d3dc12d3e37e8c31db2ce9730ea79f372e64d38d96eab26e7c94698502c82896

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
Size 2.9MB
Sample260730-nagagswdpg
SHA256 d3dc12d3e37e8c31db2ce9730ea79f372e64d38d96eab26e7c94698502c82896
MD5 c23457b6775c8c7675266c7a5c4755fd
SHA1 38037fae56a8cc9a08a1ccd02b91d91d35e16a78
SHA512 e1a4011ec3caddf80628bc93e8ce6b8630eb2e1ee3b7dff59467ef167f4f7bc39c62f60492b8dfe7b78ac0957657487f4234fedd05af207545a845d134eac32e
SSDEEP 49152:QuIIKQofs2hPd2l177BTK2VbDsar1YDjiaB0zj0yjoB2:Qjlfs2hPIl1/EB2Yyjl
TLSH
T1E9E5BE00FB46D1F2ED4762B448FBA71E462996F443101AD3E3581E0F5EA6AD37D3A28D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3896	elevation_service.exe
2808	elevation_service.exe
4424	maintenanceservice.exe
5332	OSE.EXE
3788	PerceptionSimulationService.exe
4732	perfhost.exe
3472	ReFsDedupSvc.exe
2592	SensorDataService.exe
5236	ssh-agent.exe
1476	AgentService.exe
4248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6c250070b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	5708	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036658e351420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d5781771420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000704b4d361420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002932d0771420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d779a2371420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c8f7aa371420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3896	elevation_service.exe
3896	elevation_service.exe
3896	elevation_service.exe
3896	elevation_service.exe
3896	elevation_service.exe
3896	elevation_service.exe
3896	elevation_service.exe
2808	elevation_service.exe
2808	elevation_service.exe
2808	elevation_service.exe
2808	elevation_service.exe
2808	elevation_service.exe
2808	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5708	2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
Token: SeTakeOwnershipPrivilege	3896	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1476	AgentService.exe
Token: 33	4248	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4248	SearchIndexer.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3896	elevation_service.exe
Token: SeDebugPrivilege	2808	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3332	4248	SearchIndexer.exe	104
PID 4248 wrote to memory of 4292	4248	SearchIndexer.exe	105
PID 4248 wrote to memory of 5364	4248	SearchIndexer.exe	106
PID 4248 wrote to memory of 3012	4248	SearchIndexer.exe	107
PID 4248 wrote to memory of 6000	4248	SearchIndexer.exe	111
PID 4248 wrote to memory of 2160	4248	SearchIndexer.exe	112
PID 4248 wrote to memory of 3480	4248	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_c23457b6775c8c7675266c7a5c4755fd_darkgate_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 920
  2⤵
  - Program crash
  PID:3920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5708 -ip 5708
1⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c4f05a857af0dccb2fcd085f73c929974fc9e8de2a909888102859ab2c323351
MD5 147e09b369ee56076e04e295c2f4d552
SHA1 aa3fde9a9b55b872ea1c7967d6328302e6dda7f0
SHA512 7b154dcfc770c5b67a48ec8d6461ac7da00ceb19baa419efbb726d734e2e527a4a08b77905039537244196a8ceb5fc7ee20a2b3c074121762c25e40872a0627e
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwaB0zj0yjoB2:g3q6HjBEB2Yyjl
TLSH
T162D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d02186ce685588518c0edf628253bc1f05a5ad072aa433e9e72455ae9c0beb85
MD5 6553d27b0c71c5375d6551b61a4621af
SHA1 2694c2cd5c19a38d21cd4adda7d1d718cdc7b0af
SHA512 68fbf5dd1566bba36acdf6d0ae89eda6cd8284864eda68d2a27e335ef0300b43dc4cd1768d28bd146548206e2e61d6093d3cd32e457317f2b7316baecfa4502a
SSDEEP 24576:ZXYfDtczA5atr0zAiX90z/F0jsFB3SQk+:ctceaB0zj0yjoB2
TLSH
T1F2650229779504F9DC67823DC9A18506EB73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d5688dba7c7646e7cdcf18ea2108681fb8017358bc99accc3ea47f016448e61a
MD5 f22f97fa0d670be7d8a5ceffc6099d6c
SHA1 eaef48e284ebdcd36d5d9179a35043d5a904d445
SHA512 c3673eb3b9cc883755220c10141e9613c7ccafba56ed10b257098d3f69c3624dd9b3c31ab04dbfd5859ecb6a2e5d921342a876587c062e0f78429b5eada5fdf6
SSDEEP 24576:r0Le5ji0hmxcrMtatr0zAiX90z/F0jsFB3SQkd:rPji0AiyaB0zj0yjoB2
TLSH
T104859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e27513733595522b0a3f393b43653f33dcc443bce6afb1137f72d40c3ee2b8d4
MD5 f017678dc4227be295913b00d18622bb
SHA1 846cd4fffb6ac0f7d6df62e8b8d505b45727e660
SHA512 390fdf28cb9865146291459fa7d72ce7d8507628af12c0d079347d51fbc73f1ac0fa1318fceb78d3c305eac26d0d095dad401631e0cc3b8e1e2ea2ce5df42143
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyuzatr0zAiX90z/F0jsFB3SQkj:3/ezSC6vUzPvxHjymaB0zj0yjoB2
TLSH
T10D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 602eddd64e0b4a63f4faa9125f835d777d6b46a5f5c749602b6716e6428a828a
MD5 bd3916ca9ee57a7d8fa218d1fbdd5bfa
SHA1 c9d40f8ce5d85ed319734b5a483894003870c76a
SHA512 d6663450a23e2421b4c1f6e1b61fc025d465d15cd6117983db2ffb4959638f5f3b97ebb64d5f1c126929c52001c5338e499009aac004e0bed463421b932fd503
SSDEEP 24576:gVbqPb88hv/l+68atr0zAiX90z/F0jsFB3SQkT:gVO88hXl+haB0zj0yjoB2
TLSH
T10555AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de22ef52075b3d1c9bfca6737ce13a1874e7b7b91d43a6eb33cc460708907700
MD5 065398c22af3d5548361994305505bfb
SHA1 29082478a89b02af8887ae42e84166187553ae83
SHA512 79dfce7c7e4531d4ce35bd2530bd5a2a5b9d1aac22c447968313fd30231af92b791b63f6335d7a7e59695b79fbcafc65b7671956a965347490893981139a259b
SSDEEP 12288:a+pUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:a+patr0zAiX90z/F0jsFB3SQkd
TLSH
T12445230B340E80F2CDC32B3526989C4B1AB99EB065E2AF85E2913F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 aa0ea662eb40648762bc11819043010a10932837836e68eb4f6fce7787f70c85
MD5 dbe66a6e5f463cadf3ce709ee4a73e66
SHA1 76cf8ab8cc1aced05a5b62359780bdd3cdc25eda
SHA512 579fac1634434a2fb0a5fd57982c3d4a90e9bbb870ecdd05e514eda1f9639acf45f71529074c50f8ae9986d8924c181ce3fcdd5e3efde797c2389e2c6f0279b5
SSDEEP 12288:neBNUbTVO86UUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:nJIUUatr0zAiX90z/F0jsFB3SQkk
TLSH
T16465CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBE165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1ac331779bad1235d19f6efcc56aceb5defffa7bb2ef2cfb57bf71aa765c64bc
MD5 0cb755f22ece3928f22c980a270c2e80
SHA1 75e6f84a0fb5dbc8567df75b323d0ea46342c16e
SHA512 2a2a839ffa117132e40676ac64e068a641f1d6f962d1a8d4ea55264de81b65edcfac76170c5432426d529abf9463f55fccc5c19dc840c14b47bdb96844f937ea
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:aQvGAdlCEL8c/yRNw5CuB2Yyjl
TLSH
T144267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 37e15eddf269dba52f3172903b907a48d659a3fecf4673925f034f01b98148d0
MD5 a003468aea73edd87a4b7b028479b54e
SHA1 02d825b36329d795e6109571de84c7cf38386631
SHA512 c56b9379d09cd5902c96e96c6636b0a872fda25c21b8b91f234e10b129120515af7666116c2822dfdcfd00fbfd780603572a91eb7622ff13e100beac4f7ad34e
SSDEEP 12288:+AwSfxL/2Dc3+DLLmt0LDQewsAjiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHL:jXewsAjiatr0zAiX90z/F0jsFB3SQkD
TLSH
T1A475E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1ae5dd053a9dd8ce3d622ac2f3cf847067a828f499cbcc5d0d068fce009e45bf
MD5 1fc02985c484bac852d622c4059afdea
SHA1 9ee46fbc68c681d97bb8771af53a053c082081f1
SHA512 ff4a2bfefef3893d907798007bd7af9382ff55531e0fd973345987af8ce7aad27e3bf99f6b5b15bbd989b9339b0b2604c21ddece80ef43711dbfe3627dff0d86
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNZ:7UEtQevvqc2W1cpV2EI32n
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1a3b0844bf254810565e0f8946540ed1f662f75eb93212465e990749b403d5fc
MD5 35d02f18305e08a015edead13a968be7
SHA1 4a6a4e0014bebb50e616a26a495d9cb5f0320d09
SHA512 4760381f9fc56dd335bceff0b9ba311e588bcc38b3144b869ae273df93368945507d632e008f25a67ac54da675e7555c836c7d5a38483eeccf1d488cb43d1b2d
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zCaB0zj0yjoB2:hoqtVjnmaB2Yyjl
TLSH
T1F3D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e5a0f5b1de63e3ab6a48bbd1bbf9df8855b99604dffc676c160a727cd277686d
MD5 fe60f92e00b56c5d377de6c92cdd5dce
SHA1 96d51a73822f141d528a102422c046d8aef6ecfb
SHA512 86d71aef6ab9b73af4d915789d65d578ac9dbdfba788b2d8d6cd00dd6ce7d94e533a805a8e9112ba9ab5ec443777051a470aa5071530c5712555cdd38a2eaec8
SSDEEP 24576:JAhGLJIFoiwtA5l7S53Hatr0zAiX90z/F0jsFB3SQkD:JAMyFoiq5XaB0zj0yjoB2
TLSH
T1F5359D81E7F955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 76d211c4b8a73483e3bb6761b4ec00e2cb70bc178a3064fdad5cea48b30b60b8
MD5 0e453591f86a34107d22d1636686b0ef
SHA1 da2f8fd484d309f794453b669252fcbb79dd0ac4
SHA512 ccf5d65c9104ff4ca1e6bd459d3235896de22b5f2bcf4e082fe9af450531c0ba0fde4796469891bc4adbe7ddd0a987ffbbb45251f42c731321699268170deedb
SSDEEP 12288:Wmw5HEjsChN3BFgl0WDm+CTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:PwuOOWGatr0zAiX90z/F0jsFB3SQk5
TLSH
T1C165F14A32A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 33730ef69f0116ba6bfc516a5e0d8e206809a1e8b9099f7d7010b6015470a7f8
MD5 4096e3364b35ef7c33260302e05bec14
SHA1 1ea04dc156eb7371d1c34e23bad2facc8e916e05
SHA512 7ce07a0fe11e7fd8d3408e1f7880d61b7d21d65380b669049fe5e947620275fb12e5a52a6f3bec98d1c4a8f79f8fa5d1f60f6f043f10695363e6177755e1ed00
SSDEEP 12288:iIZ1IySUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:1ZuFatr0zAiX90z/F0jsFB3SQke
TLSH
T11D55124B32A920F6D5D3523C89E44906D7B2786123B283CF62607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 087116ab8bac40b27ae7331a78a68d8281964f0b00f55beccf72d4629dd29ec0
MD5 5689e8ca0022561ec51ed4cc017adc45
SHA1 b57afd8c43eaf5a4596b33025cab745675f0bf47
SHA512 31ea3a9b5b2e4fac1ccc7491da39a17a2abc0a3fc6ab09bf693ed184e16690207f34f86bba691b9f11fce48de9e67133122c20c31f57b542d59adb8a77244c25
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:sQRQyi36YOcPQLvw2gAf+PN3HB2Yyjl
TLSH
T1DD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 62035ad115acfef0f71c2da4731685120a2817e24a56142d67337d09aab11e48
MD5 3a2364f4dd05aa5c570b266021f4e845
SHA1 6587b807353a26a1f07e7fb92f8ce690598b7e27
SHA512 8ef1f405fc47cf15b36a9e29f7a53296ef48527393b2d15cb631196fb65c0ff59687cd0cbe03c6976b07f026926eeafeea5c39779e64dc3e983fcf958b70bbe2
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:gQRQyi36YOcPQLvw2gAf+PN3HB2Yyjl
TLSH
T16A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 66bf5744fb1d5dc6f387b20a34eb6d74604b547d01ca2669b452e41477a3e426
MD5 bf3a6acb768da62aff05cbe213db8c2a
SHA1 f087dfcfe9b840f5377b0bf1a274ac6a17593d87
SHA512 70a40c08e2ac4ac6a4d4ef593e1ecd0a611bb18158c8c54827aa47e5acfc04538fd3f9617f74ecd858d2e4cf06a68deb1734bb95792c31e07a345011c75b37b3
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Vatr0zAiX90z/Fx:D68Qg55nhheWu7PNU3/yaB0zj0yjoB2
TLSH
T1DAB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b328a39a7cdc29d456ab54fe2c37183db64bd9e7a01acd220163195edcf9e00
MD5 6830bd3d3dec38529957977a281640db
SHA1 05f037cd79cc30675e563e4d98d3b3c993bf3739
SHA512 5e387538a07dff90e2bed7cd25f57136ab0fc77277d20055a10cc2c7f9b8f35b8f21cf12444e8d3a8a6611422607f0de36183d5e2b2ec21e4cfe690e98951465
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:6y5112gYy5azzVvL69nLKnhZwB2Yyjl
TLSH
T113167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ecd13ebc79aea30444298f9b4a41f1af9e20428556082987e1c790a0a7885b7a
MD5 7401dd45150f294b730f212bfa84f037
SHA1 4e0f2239d5f4503bdaea43f0fe6c4a8da2c46829
SHA512 aed9ae6b50ed5a6c8a4c20668e1b019fdec7df2fe8fc2c7f00bb973d6ffdd751a852f09041ddf244356b4886c6ba6a175906fceecb9ba4c4d597e8a1dc6c00db
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJaB0zj0yjoB2:lu6JmVxd2dQB2Yyjl
TLSH
T10CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 504c883218097c369a64658664b13f84c25ad93f768ebe6eacaf9fb8b7f5e3b9
MD5 9f90fe63c6381651f839cc7eede97468
SHA1 9da9bbeb9a4299bcd280fa2ea7128a638f5b9b8c
SHA512 bdfd014c4533e33f6a457281c195971caf826d069e63c50ab25d507d1b3aadd8ba8b2ec392c066ec7bea6418fd57c825c89ed168536a96e8e447b20f2460ac4f
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4x0aB0zj0yjoB2:amifPbRaB2Yyjl
TLSH
T13BB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c3dbfd747c3f2afd69aa2984cbf9b2a12d9b72d9ee4127e1d4ec2fc5ae19096
MD5 e8f2bebf10f1c2bf5e0fefac2e5fc961
SHA1 1ae502708595562ffcdb89776267f1e7adeca3ee
SHA512 2ad7f0536a00bb500ec76db0d5e2a9fbbb1fb22531647d6959c0d47a2967bcd61732eac0bc930eb6092b8dad180a6e321a811891c7507fa5e71b79e963b126db
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqFaB0zj0yjoB2:J5dKTi610B2Yyjl
TLSH
T102C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 215cf7de8ad9504604a28f5fa6cb4892f75678f9aab0f4c366f87e340e9145e1
MD5 f1e18cf42003129d5d87a39d8ecd2a12
SHA1 d8e2190c136b988694c37ea502d26e04a5eecf1d
SHA512 f4c45e40b4c5625776ef5560c32faa461a9cc44cc866e6973e72368aa71ee478b96430c47c8310c3b26eda25fcdff3f987c4659e964e8ddae090d668bdd49dc6
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wQaB0zj0yjoB2:GX2iyphWB2Yyjl
TLSH
