24f2275451ff81dd139acb8d0f6e01726da4fb5621f992cbb840a8afe0546fca

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Size 4.2MB
Sample260728-pzc5sshq41
SHA256 24f2275451ff81dd139acb8d0f6e01726da4fb5621f992cbb840a8afe0546fca
MD5 cfc0150326d42b3c5df8d5821546bfb2
SHA1 509323c38f7dd3c62610fccaaebe3a916b129259
SHA512 be7e195ed6e597ef6cce6b7fb0f6175b1fbfc9a8cfb8469a2309f423dad8b55d459a57e1a7f43b677e0e9aef2ee44742cbeb40e8947971c9ca87cfde23af7c59
SSDEEP 49152:5evd0EkD/ID87+hf3bFOshy9ECwwDpo5luG2H2d5yFP1ixAUF50u/zvs+8d7K6wJ:s0E90xTQWj
TLSH
T1BD168D9263C6606AC11690B7D9507A347FDA583CBB06DEF210992A3F34F3E60B339759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2916	elevation_service.exe
4792	elevation_service.exe
3884	maintenanceservice.exe
928	OSE.EXE
3912	PerceptionSimulationService.exe
5476	perfhost.exe
1052	ReFsDedupSvc.exe
5776	SensorDataService.exe
4608	ssh-agent.exe
240	AgentService.exe
4552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa3b9327e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000051fc74108f1edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075402e128f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003596b94d8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005688f44d8f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ad16d108f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d09ac90e8f1edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f37570f8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000706df4d8f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd4e6d4e8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0ef39128f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4948	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	240	AgentService.exe
Token: 33	4552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4552	SearchIndexer.exe
Token: SeDebugPrivilege	2916	elevation_service.exe
Token: SeDebugPrivilege	4792	elevation_service.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4948	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
4948	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
4948	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
4948	2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4100	4552	SearchIndexer.exe	100
PID 4552 wrote to memory of 5360	4552	SearchIndexer.exe	101
PID 4552 wrote to memory of 4176	4552	SearchIndexer.exe	102
PID 4552 wrote to memory of 1616	4552	SearchIndexer.exe	103
PID 4552 wrote to memory of 2112	4552	SearchIndexer.exe	107
PID 4552 wrote to memory of 4420	4552	SearchIndexer.exe	108
PID 4552 wrote to memory of 5248	4552	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_cfc0150326d42b3c5df8d5821546bfb2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4537f1e88f76b435c5a7757cbe079642b28669388eeeb8fdb932820ccd907a9e
MD5 505f4b5f017754b9bb6c61703e002b1b
SHA1 27497122a9412a1dc74f53c0501f210fdf55a3b4
SHA512 64514b1c3773ced5be53467ef93328e341bcf7e71c5dec55b474dbe1ed61f3a4edaf47d98b004674cccff6ca013a5ad9e3afa7877b2571c5f5c2aabd6cfd4d80
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn995MdTAcQQfjP+:E3q6HjBA0xTQWj
TLSH
T1F2D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6d084d74e035c0dc4f1fa22e46fd1360575f9c93edd96cd9c9ed95070ac4e230
MD5 287d74f623d720192c69e30f5757e715
SHA1 ec6bdb8dc81429084bcf03f1d7d269d75d6f41be
SHA512 95dec2952aa73d76a7056dccbfaa6ab3012e52572ae02400be44c958a9ba37ca3174a13fa190d9a02e9b2a175d88962f9d9fc876a820c853bfae3d9dee567151
SSDEEP 24576:PXYfDtczAsN94AMdTEvcQFuOjOP95Xdt5c:6tcj95MdTAcQQfjP+
TLSH
T11865F12877D908F9ED678278CCA18511EA33BC514B60E78B03E48A6A0F337D45E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5b3647dc374ac5dbbe6dc20a875d913308e03bae0acdd3d65965bb8a8e92faf6
MD5 37cca8f2215b842f2d29a6461160852f
SHA1 6a9a98b57441044aa8af0444c8759ac6c2c5a2dd
SHA512 0e89db9180de167c34d0fd75f4e6b2b10bba8445c3ff1bb583644cd09713005ba9ba6d58c750890278b4d7f3f9003b517bc6078de73755cd7e77193b668c3cdb
SSDEEP 24576:d0Le5ji0hmxirMvN94AMdTEvcQFuOjOP95Xdt5c:dPji0Acu95MdTAcQQfjP+
TLSH
T17F859E15F6788335D073C0B9C5D2A69EED7230865B308ACB4286C77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 737788ad3b9d3f178dac68763ed4ec2fc320f7183fd4243602bca2bf538900b1
MD5 72f0fb12c4d2100ca2bb86363e1a0266
SHA1 b87042379bfd06f8ac1f8251e86fa04b2b0350dd
SHA512 ff07fba940cfc599a638d825fc7c404e1ae7a33e0056aab1ea785e7b4e259546ec65938edcaccc7fe7032a9ad34b428d2cef8b83169a2b2d75b9b657a9a44a6c
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyu1N94AMdTEvcQFuOjOP95Xdt5c:o/ezSC6vUzPvxHjyC95MdTAcQQfjP+
TLSH
T1F7755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 253829460c166617a1ed9aeff3a179070d136936fb77d8b5f62b694be30060ff
MD5 012ee35dca481ef3e751aaa825e7a5be
SHA1 f6dc5e130eb5dc1e0d65b845854cad7f7e5ae8f7
SHA512 76ed13445044387969a720d78a27c321b45e1294d3580addeca67033ce9b428d1899f2916f92b49d082b2d1a4fa7170584c535155c43d3b7fb92333f5dcac66a
SSDEEP 24576:TVbqPb88hv/l+6gN94AMdTEvcQFuOjOP95Xdt5c:TVO88hXl+Z95MdTAcQQfjP+
TLSH
T19A559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c2b1eb6e650817fd7f39f426911413107f7e966a279ba5474dc09dd1db8fe756
MD5 807770d81c33fa70e55f21cf56a49556
SHA1 51c84d8c5ae67a2a3f742bff162e598a0545e22f
SHA512 4f7d0d97c23011f661af3fb16ba78dac8342c9a8a9e9965c24efee24074dd999b578490dc72627861d383c0345de799fe1664f6d5f719f6026b5cc5317b02584
SSDEEP 12288:WRzqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:WRzN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1804523643F8D90BBF3DB19709CF880686C0A9F518E41964F57D35FAE89389C2D6E106E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1b130ac3c0cd181af6f385586794439faffbdb14f68a838f81b946be9f799f17
MD5 7bcf431c95538f6233b6ed775965be0a
SHA1 0ee8fc5ea1fa746c101d1f2a73950c124be3b4d6
SHA512 54e5380dbb58c9873b9b79508d865703ad300dc65c12687761a749a51cb5397574d25adc976ac0f2a41f27e32680850748613a520c171409d8fef928819012d9
SSDEEP 12288:feBNUbTVO86U4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fJIU4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D765CF3BAE28FCE2C27A4DB85A91C240E77278704F52A3CBD165830EDE235D15EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59276c2126181f54f06ed271b6c277a2c6eda40fdfdd1ec8946fa27d37a59605
MD5 711cb73bb4d9356e32da063623aeca00
SHA1 35fafb00a97785f4930edbe824525361157779f6
SHA512 c4d81a523fb8639e2b65addf52e8df72715616cc41057cb66844b40dcbe973ef1f2b1613685c28b3086337c59c3b54585f8d6b28999f8a474bc51e5c93188284
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:GQvGAdlCEL8c/yRNw5CD0xTQWj
TLSH
T118266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 62d972b84e2acc6e6534a6894923ed0c17c49072e86ea8c7e765ad00f381ce6f
MD5 e2b6cbcbc8a779807e8cb43db3c8abca
SHA1 cafad39f2a7494dc46722d6e510b836de8e67bb0
SHA512 5ce00944a68dd4eae28c01aa1d47c1259a54553d694e9083bb8ce132b24657c9badb7f8303fd43645a74a37d79dc4a0056d92120edfe8056b52c9c22c8d1e0fd
SSDEEP 24576:EdewsAjWN94AMdTEvcQFuOjOP95Xdt5c:clj+95MdTAcQQfjP+
TLSH
T1F375E031FE74E036D2BB0DB21B75C716582D7A204F511AC3E3E88E9E59342D263B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 718288d78dc7821cf8f003e50d7cdd0b8043101914acd408583d1130dec582f1
MD5 8fc2169cea2958ca75b59026fa11d671
SHA1 ead13d439241b72930ae367b11e6027a749fec6d
SHA512 85cf4a6422d48ba0dce0588969d964f636eb65fc19aa46288eb0bd8f57277d5c34d90490d00794dc3c7ec42a0c1408f12a8b1a283003d30ad0044537f8fcfae6
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH20RQk:AUEtQevvqc2W1cpV2EI3220d
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c374fddee37079ea5c7d5fbb7965b5e4ceb81ab74e458adefdeefa2aefdd3cf
MD5 677549c65138705e347ab6241c1263a8
SHA1 c9b0572f71e3985e05463294614c7f1bbc3b3452
SHA512 3b2f51c487dc887d529a3489798c63ed2feb9c4b89ad95b24a595b61bc7aa6be6726f63edc740a5c6feaa34c9241a652bb5c7b9fc23a494554fdd4d21aaad27d
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/ze95MdTAcQQfjP+:WoquVjnm30xTQWj
TLSH
T1A4D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cffa6ebadc6699082557619823465722089cd693fdd1ba9f06b4ae2de7bd0b7f
MD5 4816cd3a499918058487df1cace8ec88
SHA1 581666fb412ff68dd9902e291501fae482641754
SHA512 bbfef41945ba71ada8368c3a28fa05c4808bcceec3eda6aebba70813d89edbc71eeca56cff2f5f63040001b04a20375f148032df3e50f53864d687e0422eb8d3
SSDEEP 24576:TAhGLJIFoiwtA5l7S53xN94AMdTEvcQFuOjOP95Xdt5c:TAMyFoiq5H95MdTAcQQfjP+
TLSH
T1EB359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8b216d0d6ee86f8f6813f0ebd7a0c8e8d9ac07a911bf3673dc445325c6c14f5e
MD5 f125baa3c9f162f31e06bb2e4dcf3a7b
SHA1 efdde829eb93520a0350c90be814612116a66425
SHA512 f4cf955b7516407cc4e1dcd7de399c57c96f0d58b74b7d0f2aea9093989a9870daec34ef5dae7a48d1d238306bf3a9bde3fc3373ba4a374e2370b49910c8f9c6
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CVqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:9wuoOWSN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B865F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bfd0e62cd805a0b7e9240ee36d6d2397862e4f91fd59b911f55ff5e77631d4ce
MD5 8032a3530cdc95618a2fb0a755adcdb2
SHA1 ef360188838abdd8e9ac19ca1b198a8b5e0913cf
SHA512 03d429c3d630d1827d012f76491fa874d351a190bb54ff5cdaddf1efda92fa7ad92823beaf881c33d0517a48e04d4135606eb6de3110551073d5f6d853f8084a
SSDEEP 12288:5BZ1IyGqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:XZunN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CE5512593BCC60FAE1A75274CCE48215EB7279525B3243CF136146AE5F32AC29EB5332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 73b9e8d36213f4a229b90c538d25e6d712eca27c5638aa2d83db598bf63ecfad
MD5 453523d753b6241a9b0de9da9b5df318
SHA1 2fe49b204a0b49da4dbbd46656eb5ba36d43d282
SHA512 60fb88386e867e9b9db3196ee2711c679c19ee2bd709eee2eed54743047d3bde9bae2a1d861dde6a4cd81e0d752d0d6df1d9431d3eee7422db942396da23bf1c
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:aQRQyi36YOcPQLvw2gAf+PN3c0xTQWj
TLSH
T182667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 727020f748949a571d072a231c00c7e9a78960af4f21f9f0acb167a776ec4087
MD5 08ece471f1d6bbc89d558a61d24e9263
SHA1 9a52c24edabbddba9eb685b70a9074439ce4bd33
SHA512 6dc8fd4f39478b656fc32b7f4ef60d11f579142431228c0fda22745b8c42e98aab0df9e215db83d013178f097af79e629cefcdb0bd4d17cbe75176374fa96556
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:ZQRQyi36YOcPQLvw2gAf+PN3c0xTQWj
TLSH
T169667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2ad7cc5f17f2f8a3e5661e80ce58017f9809245718b4afce6d511f94fdc9b993
MD5 9183c5ce41d472a9a31ec22962909548
SHA1 4b40d6112edb852e9192b79d21939c83754aebac
SHA512 890965f9fb828ef3cfbfff822430026e8a8761c47bac9e9528d60550c6e0527625f800f2b87c795f6f8cc7d9134f69a4d8ea0c6b590b6b0a5da888e72c4e40ea
SSDEEP 49152:A68Qg55nhheWu7PNU3/u95MdTAcQQfjP+:6thWRc/u0xTQWj
TLSH
T134B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f188e9224dbe5467fd9f57bad5e8faf196cceecf7912a8d36ce820baf91ea229
MD5 dd04a0e61ace705de4d89516a0835bb5
SHA1 228d6fabead5c1fb325913ab98477a12ef96385e
SHA512 bccfbe1187bf7de7ea16d2cf737905d222e7cec5e9503258ec73877e4e16caeb831734e4d3979883248afde32126ba5dd8ef2553f7bf542279a45dbda3a0667c
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:Zy5112gYy5azzVvL69nLKnhZR0xTQWj
TLSH
T150167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5dcb5055fe184449ec46768476e2e0d12ff7b9afccb7b96f5c2dd463856cb9f4
MD5 d7a6ae7a67c37f66d79b8b9f041fc68e
SHA1 526e40d92070878259f3654b0e0d678a13ead09b
SHA512 27a04d43a7f75d3170f730bd0ad185fa9eee62a49f1e8978ef6ebbe848c95f82b044cbd956ffb3ee66aaa344dd079cbf704c02c5ad8e2ccee156c0458efa3594
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glE95MdTAcQQfjP+:Tu6JmVxd2dE0xTQWj
TLSH
T1F6D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e8a27cf0f61423018d29c3944e4a0a58bc6c418f10ba6416d0263c6a406818fa
MD5 e71049a430e9dd276f36ed94c6b09329
SHA1 70134c7403696f40e2b827de5aea9ed558a34796
SHA512 7af52309d86db86f357d488a1c6a1c2712b02a74fa47c0b56ceddf83e07844b1d3fb9fc03e381020993c660ac8081c04c654ffc50423598109a963ccf749347b
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xY95MdTAcQQfjP+:rmifPbR30xTQWj
TLSH
T10AB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 443a781df489680b72e278b305ad85f86fd7cf3c744465b5d0c180001fcc3fe4
MD5 e7b3da54adc44163ac2bc96c27b312b5
SHA1 763b341632bd2a0f9b63ecc0061cc02b7f6a5d83
SHA512 a5c5ae83303e9f7b6cdce0e4b92f6bc75732fa78b7ceb2de788bc652122400e5a76904d4033a7fea1a682a462c7c489508c6c6e29d1a1c67e45876b0dec6c26e
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqN95MdTAcQQfjP+:A5dKTi61N0xTQWj
TLSH
T1BBC5BE13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 00118f57435701c73722532dc59eea50eda498e0b0221fa54bdc304c909bdeda
MD5 ca68c8620fe990b1bbcec51c1114907e
SHA1 d8479b71fcf89a664fdc76482f1ed11c40251f66
SHA512 3bc9a8ab300b5039fe9317ca03ecbf32c5280c32dcbf16c1fa5674a8dcd9e7e87d7050580419d1441004c5323485171e76cd73a713210078cfb46922b8b39635
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wU95MdTAcQQfjP+:QX2iyph70xTQWj
TLSH
T10295BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 003ec779b98f25599bf11d0112a33bfa23842496d0b5f8c3597bfe148f12fab8
MD5 a15fa250b89ad6d8b96bdba0fda4c2ed
SHA1 8d36e48ba5fdbef7b26e46ac01fd5da1866ef425
SHA512 823a85bb9db6170f88fdcd0cdf5652f73e85be7e119bdf7b78ab49cfe8b69469efbb8ad6b6c77c0b9fa6070d4a8f0c0a171c88e51aeb103e967083a06bcfea5c
SSDEEP 12288:+LqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:+LN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1264523543FCE81BFF18659B08CE48168AC0E5F57DF02528F63D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 585e7b27c51c0858313e0e3d687eb4285bbecbfe7092a6cd94ee9f05ec6f7956
MD5 e7c85add44d98a4a7faabe84cb841c57
SHA1 32415d962490998b83bd86d586b0c0b2fbe1427d
SHA512 297c242950cb4968b85306439048d8997dd5518377202163a95607d4106aa521a2c759fccb8d697ba47526eaf3fd0e8c8b6703a7c3da45f94100a6c506a98820
SSDEEP 12288:8aqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:8aN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1CC4523643F8E81BFF28655B08CE48168AC0E5F57DF02528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5392b9d5b5adade612ef8efc6cd532974218317634d3833976e5070b6c483dfb
MD5 bf3ca1cd7270e477a56d672c9a9bfeca
SHA1 1bbff8bc7345bd8e92455bfe4bf69c16c4f1f1ea
SHA512 127a79f32a50b8303413164d74bf9cef39eb21e9158dc2daaf81dd3968288df46e56081d18f4bc8e35caf3f988b9169e7f35201cf7772e76b548c0951a2d030e
SSDEEP 12288:dwqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:dwN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C44523643F8E81BFF18659B088E48168EC0E5F57DF02528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3315aba2d7d92fec4c4d29829957c24bc2a0ac06b0e21ab6d3dbda657b7c91c8
MD5 4dab8e43c4b36321d60be70605f47f28
SHA1 5fbff7838b89290ccb914697b3a4baf3cf887a9d
SHA512 25fd3f6c3f91a83ac4044b22df097872a2ff20f86c5fd4e5857c9e06b9dda1774595bc4052c8830c7eba24c88a3de15527aa9d30c43260e6adfb05b5b2481e75
SSDEEP 12288:HVRqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A24523543F8E41EAF5A796B0C8F48064ED6ABF968F12938F57420E6E4E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3140ce6ddbcbdffbc248b6edf6a05586b7d6da50780395e3034adfe0a1a12fed
MD5 578c23a8b6ca52b9f97df042e82a0034
SHA1 109f6f037a69ce628520d69ca80e1b7fc69a6169
SHA512 82931ea06a535865d01d38f2e574755f422896f4c0400e0ad7b15979a0c1c8ab46e60506c323e28081d82d1c341d5b06ed63dfd807b89be7050dbaa748dab309
SSDEEP 12288:s5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:s5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13E4523543F8F81BFF18659B08CE48168AC0E5F57DF02528F67D74A6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8fba2967bf9d72e076a838f27b8bb937d76d6cc8448c59bec94bcf03aa606317
MD5 b2f3b250edbb151b8a5d76521a257adc
SHA1 b183f6b402025f8916c34c57601393e9f0b38789
SHA512 5d532ce231f704300e87fbfe3b3b0822a8aaac2f470f3aa225efc75565731491376c7d8d19067338cd4cdd68bc1d6d8552b0aed1e4c4f6905e402dd82c6f8738
SSDEEP 12288:JOqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:JON94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1EA4523543F8E81BFF28759B08CE48168AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8c340fd8ada5acc78a21ee67f07a4e7ce9ae5faac810d59ea7618b744483d628
MD5 4027432ee5589a466c6e2c34c8d83914
SHA1 aa8b24592dbd56cbad62920f74f872259216f735
SHA512 6d4c263bbfea4dbbd8201a18482e5e9ac3a5b3563a632e588488a114be26dbe03bd5081007229fc0d8ba97cd74bfcf64a80f8e119f93db867358d4d1f9b4ea6f
SSDEEP 12288:jiqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jiN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1264523643F8E81BFF28755B088E48178AC0E5F57DF02524F67974A6E8A389C2D6E107D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 674a1807fc7bfe6f23d7d458aaf26d11032ac6b5005dae0fbe328214b87bd381
MD5 53ea84dfa37a7ccba62f7a0f8ded4aae
SHA1 903982132c2d4d4b787c64ebcb36269bb0a4c358
SHA512 01689191079cd8d41f0e46a9aae6a6ad4d115def94f843ff5b2963fcc9d82dce098920b5b298730f7ab5de5ed57122c3027a6ff71e1c82ba3d37fd1236ac81bd
SSDEEP 24576:PZMSzFVSO6N94AMdTEvcQFuOjOP95Xdt5c:PZMSzfW95MdTAcQQfjP+
TLSH
T1C46502A4739418F8ECA7813ACC658915D6B27C5A0B60C60F03E4366B5F333D15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0e833de1b87eb31390fdd04c029e08f074d2dafcf99abbe56228f242f7ddee4d
MD5 ee3dd83af2ae3f197caa420002dc50b1
SHA1 9474f556be8b5a43954e6737c78b685899e7d581
SHA512 4ef0fdc302db1b168f37745ef2e47b6d79a6a68f8a30cd6530d9997ff0e85e59f7b18539b9670caf649f85cd70e8c0120e27b5699a59e42b36d848b366aba1ac
SSDEEP 12288:IXqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IXN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1574523543F8E81BFF28615B08CE48168AC0E5F57DF02528F67D74E6E8A399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 014f32ee16012a30c11f77bac749f4a4ed82be8c23dda2f177ce1c8c4fece8a1
MD5 670414e2946a62b629fbf9ab8a7ee32a
SHA1 9b62c66ee23ceb1f1b97c904db8d9c3aed3c40ca
SHA512 f60730161ccf9660efe4fa21410e1bf80d3026929787a571b78e5a66ca14fd3bc610f5cced0ad6e5ce339b1649ab4d296231b0c672dc34c646e830898be308bf
SSDEEP 12288:zjqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:zjN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1BF4523643F8E81BFF18655B088E48168AC0E5F57DF02528F67974E6E8A389C2D6E107D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2058f0156c053249c09674d0248d9091ceebbe1edbd6c578b441c07fa6e972ad
MD5 92dab613eada68419a25ec06362c3208
SHA1 1912c170be02ecb94496b0fe78c1801ba74859c1
SHA512 4419f8d86fa507ce75d955b30af92d2efbc35ad9d907f435328c5e55bc31866ad7c550a6eef1581760f9056d6f171d41ebe3a3b059f0c44fdc77df1f2e1af11e
SSDEEP 12288:8yPz5L8GqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:lzyGN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1EE550117379930FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d233361018405b38248e4ebfe4e8150e2b667e54c13e659aaabe3aaad250be31
MD5 979d552e83684bc64cd68c1c8b746b40
SHA1 2594af8ba9eed37f5db8e5883038ee980e062e5e
SHA512 cff5542fbe78de7bf22b2c336b1aa7cb3d54222b7a038b3d1474b425d34c9327b9ffddcece49247579e5cb7935f03943774151b257d6fd25dfe92109760068c9
SSDEEP 12288:0XqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:0XN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A14523543F8E81BFF18659B08CE48168AC0E5F57DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c286ea1a422db6cc5c3a0bffa3084130c3266402dc3a109e34162e169be8bc4f
MD5 f8986cf9ec17a537b301b706c6d6a449
SHA1 a8ed35115728fcfcd27170a3bc61b83138adbedd
SHA512 16685cbdf1cc7dc537871d1b7183a5f2f66c46904d423ac390c1ce73f14805932d8f51ac291f5301a7454bc2bf258b8b4c7c496155ac7389b7bf8f3b38a45864
SSDEEP 12288:JXqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:JXN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DE4523643F8E41BFF19619B08CE48168AC0E5F57DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 03c6b2ed18f91bfc6bfe6b5e6eadce34ec21546b5adbbf422d8503337a837fde
MD5 b7a32c03dc57c2b552cdf54bfcd3d1aa
SHA1 3d11827e693aacf04e9090e52b9debb9472dc6dc
SHA512 e914f51ea07caeeb612547e0e50a9aeec308162b90836de331ea9bd1ec32a20972f1bec7c4d48acc2437e7eb41d425b5630e0f39e88bca681063914726bd2ae1
SSDEEP 12288:UyPz5L8GqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:NzyGN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T165550117379920FDE1679234C8A14615FB76BD324B208A9F13A00B7A1F376D19EBA770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2ec84ef75f349750d3401ad02257d0c740690c34037df4e494827ad57859afe4
MD5 a230cbfaca09e533d532dd83bd0126b0
SHA1 b846e3bf997d68c12316c942356f4036b656a977
SHA512 fbe34b83909bf820427c49ffb0c341a79eec0fa2efdec72dc39e53317f11858d9e63454dbb3a24dd913195ac30d0b2e31c3be915f7193b1c365d1ebb7c66e26c
SSDEEP 24576:5THaLl3z0zDAN94AMdTEvcQFuOjOP95Xdt5c:5T6Lljz95MdTAcQQfjP+
TLSH
T1EB6502A4739418F8EC67813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9149f92a4b3c85bd6393345a41f25e6d8e5b1a569174f7963a8776d2e68993ed
MD5 601e59223ed6ad6e0b1c79488a762be1
SHA1 2f1d04be83b6e5604db874a3fa82e726181d33ad
SHA512 50bd3f10339d80041eaa986e9f06706df26d32d4980b086d87e11042c4b15f808b5f48f6aab70b5e8731edc5822e2532d42db16507482f3c5f646977beaa9f9d
SSDEEP 24576:q37d9CHKy7GZEN94AMdTEvcQFuOjOP95Xdt5c:M7d9CHKyaW95MdTAcQQfjP+
TLSH
T19B75CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e6137fdcdd7fdc4bf20c7bbf7383fd450568a050b03749a2b61bae67a2737b9d
MD5 6757d49ee6cd8fd49d3d7cbeab1f90f3
SHA1 dc6d0942ec126e8f582e716a2c63171cbfff56bd
SHA512 55c33d20870651eaa5424d9e9fb4d2fc2591f152b8a31a946706401f20a4271fd9d47e12b8dbc28573943f5a9d202e03f3f002c3c3fc522548ba1a8db0088b99
SSDEEP 12288:AQqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:AQN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T16D4523643F8E81BFF18659B08CE48168AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3302e0664e4e36429cc522ae935eeb665844679356bda7172a44204b5239452a
MD5 3e3bde85fb5de4545275ae7c21454711
SHA1 492d4fe645683a413adeee0298444fdc33111bcd
SHA512 24e8cc1d08327268c4bba4076d70e606f854f10dbb8a1992e5254eedc7f472f46bd6a943c747f6b3a6d16d4f177ee0d498b2392e02bfa7b131be485210a9e5c0
SSDEEP 12288:1mqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:1mN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11D4523643F8E81BFF19655B088F48164AC0E5F57CF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ce04aee2a39688c362dd258089e69a24d9ff505d825d60ede590ffc72e3bb95a
MD5 86234ba64a454e5a160baf3c97f9aefb
SHA1 098f5675c1bc2e121f121273f4ba013785d2344f
SHA512 47599fc18b43f48b9edcd7cbe4274fda60a4adc8e22ebd42bf14ed3c1cd9a1fc95fa069d616257db005ea94dd0c91520f99de4644fd826365ffe684ac86a6adf
SSDEEP 12288:YdqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YdN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11B4523643F8E41BFF18655B08CE48168AC0E5F57DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f9f2dc0f2a6666311eeb44d2a1df4d3bdd9d6829e10efeb1fc286d314b109c04
MD5 724a42a430ddeb63550da814df6f8f7f
SHA1 b1851c5624c7de84491aa955b0ae7c57a67a3e01
SHA512 da213f64b2736ea5637be746fbf14999083ea3f9dbfb22db17001a5e45175b02020ad66017bf580538211923fca4512dd04efd6b5711bff969037f55ecb164c7
SSDEEP 12288:MXqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MXN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19F4523643F8E41BFF28655B08CE48168AC0E5F57DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f23a8189c591da15808f1a14b35ab4f2096b7d7db651261b7b3d18711941eacf
MD5 4c1aee29ff49d9aec92cdddadc5e9328
SHA1 f80132beb790a4335bf67c09b0f60aeba5e01aa0
SHA512 f5873990662bcdcd5fed310d10f7a4e10f7f8b7b46c9a35ccf3f9bfe48ee3c6662ab64da6f578eaafaf06d94caef478f6cd0a54fa8bf5afe85812655a343de28
SSDEEP 12288:yQqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:yQN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1134523643F8E81BFF18659B08CE48168AC0E5F57DF02528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 aca46a2ebf54cb77e80d1205325c06d443e015faee79b08bfa0d3c4312a23ede
MD5 f2cd4894cb3e26a8712a8e940ca7af96
SHA1 5be38d4942840a80ec786c20a71ec4a3bd94f491
SHA512 f5da6bb87788ee1fbab6c422734a20e762d26d8710eb35890d17c78f1a7284656466984c38354b45abc4c6589aa5bbb9011fd4473607d1ddc085a042934ea99a
SSDEEP 12288:g/qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:g/N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1294523643F8E41BFF28659B08CE48174AC0E5F57DF02528F67D74A6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 005199bd6568fe7e7d202e29af15bad6eff0a0b9f20d96fc3e41c59e5b9bb25a
MD5 7fddc2edaab05b5b4d8c5bc88c44bfc7
SHA1 30050a850b3983bb4f79845d122e1d8823ce4c15
SHA512 26fe2736311bd43950973edb1489226a18a820c9fc41292faa59c330c4915481ee22cc2613ede22a2e16a7aa5424730c88e921c1d375891fafe991f44bb79ce7
SSDEEP 12288:X5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:X5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1C34523543F8E81BFF18659B08CE48178AC0E5F57DF02528F67D74A6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3e9651bbb443b0113e4b10e93d3d0550940b8cfc7d2e65281fc7c8d33f16d568
MD5 1e60e76acf1bb1b7b329cb2aea1fb8b0
SHA1 d79ec1e789913209f683043967bc22170288209a
SHA512 b1a3d620b023e1304d303396ba29c29e29eea5a225560518e3e1ea37b5e7ae3df3288e842bfc2ddc4d4c5272711981f387db9210115518e1e372fd3af70d26a2
SSDEEP 12288:eoqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eoN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1774523643F8E41BFF28659B08CE48174AC0E5F57DF02528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 ad931ac574e7d585a9d4e7016b32695474ec35bee10be768ff238585a03d1bea
MD5 7db152ddcf1e1adc53683772ee1e9142
SHA1 844182e44d104213dfc6189afbff878579429b5a
SHA512 65351ec3949f4fa69ddef58fe1a70675275b63d6edc39a905e6d710da41bdb796b934f6eed48ead2ab1883485aadff04ae3832cfd592335d84a282ff2659c6ee
SSDEEP 12288:/5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:/5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B44523543F8E81BFF18659B08CE48178AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c56ea999efadb4b8308d6b85c4a61155b352eae040f49496517a519dabb76282
MD5 1b8f59f56850dbb8d3aae5529c6ba97e
SHA1 39b48ed2523cd8044b00117422cb1df46fa4ec4a
SHA512 0d5fc37ebb959b3c0624ec34d8c4be16563ae9158964d3b1223f0304c5795a99f4069b77a41ceb362f6b3a34e6dccec00330d3c903c028f9456b0f7e71bfe521
SSDEEP 24576:afwvok9RX6wkyAITN94AMdTEvcQFuOjOP95Xdt5c:mMnYIx95MdTAcQQfjP+
TLSH
T12185CF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 09874fd74f7301f99b5867ed848cbb1a89b7150b9dac583deb478d58ba24320b
MD5 7ca9305f77f119a430a11b5dc3ca90d2
SHA1 931a1ee9496674abb6d9545785323e983f8a60c4
SHA512 841a8876f6bbbdb5c20d0fdf734fbc439dae5beace26dc62d46968a7747cc791cacabdbf9dadc9b74b4407349e9ba0b11844e15e380645304b8c5f61532d9429
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0095MdTAcQQfjG:8ySzP80xTQWj
TLSH
T1A4067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ee7c0cadd7513aa22e489d82e38b9c416359ab6ebdf3f23a06f83cab0235033
MD5 c3715f4ce4b06747026b9722b157c10c
SHA1 0270f49accebcd088ba795e0f7142867861d0342
SHA512 2c26dc773669475e796b8762ad9f2a3776b7557a09907f36cbf642ccc19beab3e73276fa562aa1552cbe2107e9662dc37d086d20a8780af1e166fc25d035b84b
SSDEEP 24576:347Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqN94AMdTEvcQFuOjOP95Xdt5c:347JUQj1irIhCnDHUPfF/E95MdTAcQQq
TLSH
T14065AE1DA3EC01E5E1BA927885554A1AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 37f3ca9d6d49339d4a3dbefa37e25811c63945f1513e2ab9d1cdbf121d1e7a82
MD5 5fd107685911736993dde6234d82ac70
SHA1 c1a68dac17ee9b3a696710abf9fae55462936396
SHA512 cdd84fa6c284623ddc097988b2e36d54bb24d95d1e93acc74cc2362151ccf29a62c0e835a0bafb303f3cc40af7d5dfac7b76d6aea0b831d037d8dee4a4b243c3
SSDEEP 12288:dNsfnqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ynN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11555F119E68802E9D0AE6271CB958640F7277D258BE1D3CB53D1F93E0F366C09EE6613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c583bc66bd293bd29c5966712d445e80279dabdd9fa276ba79d21b5f7776b34a
MD5 6a92427d00bc87fc4d3d6b4717c81861
SHA1 a3ffc78dcb07a16e5084f9d2eb7d9781150534f4
SHA512 acc101849ba84ae1a5f6a68e75b1bf72ee26f4c605f4a1652c7329d74e5b65d9d2cc68b2e465adbe033666314c8abf1bffe0c17abc40ab08bee6496cadc7a47c
SSDEEP 12288:YQ0ZHdRU3faHfkGHvLv0a9MJJvvhbOTfr1IAOyBEN53:YQEHfUPEsAYJvvhbSfredyBENp
TLSH
T128450741762AD69FC6A940321E36D6CCA7707D01FE05AF0773C8873F9476669B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4532a0880ee6675278433475903d8a755f4cfcc30bcc8be69cd020c57ba6a5b3
MD5 7f4859128b6e4c23ce17f79aa22fcbe2
SHA1 9bc37e358f569558878c7b8bc56e668dfe5a0882
SHA512 278226770998a88f59144a4c3e1d3edefe1ed1727f8de60f21cc0eb8f5aebfd27557a2f0ed3c56f653f5c15044a70960f1749443682bb7e71e542593a701ef07
SSDEEP 12288:w5U+NufqPbTKRzmnTZLaZFd59yak8+lLBVlMlsITGCb:w5U8iq34EZ9VWaI1b
TLSH
T120552B01A5A7E35FC9FE90374632C6CDABB4AC07FB45270173444A2C987757EB6E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc2a44a623d7f7dfb43399e3568d26bc3a29fcdbe6eea37e4011f4106e8a5d1f
MD5 c715975388c1095bf011047ca47d3c86
SHA1 7606fe1ece79597a799b8d2d9faad54fb52082ff
SHA512 db8d57823afb10fce4abb83ba73d45e5a0fb872a8bc182fc88f621c47c1ba85434f9b7e3539c182eecf85bddcf3da70e93763e7af78a5c331a2d51c2f18a8241
SSDEEP 12288:R07PqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SPN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F34523253F8D956BF5BA56B048E8C1346C0EBF658F0191CFA7424BAE99349C1DEF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 be7536685c5c660b0f97df3fb54d1a44d799dde9ae01531e892335e59af49e65
MD5 6e8f5ab78d8db162e60a6217f51d8761
SHA1 4f693aa8a8ef72ec98c271945bed9bbd02a93859
SHA512 de4e68c26614a2ebd461089b0e4c82ec0c06481dfdbaa5385d929c0a4617ccd53cddf52c0f04786b4d51585b5125db608815c04bcc00b053df81385c387822c5
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY1N94AMdTEvcQFuOjOP95Xdt5c:vgb4mBIBhGFK95MdTAcQQfjP+
TLSH
T117659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bf36abcdc84eeecd0ee7975de1d3ad312310f5a45d3f3ceb4e1868d099aff0e6
MD5 910abe3e363e3da982c9aa88cc8d769a
SHA1 3cbc091bf497301e34ee76594329b40011fddb5b
SHA512 6bf816d0c95ff20b24283890775bd91fa74a75cb0ddc5c9c16088786ce859c4c1213bb40ab758a5d1427f0e926005ce6085418f26ccb633c8a489ab6d5b695c6
SSDEEP 24576:SG88u8FpJqH1bzria7/m6N94AMdTEvcQFuOjOP95Xdt5c:J7ZFPqVea7/r95MdTAcQQfjP+
TLSH
T1C685016577E501F1E47BD13889864663FAB2B8210320EFDF07A88B551F23AD14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 caed2db047014d08fde606e62817f03e0467b669d675a40daed882fc64fcf1e4
MD5 055d5cfa5fc632009bd1a1f25d87c68b
SHA1 7fc180111a185f03508586dffcebed9456919d56
SHA512 4a613173dbabec7449e18172b65e6dc6411e2304465d55d0f17820f55067f1b402c2e537ecaed2e3dc86d637149d44bcf1498a90d25e6986a79cac317c163717
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjG95MdTAcQQfjP+:pG05lO43bp0xTQWj
TLSH
T167D5CF6E62EC11F9D1BBD17CC9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5e2c039c4575e126ea4a3917b6fa21329ebbadf31528c7709b804be0d3bfa479
MD5 cc6a7a83994ce8abcffdac9d0cc7285e
SHA1 29e9a9b728d9b83a0baeace419702273b4adfc70
SHA512 234d94aabf4fbe969da17a518a35fc4351b9c0623f4a39de14ab55ed56a3c63a3f33e0940a558540ec6b92a07ffe4093b2a9f027991f852266e738a46970104f
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMN94AMdTEvcQFuOjOP95Xdt5c:wa5POZ3+Jt2pasx2+mu95MdTAcQQfjP+
TLSH
T1E465AF5DA6EC01D5E5B9D17DC583861AF5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 58ff5a6d5cbf57a9cbe3979b6087d8b65de11c210bb7644bf1b20f513b573dfd
MD5 c5b231cb38fc54594e6f46e6b4054ff3
SHA1 ddf5a2fe858c04697de94db650a52481e40629ad
SHA512 5ec87904b609bc9343ccf9ba2043a2da25ebf2a70211d1023fee61b815db5d508c5d11dd77b23f23eea1bce53289f5aec63f9efddedf8db29826f261acfabbb8
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkyN94AMdTEvcQFuOjOP95Xdt5c:sNc/zEOVHFL95MdTAcQQfjP+
TLSH
T1E4857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9d5a7d88bf502898a4d3a1beedf7598c68cf0ee3131fb322c5bb73fd1190e09d
MD5 5190ea77c72e41584b3981497cbebeab
SHA1 d50abf7701e653ee058e4c2d7dd5cf044375948c
SHA512 edf77928190cb804b8c487ea4bf94f254a8d26f6928c657e68ac46bb868c4de58dca627ed42c716c50ce1cd63afac7fa3edc0f9d581e267ca9627c427944d226
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmoN94AMdTEvcQFuOjOP95Xdt5c:m8MwBtOmI95MdTAcQQfjP+
TLSH
T1D055AF6E7AA846E4E1FEC6B4CD238512EA727861073293CB5390C13F4E279D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7837b83031c80dfcec79ec4637f947990349393a466498d0c7c043d635e104fd
MD5 941fd77878cca72a60cad58e20d3bacb
SHA1 6a8d9ffb27565613e8014f2d41bd949ad93c12ae
SHA512 9d6a0a6fefdafc17e4a44b3251fc3380de77bd6ff96881b74f613aba5eaab4532ad356accf5848f9484b39612c09b37c827be3a15b5276f9850c73be2e22cd34
SSDEEP 24576:6PUr+NQ+N94AMdTEvcQFuOjOP95Xdt5c:6JQW95MdTAcQQfjP+
TLSH
T1EB65E12E36DD18E5F676A17C89858219F772B8620712D2CF02E1817E4F37ED4BD39A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fbcd0f97fa5fc4a1652613c474f2635ebfc376f3a6f1fa91d0923314633053c7
MD5 24f2a317550e819a6a47476a1b9bb347
SHA1 9fae864040d9021e7c65e5e22662fc36ead9cefa
SHA512 53b734f10dfc316dcdd8ff8e19c000ec723349a6196d8b3ee718bd0c78cfe7a8ef279fd5515b281a81ab00f8361184b1fe45dbe02825aa31a936e61cae36c41e
SSDEEP 24576:zD3FHshBIYQgArN94AMdTEvcQFuOjOP95Xdt5c:zDVHeBIAA595MdTAcQQfjP+
TLSH
T14975E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-126-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/240-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/240-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/240-120-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/240-133-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/928-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/928-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/928-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/928-190-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1052-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1052-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1052-366-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1052-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1052-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1052-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2916-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2916-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2916-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3884-45-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3884-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3884-39-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3884-50-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3884-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3912-227-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3912-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3912-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3912-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4176-392-0x000001A72D0F0000-0x000001A72D338000-memory.dmp

Download

memory/4176-369-0x000001A72D0F0000-0x000001A72D338000-memory.dmp

Download

memory/4552-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4552-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4552-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4552-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4608-114-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4608-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4608-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4608-359-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4792-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4792-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4792-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-318-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/4948-6-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/4948-7-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/4948-1-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/4948-0-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/4948-80-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/5476-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5476-266-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5776-361-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5776-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5776-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5776-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5776-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5776-345-0x0000000140000000-0x00000001401BA000-memory.dmp

Download