4038dbd15eaf6a8
- MD5 ab8d84de1e028787127e0197708fd65b
- SHA1 26652850c5d2688ab0dbab4a69437d44f0b9fbb4
- SHA512 ad95a3f6229a03aaaaa710fe0d0cc0a317a8f5ef615b62d4a9f748420e8680b74edb9b3a3627317ef706c2fa3a8a9682e82763cbc352e346bf5f5ff3edc59c34
- SSDEEP 96:nf+/1GHhAGaNhuzmDRI/C2VkhW3a5lj3YlWd+uOU/HIlmLTvS4ShizF1:nf+9tBznDRIK2VkhW3uj3pqlmPSI
- TLSH T125228584D3CA052AF0129A349AE349F3AB7EBC133666A31FAF40485F78506049F55FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Intel\Logs\IntelME.log
- Size 8KB
- SHA256 bb05a2e90246f72500a4974db60f3c334043daa5ff83303e83028a7a5fa1efd5
- MD5 45cefaa226ff4273843eb244d4f39dd4
- SHA1 6cb2e62ad6f19908e029ed695bea0ed43dff39a1
- SHA512 ac2d80abef8afbf2a7ed5ba120b83b4239f6648ecb6979fd18a7ca5e47aa38a7e95e02b0f361f7c98f54429fae3bd6891bbca186ca795330fdff5b3e45d124d6
- SSDEEP 192:6PQv7cRrU9rAgjt3aEmjk3lB4nHt6FLnH1FLnHeFLnHl7FLnHzFLnHgFwILnH+FZ:6PQv7cRw9kgjt3aEmjk3lB4HMFLH1FLS
- TLSH T16C028E7F5EE2096FB176EA13CEF38623B5713A897570621825C983894E93101F5C4BEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 33e367f385db52e37abbf4c5a41b77235740c6e80b07516423f0a2607b6244f8
- MD5 58516f9492779818c667b4976d8c4fba
- SHA1 b575baf692ced8ec72d86211fe80b00c6b65767c
- SHA512 468b982a69b130698d9c92f1249825543a0cc19d0f0931a8b224500753a0e37335f27db2ec4f0e0e9954f283d0dc1aee25541ff7cfad40a5a25600229165a924
- SSDEEP 12288:LF7ePNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ye:hePne87HtO/DF1+9codjeWyZxeCEW
- TLSH T19DD42350FBAD09A1F776063205FEC11421A57CA0ABFEB2C7F4467A5D5030DA4DEAA327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 8bdfcc8466d7ea069e8e311895114ca977c4138f1e86e97f48636014a519f01c
- MD5 46b7f6e9dc946d7428a6aec2468a723a
- SHA1 f984a6273d20b0d4b422c05b9acfd6864b5b52da
- SHA512 d7ffb56a979329001a9e190e9ad92f12a5e37521e5af3ca8774f625a8647fda7d29da6c15f09770768ff7c72492469700759635e24442394b869fdaa06fc3e84
- SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYcPne87HtO/DF1+9codjeWyZxeCEJ:Wgb4mBIBhGF3R2TPod5
- TLSH T12065AE1E22EC02F5E1F6D2B88DAA4417D6B278161732D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 300f16a179e6435b7706375dc5caefb2f6c00d52e817975889bd32a5f8086ff1
- MD5 76f41dbfb3cbb6cb23d6dcde1493a23c
- SHA1 57e1e3545f41f90d6dab94781f36d8d70dcd90b0
- SHA512 6473e668cb6e32ae9e36665da345d29b28d14c3c7f95801cfab1f7eb0c6ebc2aca50d10104fb3ebc60baf42dbdbc085878324b37ac39996aab932d8ce69c70fa
- SSDEEP 24576:SG88u8FpJqH1Wzria7/mnPne87HtO/DF1+9codjeWyZxeCEj:J7ZFPqVha7/ER2TPod5
- TLSH T18F35F165B7E101F0E477D13889964663F6B2B8210374FBDF06A88A551F33AE44B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 530f908abe5dfc48a9b5cac33b7230b7b880a7bdb3c0addc76ba40fdfde051ce
- MD5 4e39dfba056090c8d585697d499895c5
- SHA1 f3c88688f8dd5c0a950fb63147ec70f1fe7d5f38