T16A95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f9cf248658c9cd885a70143866bf5618d5a7488fbb6833781fb40a07ad36cd0b
MD5 927ee6284a2752571edb6059f97ca93b
SHA1 70a9190288d8098236c600b8c0204473d9fa57fc
SHA512 c0110111ca9c4aeccef84a2ebf9f1e784fc581b0a427b49c3e3d57cff6eb2bc554abcda663ce23ba30f4881a89649f2f9ad98ba88807004b1f0a099e4db3921f
SSDEEP 12288:9hUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:9hatr0zAiX90z/F0jsFB3SQkO
TLSH
T1F145230B341F80F3C8C31B355688984B1AB95EB4B2E36B85F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 279b919d0ddaf84690c5b2be285b7a7a93aa015563bf4b69bcde5a6b8b082662
MD5 6d666ce3ebcdca129a72da5ef613182e
SHA1 443e432be57b0114fc41a04bad6014f0249fd7d2
SHA512 40cf1f1820f29e08f4a5de8bf022b3d4ac3ecd1a3c6bdd4a1b83de0a03236846c0873d42ae2f1ed4a9d262a1117b8310eee4a6d038ef1d53c9232ea89f88f6dc
SSDEEP 12288:guUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:guatr0zAiX90z/F0jsFB3SQkO
TLSH
T13645230B341F80F3C8831B355284984B5AB95EB476E36B86F2D53F0FDE382C61565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4a3d6eb6de2670988cfe12268adbfe6cc486d99d3b86adb3955d0682c4de9a13
MD5 007e02079930bf88ace645532650cb0f
SHA1 aa0124f12bf0b7bafae65885b43b9a9107c98aab
SHA512 6f798908d89785fdd9eb6ecfb97571027a722164214dbf7b4fcc4fee519560d509bde084d81a71d60a7a4585d7294a88470569d46583f76180783a71dbcf472a
SSDEEP 12288:TMUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:TMatr0zAiX90z/F0jsFB3SQkO
TLSH
T19645230B341F80F3C8C31B355284984B5AB95EB476E36B86F2D63E0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 676e8f4c3a62f3d3e431f58cce33d5d4c058b968b7260b6b3f52f48247a219d7
MD5 dcde7790942280ee691f71d40670126f
SHA1 1f403c608756fbf69f81d655c1089ed4ec994f00
SHA512 c7ad1d7945cc261101f08986e11b53ac0ec64669164f6561b5949a93681aee849a51bca2bcecbf68c93f75504f0b0c3dccf9aff673848ed63e28d0da1b552a76
SSDEEP 12288:TVnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:9atr0zAiX90z/F0jsFB3SQk2
TLSH
T14F45230B351F40F2C89397358694884696B5BDB0A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 60ddaa16843b8636edaf9d697402c386bed6f1250f0763fd022ade51f8bfedf2
MD5 e63f6a1b7807c2d9ebb6a1d3301e0fc1
SHA1 9ce91eb1a5a82e79e3b4a02577a6e442cdbb3247
SHA512 1cad4a4f145c0b0197b2be313606757f6c265339e058cb73bf24cc246dd18b9505c737915397f394d1d7d3bbfa3c1473a3ec135be6e10943c6d77a107da4b562
SSDEEP 12288:KvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:Kvatr0zAiX90z/F0jsFB3SQk3
TLSH
T14345230B341F80F3C8831B355684988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 293cbac3442baac5019da6ae0ed3a35dbec060af4c6e1712b0ba6212bbc43601
MD5 5694a20281ddada1e0d3ea11fa5863c1
SHA1 323f1f3153eabd6b4e9601c870446e118fa3cda1
SHA512 0a664bc7b7f07d89f517822b83146f8e1abf34cdd198c000f964d037de540f34545de455a09ba5f40e214ae94eaf3aa35cbda1d410d499906b44074cf0477ab6
SSDEEP 12288:hp6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:r6atr0zAiX90z/F0jsFB3SQk3
TLSH
T16A45230B341F80F3C8831B355684984B1AB95EB476E36B85F2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2659d2a90c2f57e5ddf2ed3302413a24d3b91e699958fc3b34f960658ed06359
MD5 d7ac3abcf115d734417c19463423640f
SHA1 ada8c75f62cda03bcb1fd93348928ee5f57e5f9f
SHA512 d3c6e4fa2a4c9b059690b3301592384a8ac5bea167ecd78734714b29206172adebc96e6559eb2b9b475cded564a7968777d128e251c1ed9bbf28dea2da9f9c57
SSDEEP 12288:UWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:UWatr0zAiX90z/F0jsFB3SQkE
TLSH
T1E945230B341F40F3C88317355684984B1AB95EB476E3AB85F2957F0FEE382C62525ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 dda8c26669f29054c9c32afd5331c210a6efe6b9c39f5650636f94164a67db76
MD5 d113f7094dd27865a1b8815a2d60cc24
SHA1 3f2080c809bb885b3ca137c2751dd19e32ef14ad
SHA512 d69055434fee47ac3ac85c6ffe28093edb49aa920fb91d3e370ba6e0c52e8d95529d5406cd72eee2246a184d6bb3fd55b1cea7450f0209fa2f7de5bb1b8cd6f5
SSDEEP 24576:HZMIzFVSOOatr0zAiX90z/F0jsFB3SQkM:HZMIzfqaB0zj0yjoB2
TLSH
T10D65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4c7b5d8d1cd7a6e2ae099575c4adedd7be405d95a255d639175b5cb7cb1d8ba0
MD5 6eebfcffa5cd4c22ee21404ac7b885aa
SHA1 86cd9bdf0e6c4d77503ac0c4825acc8e826dc9d1
SHA512 1e163180a124a41c74d4a256e7bf5888445691009c028393f413b48b4b192d1c4c76e164ab9b35c8f0b7386040d6e6aabbfd23dfcdc20ff98ee5ed64f6c8416e
SSDEEP 12288:81UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:81atr0zAiX90z/F0jsFB3SQkP
TLSH
T12F45230B341F80F3C8C31B355684988B5AB95EB472E36B85F2963F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7f43548de4f2d3dd0b4067057900d5f70468cd5d7289c33e49328ee4f5f5e532
MD5 964a9bfafb68cfb4d5abf168fd508418
SHA1 b911a37f46df5992c49b7cb5c85914728bb8c001
SHA512 5702f430f05d5e94c62c46b232bbe226c7825c26ab12a12db17edd9711f35783de943b2b709fc8702c5ea3705904509f8d136789c781bb2854ba37dbd647098d
SSDEEP 12288:uZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:uZatr0zAiX90z/F0jsFB3SQkb
TLSH
T18E45230B341F80F3C88317355684984B5AB95FB472E36B86F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 511abc9dface0d0c8c1aaf18ff761e6e693cab89ac9ee6c5705c7bd0cf74bb4c
MD5 a2f8728a5187296ebb69328a765e6ede
SHA1 b5ec2d315288de065ba092d33349d666da3610c7
SHA512 e70601c6282ee4ae81889e4d2051fc8a030b8e33f18a9df31f5b8959a6cb704fad51021a0a4e64745d6a964d3c581078add21601b06a4a8044525afe982b7ca6
SSDEEP 12288:pyPz5L8SUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:IzySatr0zAiX90z/F0jsFB3SQkd
TLSH
T1A6551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 21c7beedc6b92da410a244f53fed9e73634823e02d480d473989a24690b66be7
MD5 0d8c62b3fb4284c56434aea11fa83d69
SHA1 057499d78d9ebc6603c2a34c13926a2479347d3d
SHA512 3e4077af026c7840cd87dbd5a76ba4c3d93c2ff5aeeee590081bf3c2e1781d0ba72411d0c4ed83526ec82eabddb65530c8e1ab8d953406d09c9ecaa62661b62b
SSDEEP 12288:G1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:G1atr0zAiX90z/F0jsFB3SQkn
TLSH
T17145230B341F80F3C8C31B355284988B5AB95EB476E36B85F2963F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cf4e07ec33c9484cdfc854a84e0b7c5c785cfd8f0cd72fb5a500d3d325c3af1b
MD5 6f13688e535034710e799aa1b9a31a41
SHA1 998ec22786a4c694c26fd720b713d2768e1585c6
SHA512 fcfcc6f4cfd0e6afb286bc50e6ad1942222ebc331854704c32fe22c03d821a3fcc3410d1eba42b15471b73ac1ed2684fad9e89576c44adaf8a7f433f12e0c9dd
SSDEEP 12288:61UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:61atr0zAiX90z/F0jsFB3SQk7
TLSH
T18545230B341F40F3C8C31B355688984B5AB95EB472E36B85F2963F0FDE381C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4ef43d770a8463ab92c6813597d77811c030774775577a3f2468907f79b17c83
MD5 37ab20083bc51e3c263ee75631a5892c
SHA1 f5f6ce21066543bc651eb6935dc4a777ccbf3b93
SHA512 f77c0ca2624b555c969d79dc3b561a1e6380f7630543273858ab42a22c43db8ec26edc52693a7dcc2cc6cdbd2c40f6cc1d1fb75d476813238fba53ac30ad4aaa
SSDEEP 12288:WyPz5L8SUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:rzySatr0zAiX90z/F0jsFB3SQkm
TLSH
T1B1551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 74052418d827ab39525859a3c7fb9c6531082d99525488e1b18875bf0844e900
MD5 34187ca4fcabef9f72685bd2b2cadc9d
SHA1 5b37287bcd32fdefb85f68fd20fa2017efd6f7de
SHA512 3c60a08f333291b0ea7ff4edbc4ee5ecd8f6805febb94429f3be3439cfe24da3b07c613899d86bbfc40024c2e4ffe942e0455380ea52f97cfd42b566171e0f16
SSDEEP 24576:ET5aLl3z0zDcatr0zAiX90z/F0jsFB3SQkb:ETkLljzaB0zj0yjoB2
TLSH
T1E3650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 88d9dc58fdadd214ab691537d2c8787aa4934c1d62366f0c4b33be57aa00167d
MD5 789a6525b8b14da4dedc4bde4755b2a5
SHA1 423386470be23588b30d02714463c5a38b71104b
SHA512 c0d1cb58623ba5ffb6204a408b3feca9884fdf96558fe6b9a22e1ae1abf813210465b958dd7a179e08759b3f4ca8574b3f0c2311c04014fd6e84d42bb1b53c73
SSDEEP 24576:r3Od9CHKy7GZoatr0zAiX90z/F0jsFB3SQkO:LOd9CHKyaqaB0zj0yjoB2
TLSH
T18375CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 facdbecf48fd0a90a9f52cd5d2d9b27c9df9c06c3dab8129f65877478de13152
MD5 7e44c31b5b16f6aad9920f995a70b1f6
SHA1 ba339244f27617d3a85fbf04e0748e3dfff30e47
SHA512 6bce9959cf77438a6a8701aecc6871f5083aa8d05f9312f2f605496f2d27e31d27acbc12bf2b6ea3f33dc956d9f74ef7d36e7b47dafb9dce3f652f48a254005a
SSDEEP 12288:wsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:wsatr0zAiX90z/F0jsFB3SQkF
TLSH
T13145230B341F80F3C8C31B355288984B5AB95EB476E36B85F2D53E0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 208c0d3d0245f2b9aa6cd404af536105d3eda800938b1bdea92d99795143aeac
MD5 096e31eabf98d164bbf982710d65d537
SHA1 284658858af5afd9e0316de6bde694f298be777e
SHA512 8bff559634627aa1ddf3786dada6669d49026b1ca234a95a7f03bff1cb62af623a406e8a2359e403f02905a69b68f635e608b9daa0462e24209f2f61e9837618
SSDEEP 12288:+yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:+yatr0zAiX90z/F0jsFB3SQkN
TLSH
T19A45230B381F80F3C88317755288884B1AB95EB4B2E36B95F2D53E0F9E3C1C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fc5892edffdc48e9465727e6f2f03fc6cf1c854e5e07300df80a09a46ea19de2
MD5 8cd6fac13f98f32350e9c6cb45c693c5
SHA1 ffde692eb180a4b7ac697f0d38a3ede64af31c0e
SHA512 a18e75302fad113a4a7a2f6d076a966267ce298eb897ec0fb42780775fbb60a690c0036b202e63c86830ce52a1094a0b06b9008cd4e133c76dc2ddab3e287538
SSDEEP 12288:zbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:zbatr0zAiX90z/F0jsFB3SQkV
TLSH
T14145230B341F40F3C8C31B355284984B5AB95EB476E36B86F2963F0FDE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 603363c9ff71d7bd48ab5ca3f32b4192d91e186a2e62f85c11d858e9ed68915a
MD5 c7ab9289e7b459eb7d9242d83598f821
SHA1 9b2357b6299648d78dc0f2404fff35dddbd2f742
SHA512 e4b7a852c4798250ab5dae2887edd0ecc5524a72b8b839a2e36e879aa863020a7b5b941fd1c8be6c55d6d4e6cff0f743ed3ec1f6773b5b161f2e87af32c66947
SSDEEP 12288:T1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:T1atr0zAiX90z/F0jsFB3SQkV
TLSH
T1F745230B341F40F3C8C31B355284988B5AB95EB476E36B86F2963F0FDE381C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2c9503a6683d448e57bfc47cbe2d653dde5c0b0dec272a3f0b11e80ce7aa2888
MD5 4cc3ffd8894cdc2dfa2ec50322108798
SHA1 2130f7b71c6947d7d9d9584a526abc8aa7d2b6b7
SHA512 9866c121022dcb7f69a775b2c07df3a9d097119d4ad1e9f954dddc4d06b5f9742a189d654eb10eb54a40c51f2a29cb23f804f7bc392086fbf83056d8f454b1ec
SSDEEP 12288:BsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:Bsatr0zAiX90z/F0jsFB3SQkl
TLSH
T1A245230B341F80F3C8C31B355284988B5AB95EB476E36B85F2D53E0FDE382C61565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dc95f700f6a452cc0bfa2908bd018b6bfc62120de102eee6b1e508517947a1da
MD5 9c62161b10688c6bef5403c197bacf14
SHA1 a144c8a8a5f75d475bc1ff76ea347e05c4cea330
SHA512 88bcca9ecbd68f025b8caa574d029fce5e1bb99d70a540d3b7cbbfeda42c6955b425a743f5a9ae9e167b0d2683d1fe5252b448324fbfc21ecb49c04e634caa52
SSDEEP 12288:a9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:a9atr0zAiX90z/F0jsFB3SQkX
TLSH
T16745230B381F40F3C8831B755684984B4AB95EB471E36B85F2963F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 108329fbb2f7cb2a062a68a7ac4e493b091a05f64a59cd881b18085c3ab3d045
MD5 408af350853a49d692be9a1ef9282d00
SHA1 7e4900d322ed4b3ec641351aa28104c116179fae
SHA512 31ceeeb7a4bd439cf713e7aaace89457ee13cee775f6891a0e96d8d814326bc94dbf74e52285349237c0de328819dd7fb6d25070e2a7a2574a726efb4b4a525b
SSDEEP 12288:TvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:Tvatr0zAiX90z/F0jsFB3SQkr
TLSH
T1AE45230B341F80F3C8831B355284988B5AB95EB476E36B85F2D53E0F9E382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f843015383d8aca5e1251f09b84cae74af2ee8ff2e680e392fbb105d561ceffd
MD5 e3fe8e48bcfbbc5216fb07568576408b
SHA1 eeb06417e136de671d155c6ba2b59551bffedd4e
SHA512 7dbcf8e835b4c706569b70222e232e29bab23fb94441d587903a5a8a7dec02d7bcb5aa485a4b4071845dbc46e3571cccc94f8f72d1a06d6c59c4f7c287be5080
SSDEEP 24576:4fwvKk9RX6wkyAIJatr0zAiX90z/F0jsFB3SQkr:CMnYIJaB0zj0yjoB2
TLSH
T11475D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8c147f107494443f6ce32647b5a4db1a627fc50fc85d5123ef3413ffcb2e7176
MD5 20baf877bff0e99d4a5f0b2f85728b66
SHA1 d1ae4db6ee4a9c3aef8b0fe166967ba33f1ec666
SHA512 aa88cef0279a1c58861e97dfffc6c04825029729183f292d7832b59f8fe6ea8c8e60be1842cd8c5997c46c71545a277956b5b2ab4967ab0d584d90bd58e66315
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0waB0zj0yjoB2:1ySzPnB2Yyjl
TLSH
T1AB066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 04411112f0442b1926dcbea48a0bd8a6f654054417a2d21fafa49eb69148b056
MD5 3cb8a0e25ab6795e316bdbda1ad127bd
SHA1 1a0f7d8798fa4a69903b9c557edbc5587f791f74
SHA512 015baffba2ae5a18d14745cacbad2abf829909ce2cbcd166536a29d9965185eb429a79073a38a8ed0d3efdfb1ac7d0eb897657f9fcef53436e111b854f60e915
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY+atr0zAiX90z/F0jsFB3SQkp:V47JUQj1irIhCnDHUPfF/gaB0zj0yjos
TLSH
T17165AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bbb7c797f140cb7883226575d8248a09fbe779def4ee9d86c81f6bee98cfca94
MD5 7f33ba54b226868d03ca9b5c4dbde8b9
SHA1 563bf7f6631c342c318eb7cd3b6f5b10bc568cfb
SHA512 e45cf73ba6f1aba8e3228b38d675cbc596caf9ff3d8521c20fbf8f2b8f09af34e7b36e7c738d379d8f448dbdbeb680b14bfc7769d71ff0940b935c1c53a4b64f
SSDEEP 12288:KXsfFUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:pFatr0zAiX90z/F0jsFB3SQkE
TLSH
T1E555F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 cde14e03275c067bae332cb9af9e75abd99fa3e038a8952878dceca7cc3e4b5c
MD5 977d212c7a89d4b73b15cc13b8facb7f
SHA1 e1673177e12c41fb6fff43529cadf6ee61d4098a
SHA512 072ff1d28a81691413152e362e0c43641f0afe139e4fa49b031dbaf2710fa68c082956c807b16c69f0b3e0abaab9681707356946096c5a6c55ddab41824801e6
SSDEEP 12288:2AYtmKSU3fS0Io+w2KkoAdItm1epIeibt9BwWyHp3ycwABQ2rXYgzLLMNyMj:2A4mJUPSo+QC3qQ2bYgXQNy+
TLSH
T1BE453941762AD79FC69D40321E32D2CCA7707D01EE05AF0773C98B3F9576669BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6548f7cad7c6216af434901c41d1b79b0a867f766fe6dc7186df30c8afb8eca6
MD5 fe25e41e4d7dd12a83d203c27571be11
SHA1 a30869c4646367015e38d9c64f8510f30cb3b23c
SHA512 a352227854bc1eb181b1c600c703367ea6aa82b6d2631644cc0e9200bc0eee773c7e4f82b91742713f37dc6aa7f5899a932dfde7296f62a5900d2ba33b00cdda
SSDEEP 12288:np2/cG99E9Q9YaN0co1JoW2dOB0Qc7e6tif:np2/z0cyc7e6wf
TLSH
T1E165D8816137A3CFD1F76032032A6B4DB7A4EC07BB055F26B389453AD81A765A4BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b6d3f5e7eb3fbbb3e29992a66fc13207a748b203dc59efe88600728b68792481
MD5 ec231947aeae1556a9be46a934825fa5
SHA1 83691254369162c72c9b66c38651b34587dced6e
SHA512 62789fc4695ec8b987dd3faf784e6c34ea9cb23d30d726425ddaa590ab5dbefeee6890df5a4013a878257ca206115b92f0a2da7548ed8d4da6e9d45907c2d0e6
SSDEEP 12288:3b7NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8af:fNatr0zAiX90z/F0jsFB3SQkN
TLSH
T1F4452307351E80F2D8E32B3452988806267EBA746BD29AC7F1413F4F9D386C65D75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 628cc20e52acc05bc429808de2f2826e62486ff7902e6b08b187607399078c1a
MD5 c2559486750973270a4848eae0adcf5f
SHA1 9bd400307eb6ce9b5f957b2e47a0abac1ca360c3
SHA512 b7de377e8d2713ab7f5f3c7d6847f20c5ef555f7ed19cfc35b66aff55e8417dfa1beff3c5c1d3d9b9d25ccec63d4d62078f4f93aaa90659250b340909f03f7c1
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYzatr0zAiX90z/F0jsFB3SQkC:Xgb4mBIBhGF+aB0zj0yjoB2
TLSH
T1DF65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d5f64967972af8aca6eab526dfbbab2eecbde163595d0d2c3de54344de4dbb1b
MD5 a6ef96374287c896c26dafabbd5fa3b8
SHA1 e0cdc27dc308be7bb8238f7007c1369969638c1e
SHA512 82bab180f8b3e74f0ba53c51bc87a6aebb4f5dfded9066dd27fe41bb11d102109867d6724cc052246afd5fd9c279a2f79d907180c5baa67e340638a428f9c1df
SSDEEP 24576:KG88u8FpJqH19zria7/mOatr0zAiX90z/F0jsFB3SQkN:x7ZFPqVka7/7aB0zj0yjoB2
TLSH
T13B85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 63cdb542997f2eaedcf721b96113b38238f3c6e2c61b4b8e2e6a675196d7e629
MD5 0a0787b5b167db2c4f1b5143433a3ac3
SHA1 4d8f759f539e870c2455ecf1ad806d429cda8186
SHA512 9f99c9c6c840df112fa8b11fddab069df0234c8bf3c92b3e3b4aafec51250d3d8400751786d4e5144a371e893ee40a176ca0978657152624af96a67a09f743eb
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6aB0zj0yjoB2:2G05lO43b4B2Yyjl
TLSH
T148D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 99986e8e5bc175e32cfc91120457731802daaaa2f2a854df36ed58931eda1a1e
MD5 7695b3cd1d3bdab955446be8d16a66c5
SHA1 962f8a9c7b822d78676cc1da0b77761631e898dc
SHA512 7e10145d0dd3924b15a2298f1d1c23b16268c160a491f4bb5cb9b3635cb914a9808e01e05331a946730d4fce61c6e83ae0cf96fc0e3a544790274fb8f9bcac5b
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwatr0zAiX90z/F0jsFB3SQk8:qa5POZ3+Jt2pasx2+myaB0zj0yjoB2
TLSH
T1A965BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0a218a572cbdc8ff5c3b23d86f12b0701c444762c44c44dd276116f3ec0611de
MD5 61ca960a9810117eecef031e01001adc
SHA1 de17ca288eb46c9ae12044870671c675045e09db
SHA512 3e0e993aee9daec4e42731aa4fe4bd153719f0670bf552a5aa399aa25176655d207d71304337114fc8b148090577c1ac8e1b7fcfc46d2a05105c490217eaa44e
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fkmatr0zAiX90z/F0jsFB3SQkn:pNc/zEOVHFbaB0zj0yjoB2
TLSH
T1F8858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e0bbea54af20fc244b2c24b4871d05a2d6fb71814b8402144fa1a457ee9a073
MD5 b8bdf554cad6c3fd7aa539e2f4247612
SHA1 ea3659cc04cb2a628b5982f802935e674c54424e
SHA512 a204de42fe1e2640e33d829edc924b3ce353e51e8dc02c3c24f2c5b650c19e1f030c07d02c7e5a40f63010f605fbb2021cd76236dd3ed05030cb9fca9f201ad0
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmdatr0zAiX90z/F0jsFB3SQkS:m8MwBtOmdaB0zj0yjoB2
TLSH
T1A355BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f22cd0b7d0766aeec1ee6998e074b337b6cdee7291aad46698c7c63bf8fdd98c
MD5 769ffef3ff463d15123a3195cadea3d4
SHA1 d33654e9774957d3e296cc6381ad8bc7cebb3d1e
SHA512 4e6025eb44ad85f5cd590143b731d32d6fac70792efdce6c5717239d78fd4f606cfd2088374a32ec035b9c9e3149e0ff4d2c120a1cb32c7a0f1a95c1a3cce38f
SSDEEP 12288:vHvUrBFrEjwaQqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:vPUr+NQqatr0zAiX90z/F0jsFB3SQkH
TLSH
T16A65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 3abcabb381e4836293f8d035a46dd76e918a2873f5d2d35dc7dbff5bd9bbc55f
MD5 ee23051607c014cd3bb18164092052b5
SHA1 79d4511813aa169b518008404833917076a7c037
SHA512 d68045eb131178f6ccab3da9c5adbca762d0eaf7c9fc75e9b4b963ef1fc266562bda239f45966a42017a2dd4c351117774885c7936d42d4e2e357afc561fe49e
SSDEEP 24576:TD3FHshBIYQgABatr0zAiX90z/F0jsFB3SQkx:TDVHeBIAABaB0zj0yjoB2
TLSH
T10975E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1476-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1476-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1476-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1476-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2592-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2592-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2592-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2592-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2592-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2592-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2808-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2808-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2808-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2808-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3012-397-0x000001F76DFE0000-0x000001F76E660000-memory.dmp

Download

memory/3012-329-0x000001F76DFE0000-0x000001F76E660000-memory.dmp

Download

memory/3472-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3472-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-332-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3472-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3472-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-70-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3788-68-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3788-310-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3788-76-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3896-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3896-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3896-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3896-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4248-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4248-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4248-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4424-53-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4424-61-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4424-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4424-44-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4424-43-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4732-81-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/4732-86-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/4732-311-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4732-80-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/5236-123-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5236-316-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/5236-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5236-115-0x0000000140000000-0x00000001401D8000-memory.dmp

Download

memory/5332-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5332-56-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5332-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5332-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5708-40-0x0000000000400000-0x00000000006F8000-memory.dmp

Download

memory/5708-0-0x0000000000400000-0x00000000006F8000-memory.dmp

Download

memory/5708-1-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/5708-7-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/5708-6-0x0000000002420000-0x0000000002487000-memory.dmp

Download