- SHA512 100d870e1e30fa20f7aa78fa92373847af8f0d7bade1e905d6520f7dd6b326be65f8a4d7e0dda54c6beb3c265a3eacce3a236c711e758df84f1e7575eaddb494
- SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTR2TPod5:TG05lO43bo2Tc5
- TLSH T164D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 b02055775617f98f822ebdc40ed734438552deadadd2153975d019c75ac4d783
- MD5 301cba6833c97273774116a02862fe0a
- SHA1 c6384d5bde5127a041a377947d5dcab095f0d1ee
- SHA512 669a6456729946a19fb49b8249b4f0886d9227d615904cc61c0125d4c802b9fef74f889ff6e80f7746363bea9827f4149766790e08c9f0eb3ef77872a63cd416
- SSDEEP 24576:zfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnZPne87HtO/DF1+9codjeWyZxeCEW:La5POZ39Jt2pasx2+mLR2TPod5
- TLSH T18A65AF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 3a3a152e612c27e90ac02e4fcce13c3d88af8f4a901fd3371903962c0e9f0d9d
- MD5 1b5803ed95a0056c4c457c3ac0d6dfa8
- SHA1 c640a1605a6bd127ed10509cdf28f60b2c110120
- SHA512 9b74f3228f72c1931ba726ccd846464e73efa2ff640eec9890fa5021b397d2a48bf18e7281521e02280742c54496e10185bf66e6ecd3899e53d507b45e97f60c
- SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fk/Pne87HtO/DF1+9codjeWyZxeCEE:8Nc/zEOVHFkR2TPod5
- TLSH T1FD857B1623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5a0f8228ab381e67ec08a01df97a13189b31de46a9746a46463c020ee0917b77
- MD5 0e8e303e788b201c3428f4d705eab694
- SHA1 d2f670de3d4e864173e83f7d863660160d505cae
- SHA512 57cee462d68020bf3002f80f474b6b810d8006081a49170768dc8c6760c84cfdd58cc6d3a5034e324086ca6e640302d910dc5bea3e3b8ea673041918ce20e0d3
- SSDEEP 24576:7tkNvNnaFeYhJNtmZBmtPne87HtO/DF1+9codjeWyZxeCEl:7tMwBtOmtR2TPod5
- TLSH T10F55AF6EB6F806E4E1FEC6758D238512E6727861173293CB9290C13F0E279D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 ab4b4d60ed099b0507c0180097e33982fab7c9bb2416af9c6b8a796f6332b2da
- MD5 04d95930c12982d43a123a4b513de560
- SHA1 7d1f43d7ada4fd0a86e5f5aabc72b9a476cb303b
- SHA512 c4bc3a655bda39df99e9afb91e2e45c836001cdcf7d196508c986316ea09f01d69b12157c54a74d3fb0903c546943412a7404f5b469f9bdda26a68dbda495ae5
- SSDEEP 24576:NPUr+NQjPne87HtO/DF1+9codjeWyZxeCEx:NJQjR2TPod5
- TLSH T18605F12E62AC18E5F676A13D85968709F37178621352E2CF02D1917E4E33EE8BD3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 f8364ddee2e45ccca00c5d6b8d95c9fb5e47f0132855ce53e39b520c51232b44
- MD5 da2f92bd32e8b2323ce748fa7c8c06ac
- SHA1 a090079ddd24470f37744c06f4acdd01a9a45901
- SHA512 84706802a911c9e2820d56c9c3405f6ff65c0164c2d764908ff7ab0b05770ae79a6ec4072ac702b65ecf694c600513a69374f52775270dd67ceede785dda9c99
- SSDEEP 24576:kD3FHshBIYQgAiPne87HtO/DF1+9codjeWyZxeCEa:kDVHeBIAAiR2TPod5
- TLSH T10525E17DE79C04E4E57BC17C86A38A06E77138A9033666CB11D491BA1F2BEE46D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH