4fe22366ae5d2e1149404cfb3e1993e8da026dae84d885c175d37613c1e67367

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260803-plbd2sxepa
SHA256 4fe22366ae5d2e1149404cfb3e1993e8da026dae84d885c175d37613c1e67367
MD5 07302f64560a368c48b5817c914b86d2
SHA1 902ca06183e6d9ff93df8908839cc44b67826f02
SHA512 2ad1965fc0b05b02e69c6f9b182ff45dd3c1316e8466af1954f030cca79029878dd0cf2d40f6b99c24e8445fef6925756e933aa808f394bb2bed0f40f9b8627c
SSDEEP 49152:YrxRP9sg+UqVks+J6LNiXicJFFRGNzj3:Y3MRVkQ7wRGpj3
TLSH
T177756B1277F99179F1F37BB19EB883645A77BC71AE39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4432	elevation_service.exe
2764	elevation_service.exe
3944	maintenanceservice.exe
4784	OSE.EXE
1128	PerceptionSimulationService.exe
1900	perfhost.exe
5804	ReFsDedupSvc.exe
5492	SensorDataService.exe
2232	ssh-agent.exe
1736	AgentService.exe
2308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8a6b628de05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092e323174323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023e643584323dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001c470584323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003d66b174323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005413e1584323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000719887584323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007546c1164323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe
2764	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2776	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1736	AgentService.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: 33	2308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2308	SearchIndexer.exe
Token: SeDebugPrivilege	4432	elevation_service.exe
Token: SeDebugPrivilege	2764	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2964	2308	SearchIndexer.exe	102
PID 2308 wrote to memory of 3272	2308	SearchIndexer.exe	103
PID 2308 wrote to memory of 4676	2308	SearchIndexer.exe	104
PID 2308 wrote to memory of 1080	2308	SearchIndexer.exe	105
PID 2308 wrote to memory of 4256	2308	SearchIndexer.exe	107
PID 2308 wrote to memory of 5672	2308	SearchIndexer.exe	108
PID 2308 wrote to memory of 1940	2308	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_07302f64560a368c48b5817c914b86d2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 72d9648fd495c9a6bde709e5720c77acba689912e821336bf75682825acdd208
MD5 c535c89ebf77c3291ac70f8b4db81e0b
SHA1 df2dd4c96e0d1f1e4beae1c043de824ab0ff8ce7
SHA512 93bdd0c7b6834fb950aec5acfc8ab44182273e27559dd6c0ca008cc87bd5ac5fc2a076c4e67a4dae4a0b94a26f9e7db3dc6768eb1bafd33c58e9218423011c7e
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnbLNiXicJFFRGNzj3:V3q6mjBg7wRGpj3
TLSH
T1DCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9097d8a1f09209e74abbe3da9f689bc6b7518b70a38ce40fa65dc4eeae8f1e17
MD5 7f45eb21bb7a22907d84a6a810614026
SHA1 6f20945b9aeb8c5d804b844d5eb6622d3f512a7b
SHA512 8958e0bcbe3e1a52ac40a4b27bf136adad442ebda0809c5d9fa057fdc904e127576f9f791f5dd1ffc03917016fd5e01b9613423bbfe7202439930792e55c7a61
SSDEEP 24576:rXYfDtczAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:utcVLNiXicJFFRGNzj3
TLSH
T1EB75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f7fbcbda263a3ee37f07e0208fccac94f081adf6b690cf309ee5f401063feb75
MD5 c05abe8689f1079f8eaba02cf5c15846
SHA1 5d3f598639e158a47d2c3b6a704830dd69841c93
SHA512 c0d55c17cd4525aa6fab989405c654da0ff14a86b885e483af89f92090aa897b249de469ae97553b6a744e3446b96f72a2465835f7f52f21940d1a0f72d01dd7
SSDEEP 24576:80Le5ji0hmxhrMT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Pji0AzqLNiXicJFFRGNzj3
TLSH
T1FE859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ba2a9b882df1379ad2141810136b0fce030bb8e49d97ae4f41acd5e0813c0675
MD5 8aead55cb8a6970c528141d5af8dfea7
SHA1 35873a35a197419d4c6b14cbcffa82e203eda98b
SHA512 e8656fffeac23d2c7c683141da4a504083b2a66aba0c674279a71df024200cbc6d208fc8b67f72c031cbfff5464d7642cb18f434998804b8a2a156ae18a2a3eb
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n/ezSC6vUzPv+HjyOLNiXicJFFRGNzj3
TLSH
T193756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fc9376b41d99e369fa47fcf331899a67d7c05c2fcfcc2c7609019a187390f4b5
MD5 9e6ed46f618cb075d33897667fae547a
SHA1 baf76ef0725c12711922b4765c9a611269b81c77
SHA512 ce7de93f2cee7629b924f3e34bd7a6ec778978911c3a9712ad6a7d6771d50530b6c409306ba3f975ce6992bdd402b11eb9353afe36927013818ab5bd9c838722
SSDEEP 24576:4VbqPb88hv/l+BQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4VO88hXl+KLNiXicJFFRGNzj3
TLSH
T1EC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 73d326e2dab3c37ea920ee7e7bf7dc9c82c31e457a7778bdd02764e7c99be4d3
MD5 14f177898a641def60099408f9b98fc1
SHA1 74242d010a41da55fe4e7afa75c30339daa2c6e9
SHA512 6eab45abe0450eca55bdb93fd7824a9a5c56b1075273776fd49b04b64a6351681bb9f34b162c64cfe0a88d0ad9d4e87f6881f7522e35b88c03b680279f80d32c
SSDEEP 24576:VGv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4LNiXicJFFRGNzj3
TLSH
T1F95523D3468864B1FBFD003A867A5828B5845E2CCA595DE2D2543E5E913CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 cee1eb91d255bd3d670f19de6df5aea79b7466599a52a32806f20e2bb765d46a
MD5 df895f664d9a0c1f99c1112aec08f399
SHA1 43edc39b00d1e8f69b589a278d3ad314c7dc2705
SHA512 9972f49e812623fb958b40483bbfb3f48a305ea475f4f93983848f0754727778f7e1560f0f9c0a74ba83fa645f3d395a3556ee48bb7733bce36a4bf0ca2b5297
SSDEEP 24576:/JIUo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/JIUoLNiXicJFFRGNzj3
TLSH
T15B75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6da0679ee5688a1c49ed782838b50a18e956e47a03061edeae734a1babad1c37
MD5 e4927ab4512dc3483a0586a8f5f34d2c
SHA1 6005b148385c5c0a4db4016dcaed02d02bb26355
SHA512 fec49b4a27f41f21f908d58e4958d84cf28847c8c78048c452c0f6bf1f084b6375efcaf16439d9c4c06a0580606429e93ec581f6ff3d8705410a99d3f896cdc6
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH2:mQvGAdlCEL8c/WRNw5C17wRGpj3
TLSH
T124266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ab3d429fe527c064c9b484eba2930edad7a9bb059bc1ac85d831014034024a4f
MD5 637f9d9ccf5bf6effc30ef5bad800c19
SHA1 198796934f99f844315a0a18b59f0b29d6648b00
SHA512 0ad3628568ad317b191d1a149581c5ced17f87d6648ad92305db71690429d0cda5a94e5211d79afb395a6a96043e81d0f297275576c6efd7bd0a5d3a845f5f08
SSDEEP 24576:JfewsAja/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1ljaLNiXicJFFRGNzj3
TLSH
T1F975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5085e9014a1bcce7529efaccabe94f76d8aa9dd9efe6f81b54d5f6b8cd89c1bd
MD5 a17a9839dd3c5517c291d9632a56b2a7
SHA1 25d3e18cc3ab2bbf56909c941fb09eb4e45bd620
SHA512 7a1a8457f3e907c4f804291955db911a6166cb45b3c959a1abdf780ccbaaa4adf6f92dde90264fae03f8ca64c41ad48d69c05c677dcf507a2f8678efd46e097f
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGF9:zUEtQevvqc2W1cpV20I32q9
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 eb781ab1de7b1f3f6ba31246ead6da28df04f8bba61c6b7b4e7ffdfbe8b25564
MD5 356d7fc6f592364711ecbe643f0ae5dc
SHA1 96992ecc6f64caea1768005f37ba5c2b912bafdd
SHA512 2828b8ac8f22601380a94eec0db5459cd6941f3bc416f66fd70eb37d54216b58cae35680ec2a828b88987bbfa622fb4fe4b61733653124389d4ad273d8f83fe4
SSDEEP 49152:QCbRquA/m2yL5zLfFiV+XenmE3/z6LNiXicJFFRGNzj3:5oq2VjnmJ7wRGpj3
TLSH
T1A3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 783a753ced42deff2d4e21630f98a2fa67fa54e1143780a82ebe75ce500ead75
MD5 3806e1c814dfa8ad19a9aee2e8565626
SHA1 da81b87b9a6937857109e55fc28218e32d770e1c
SHA512 38be2d2e4e19f87652830a225bbb99446a0895e126807196379c91922bebec84ffc2ff741e462febb01e48664b69d808e5a6f6bae81673859b246d4b0340b46a
SSDEEP 24576:5AhGL6IFoiwtA5l7S53p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5AM5Foiq55LNiXicJFFRGNzj3
TLSH
T169359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C24F2150911F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3f59359fa3e0c3370e214782a1bfd823d2a366775eb01e0f7ef78536203577a0
MD5 fd3762ccbb3ecd26603ac9d1f9d179e3
SHA1 ace7eccc114a0c6d9efcb659241d5b5088adcc81
SHA512 aba7ff1f2450f669ec6afa9f05884b5ce7d56e58d824da62c135bc6d359fdb52fa7e8aaae3364bbaef8ce4ba61fbe89a4be8fabf41b6326af9ddad5ada270350
SSDEEP 24576:MwuROWu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MwSOdLNiXicJFFRGNzj3
TLSH
T1EF65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9910fb117b46dacbe7298c7b2f10b2e1bcf3fef3b4b141e65721c95f1eb993dc
MD5 0274afe851f4455c52a7ba1e2fcefb39
SHA1 7a441f6b7d3e58cd618ebba5c1eab7d05da0652b
SHA512 e9c56a86b4a79c1c347357ac578efe251f3f58d5524eb2d8ee768d2b9df9c01b354494492fae131646bbcd25ca121d9fe9a8ab4221460f6041d9c4a75944603c
SSDEEP 24576:TZuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
TLSH
T1AB55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 14b8a20fccae3226299e338fd29f60b6ad685e1a9fd63f4ac704145994e15ba7
MD5 f7a2699ab8e602837ca80f303a7d6436
SHA1 8d688cf8acf7dbd44948b4a9be096c10f81c7904
SHA512 0033478856a4fb5314d28be888bda6414b17fea9e8a345c3996acd884a5295330cc7efe100515afc59f1032654c0ef114d04aa26bb4f20ba975cca7bb812e11f
SSDEEP 98304:uQRQyi36YOcPDLvw2gAf+PN3s7wRGpj3:1QyiKanX+PNYF9
TLSH
T1AC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5a82e606d595394b36ca140266e2926fe1ab63da6b907ea81a07f03e674b65ea
MD5 d19f80068bf2d6bf2e45a31b8111eaff
SHA1 cb5c084cb57449d47959f044cde8172a991c82aa
SHA512 a51d7d2b781b37ce88787caa571c387495134c96b0bd411d66febb910036fc256d880cde9da15c5e09f7c693d510c3f2aa74017b991b7307862c696a63f35715
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN3s7wRGpj3:VQyiKanX+PNYF9
TLSH
T101667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3d85fd15013fc3e7bf5a12af2f0f6a7f0906c99e060b9f09c57f1a3d4100b6fc
MD5 a0b5dcc8eb17a05ffdfb22db1f7f19cc
SHA1 c2d2bd91f4d1cfb23846442913f904eef84fe212
SHA512 085da1da84c0ce5a2c1f40972e53bc7c6a31f63a8b60e8e212cb7dc1b76f509c89fafd465875e90866d0434fd69e8e1b7e60db729d6e961a0414f71112664c85
SSDEEP 49152:d68Qg55nhkeWu7PNU3/qLNiXicJFFRGNzj3:bthTRc/q7wRGpj3
TLSH
T1BCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0de34007fcefb52e670acf8260382c845c113b9d7e742c66fa06ec0230041b9e
MD5 3b5d91cd0743fc0fd95f21d89b9cf7f8
SHA1 72f2ca5a1899fbf1eaa589d26fb921069b0ebf52
SHA512 014cc94630c72a7e715e2eff0b971e5e9e5fe37f076c22e579cb2f499967855e42cfb6a28cbdeb0805ee67a52924cb012bb7a262b147c54ec4c003e9feee3aa8
SSDEEP 98304:Xy5112gYy5azzVvU69nLKnhZv7wRGpj3:qLIHRWh1F9
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4722d1f2afb43f39ca07856be138b627585077f2908c9ea38a4984c01c943cb3
MD5 f7601b0dfa50072b433f52c0ea725c4c
SHA1 4043454adbe8e8a9c36984d75a15c55e19e703e0
SHA512 8b7ed7d0465381ea3a59fb54654d084a99265be38992f33f201a438389f44025eb2a1472e460db093bea3a72f0b05abbf00e158fd6480e5d7ea527aba8e3573d
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:5u6JmIxd2dk7wRGpj3
TLSH
T1F1D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 faa1ed55220887fb2e10a1f2ed33ea3785075e7912f110d5009aa77f12f4c176
MD5 27a88708c15c1ebbf8a884cf57f5fde7
SHA1 2b5505696eade30d9a96a3812cd8ebf954c898ee
SHA512 ee5a0000a27457d7f6a2696e3d9ca0b73c5b14133709515865eb77d5484487aa08c82962ba7b5b4f6603a28ee28ca8dee0f3e60f8f0044b4629b78e73ec6bb1d
SSDEEP 49152:41hpsNoJpF1A67U44CwH7R4xILNiXicJFFRGNzj3:4mifPqRJ7wRGpj3
TLSH
T191B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9096047c26416973852601759a8dee63356347a7ec2250892823cf8aff1f5118
MD5 518acc9dcb7847726d20afcff06a35ac
SHA1 afe45534d2b9197f0c9823338983e0ffbd04579d
SHA512 2d8b32908e09e8f96372fde2ee556c2cfcc5a56464230d1c9d253b5c0d628ffc2989fddaf55d196f0937d7292e3d4ca39b979dd277d75e0c5ffef0862316e64a
SSDEEP 49152:YSuZQIY0Be2KkRVtOnks6NMHqLLNiXicJFFRGNzj3:C5dKqi61L7wRGpj3
TLSH
T133C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5876d0b51a81f2724b3dcaa5d07a7573fbccdfc55d502a01fdeb9d0646793b7c
MD5 0459c6d39f7b4e782782677723789113
SHA1 ed34aeee0ea4161c43dda40f5afb7acb4357f443
SHA512 ee17f7f468480859f7bb0025edc3396130a9eef706b7131a8bc0afef812e1c99accf2b1a312e8d8b9df49bcdb0edbefbb58c04112eb35e905994f954229c0fae
SSDEEP 49152:GhtSn8EApI0figjgiDn0AP5wULNiXicJFFRGNzj3:HX2iWph97wRGpj3
TLSH
T15595BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6d1d17b6125e4c35cc2308bb7258960c8dfc79d5f39d230826f9c6cc00693cb7
MD5 c2bcdfa36cc32760f20f70e5cb181e43
SHA1 df866eab9bc993310bad2e8fd9accea406c8d07d
SHA512 034d8a9c43ffd27c628d1e662a5d0bff1d26947c830d13ed188de5858be1411a037a6158400dafe807c77d054a225603e82975662a7c818f9776e82272f213a4
SSDEEP 12288:iziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D355C955B1FAFC0039C6765428F5881E2DEB5618E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0df96a6d22cc2aec746f008285cebce493f010dc4569e1c753b98343fd0d14bb
MD5 8298669cdbd551e0176a0a0d7635e09e
SHA1 c5654f61068a84e9d2b4f4d774fae0c3e3d29290
SHA512 0039a74bf38aaf9be622a9f6ec3f57ef0529b283ad2e29d13890fab9fda4244b0aa6f38666389a685edddc08bdf376e6e49cabbf55213a2c9813b0a30b79d8d7
SSDEEP 12288:BsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1205523D3548955B1EABC0039C6765428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9cd291cb485898f3eb65f91ef99946f75cc70150f0129bbee5a766fa497dfdc7
MD5 6ea578420253ef93c1490d2f9dc76093
SHA1 215840b19105cdf32e3ee82d31660f7459d9ecf9
SHA512 6c4d0191f7864b4ddeef3993907615a3e541e6507ed658c800b73a608de428e9acb7a79d1c8f974927158302cd939b7207148a635557906ac72ab32d44ffa226
SSDEEP 12288:QWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 25f24685b878ce09c8f44afef451de60bb1a913ae17ef9f75a8ad7a9eab74ea6
MD5 53e81443757e3b4f880bc32487cae010
SHA1 abb1a6b7f0df0eac24d1dfa0797a4b861135d737
SHA512 da7632f00d3ca1fe825247a66d5d2d9497c44fa5e729ff92812bde37d4314d7c9bed44c6d900202e3e5d13e1bfa0e51aa9567d72c83fe3d47784b0008aa51ec7
SSDEEP 12288:zVFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C552392168900E1E9FD803DCA764424F2A47D6CD7365AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 499d6d1f96fcd2d8f190cc911a5c4614ba67e110ea901bed19bce3aacec2c07f
MD5 17ab7a888266d1075d09e60b7060fb5c
SHA1 daaf75cf4904a04c7d42e276cffe6a8c4198c3cb
SHA512 ec5cd7f4a7e8166545e0466f373aaaddd6ada6776e255e2778432db628b0c6117af3264c586ae00c2dcc20441e299ca90506ba02872fd9d3af6764be8caa43a1
SSDEEP 12288:ItiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ix/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 098398e77f5a156e2a5dd93d747694982f532b8492362270719326b55c0d9a4b
MD5 516bf88a27a83ccd1796fdd73e23a937
SHA1 3d95aa1bc719ec59a118687903a44e2b568ffb2e
SHA512 1ca6fba057234bb1d435b0019311f4f74c04fceff47f4fc4e744f132d4db41b516f9230cea2d18b47fc5d67a9971e6de8d3b9c7f273525453f85fc9e1d380fb6
SSDEEP 12288:HAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 096dbf7f3464500fc9667a6da494a0c0352daa98bc1c9cf15ad1ed2bd21aabdf
MD5 9bd567aa1c3ec87a0df1c36c4b040f2c
SHA1 41fe0a21cbecfca53610de9fa9acb5c77c67c24f
SHA512 7ecc9627f3b8855a25187ed2f8d90ba63fb3dae27e4941f9ef94f83edddaabf8ef92a940e76c0e905a06489cf39bbb95f819aa13123f9c93f1c61fdf4cb7c271
SSDEEP 12288:oUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D2558955B1EABC003986354428F5882E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 97706ba54f241a2b578b97948ebcf202467c982c360bd1080d9b4156f929df29
MD5 fc8ca8c40f83e0b7b6385f31874955ff
SHA1 028ba819b7123520f05cf026e8756576f196f0be
SHA512 69b9ecea5f04ef2257d41c339e45c7a943074321b14eb441e6d697caa3db1f8a34b8343f7f410906ee0b9c48334c7074b83b01f3cb83f9cafd7c423ba3f65533
SSDEEP 24576:yZM3zFVSO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yZM3zfCLNiXicJFFRGNzj3
TLSH
T187750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fbb7a2599718191b6268391378dac7b5afa0f2ff3906eab623645338fccb8da4
MD5 1637afcdd81d9eb31e31b2359ac9708c
SHA1 95e89fc64555360f71aabd1f791527b7ccfd988a
SHA512 7559081dc56c6c7a1e37a38fae92b3b4c92203c5d302b924b7355d34e83c1235f9d142d5878da885c978b105689e511fca672862d3ba84705c68eba28c1c3309
SSDEEP 12288:aPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3558955B1EAFC003D86764428F5881E2DEB5618E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 86c85cf873008d474a5628719dc9a53797d9a44c24eef89863dfb391ad28333f
MD5 37d425fe8ee5f18141ec6f1590762fdf
SHA1 7a948370d3b558b112632f2729d0b8c314f52eaf
SHA512 18a7f4b60985140062b998339cfbdbadfece53eb4f152cb0be6675d59fbf554154d73a3da0330602b07c96e62680b33cfc2ea35bb3191e0c732fcdc9256c2a28
SSDEEP 12288:fLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ff/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3548955B1EABC0039C6754428F5886E2DEB5619E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9a4553ddac190c08a25415a7dc2bda748d6205edfafb5eb8395fdf2d48991d0e
MD5 d920e187dd4d910e03f7b36b44c2c422
SHA1 04630de3e345d7f015f7c59a9af0f0b9c3b53c8b
SHA512 f8f4d1314f1c9805719b98aa58e6ea55e7d1ae1007e4286c353e0cea797b55f6b73ecf4b1c82d1fc47a8da4f5c99f32470e749a1f0ad13689c636a4e009c3a8d
SSDEEP 24576:8zyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:89LNiXicJFFRGNzj3
TLSH
T1BF650247629530F9D17A8139C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ccabe70fcd2e59a142f1b7e732cdc71b2dd3f2fe440562d2bc9b83baa4366760
MD5 ebdffe29e720ca080b8c01da1c377200
SHA1 29155fcbfea2550da4467abafa01830c16d0d5ef
SHA512 99e7b517c0945e764dd247608c9c7adb1acd6eb22ccbef48ba852ecc1d3861106287422be8471567371fb9da165b4afe1d08d94040f663c043f29a11f74aa8d3
SSDEEP 12288:zPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3558955B1EAFC003986764428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 774f0e174cd28ad15b475bcaa0906b5dc186fadb8febfc132fa88fb4fc93582a
MD5 0923d80ef298cebe784352a44c5840d8
SHA1 90f4130866f3de20d8118e48403db16664f0fa2e
SHA512 a9c8799a669293bb0b5dd9a1741006b3e968264038f60645f545c253e07757e74c9ea93c674528d64ef0260aed854fc07487a13f7b9554ce096e21a89003d06e
SSDEEP 12288:qPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18E5523D3558955B1EAFC003986794428F5881E2DEB5618E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 aa5c28d6bff8ae714b17f3e7523c3c4344fbfb338dbcbd2cf09c47ad9a1aafb6
MD5 c7f2fbab756fb7ff62987b98f8e532bd
SHA1 d794a674d5de64f7f790bfbab959a10725503e88
SHA512 1327e72b74d28920539fa2d2da7743f80bd34e3747f7a2e3f8dc6888b2ad39553a7ef1510c399cfd971c61def199fe6104ed57f7d325b1efda4821fa228697a0
SSDEEP 24576:qzyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q9LNiXicJFFRGNzj3
TLSH
T1F6650257629530F9E17A8138C9621911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 736700392b8d597bc329551dbb5842c0e58e16cfac09056170fe8439798f318e
MD5 90aed52923184154b27e0342c13ded21
SHA1 330743575530f4e36a35e12a0693879ee1655dcc
SHA512 f26fb693792962240e6b749fb87a897f078958edd0a9acbd963e369292d04bb3d716df9fa2cf0c396abd394b862d1177ab9676f61aed3e14f22c9ec9c5a565ca
SSDEEP 24576:UT8aLl3z0zDw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UT7LljFLNiXicJFFRGNzj3
TLSH
T1C97502A5B39018F8EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4e7355eb6e392be8e3f1c684ed968f34dca1a63b08559c45f66ee78aa94a5e3c
MD5 2cdd22d3448da8a002a3da219af4b57d
SHA1 fba29b31c1e9290a6eae3d74de23b2ac54231105
SHA512 bf9a5f7db8fb42eb49830af17a128bcba5341bcf237097b2c19d38b37ba6fabc663e7f9da29c44c437052818fd1ddb85988a6aa135eec44ce49bd60de43e79c4
SSDEEP 24576:v3rd9CHKy7GZM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/rd9CHKyaCLNiXicJFFRGNzj3
TLSH
T1D485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 63847ee7ad75bf00a3deee01fd241f193ebba60d0963aba4a98b0757d3c22421
MD5 2d4bb241f6262e90714e35a670fd913a
SHA1 5a82c2017da639f8734e2a22619ea2059fe9ad82
SHA512 06b7e74450eb2296dfe806368419f2145eca170cb1f811a3c635ddcf1d1d78ede822b3bf1ff0d96f2db4baf29d9447b87ac21328275bf0ff3d99663e78634cab
SSDEEP 12288:d2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3558955B1EAFC0039C6364428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3a35746883242ac29d8c4297cf819e422754abe8d7aa15e565802fa95f36d54b
MD5 7f6b8c274bb49a3431639fddbf47dfc5
SHA1 14d35a8401a51739bf1194074e3ccc4be133849e
SHA512 c468742a11ee5747be8e8a8e40e79ae201c2c05850e5c17ff1a0bc3674c074e473a21f72efb46dfcb19e09efd12aad7d3d06857d013e1783c41ac85a02b24409
SSDEEP 12288:jYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D2558955B1F6BC0039867A4428F5881E1DDB6619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9e33c6bb17f3a0735a0e670318101d046f78c318c3f93a05c34191389e191161
MD5 241702f27f49bec8b2399f914f8243ac
SHA1 86b76ba1f93183530d3a4294b0db9e771b788405
SHA512 632a7e9d1f3e9654da6efbd69553202df11e88fff5246c525593a5d3b1bd5d80423ce5920dbd110b5c5ede4b13eed19c903e693ced8cc14ea0e5b622d2a0a9c6
SSDEEP 12288:hBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ht/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D3548955B1EAFC0039C6364428F5882E1DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 faab26971a71179b5b632666f89edabd547d09447ed6671dd4b52765865b6b8f
MD5 6c48ecefe472232f0b1cd42308711b8f
SHA1 39aa5056b8a3eaef5aacfe4dccbf6f17026446d7
SHA512 fe8ea811f936a20671681a20d11a2337a447462fd3bfffcd87b8637a8a460dcd321d12b2b13a9696bb8f2e33e3244e6eb7d6a0060dfdd7780e5ba83b3bd30d64
SSDEEP 12288:CPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3558955B1EAFC003D86364428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ed308ec79b678b3f573d41867c99e866f9a29883d3a80daf8c2e1882636242c7
MD5 39afc9e194124fdb96536b83d074f65b
SHA1 d86f742a7041d7467e580443dbbbc8cc5c0ca0ca
SHA512 15cbf5f0d9f8acd0f3ca71ae5bc738320756ec5e1ac6177ff0566c3aa0e0ca99d08e6abe09da9d9177461caf082c88c69db0dd1b3f6f5bd73869dab62a950e24
SSDEEP 12288:c2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d14dbf9679bd7ec8168e6a978d4aa5b4bdffa1814357ef399d8cf887f69a66d5
MD5 20c804e2c76c81c51599c76016685477
SHA1 26ea7fe6874fc9a70b1184315e9e3584f0097abf
SHA512 e26dc966e1b5da3603f4a9810d77c22116c10e657b1d5f8d11232e1410123b2a893bde13e0eff852b26606156fdde0e97c65f6fc0db701c4ed04e2282a42ccf9
SSDEEP 12288:PXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D2558955B1EABC0039C6754428F5881E2DEB5659E3E2083E1EA27CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6bb341d38f28dd512d9108ac3176f639e30b6392f59806bfdd9a2b6ecfe06134
MD5 12ff7192d69478570e30b5c433177a53
SHA1 f45ec704f7020b8bc67c942ea15c3abc5543c81e
SHA512 eab87c89dce63d653dfa1e35a2a75161e620b8c1df66eff118033333680841cd8519e2ed2de2aff719c55e294f3215c324e9ef54d1d7b39b1bbbb54f7712bcc0
SSDEEP 12288:YtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 e864225f8be884358f3e635ac4932f53851aac9a5ba4a32f936e2f38c3ae5509
MD5 df0ba892346a6c7747aea3e73b230b3a
SHA1 48b92ef61fd6f4e374a886e34bac65ebdc21f442
SHA512 d9ee2d6ea923bd9e788d03d3044752cbbe971c3e9f362469b53ae6ff4a5c020956be960284551ff5eef48fbe3a144acd2af685fc8d8a943648252b159a7a9d82
SSDEEP 12288:luiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1015523D2558955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EA23CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d657dc5c197bb46144eadb5b337cacb0678d59ad1b7addc687c126385a6f1613
MD5 49059b005f468827528d24a9a34fa52f
SHA1 94e385405346627877671fd00b3cdf08c2011ab0
SHA512 449ad0546afb779994fc6e9beee4c6631d0f7e87d2220ad987d69ae4a85bbd39520c4931a810d20a17a8734d7b810288a2215563e836007c2a25fd6153e0b6c5
SSDEEP 24576:dfwvzk9RX6wkyAIP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UMnYIPLNiXicJFFRGNzj3
TLSH
T1C785DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa3316a9e05cece44df3d4eb0f4a1b6ef76e8ee74f942347c84206e9f313417d
MD5 7e4e9f922b53c8e19b8d3d1a0146860c
SHA1 2c9dc5e4f390b226186e171cf3afc1cc27189ff5
SHA512 97a4f323a02027d2d7fb9876f13ff56ff6713834d4e25e607f879334e1e9470162c0bfc52a01fd8112b1c46ed7b7f1429a772b028c9ad84239ff7eea90b99369
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00LNiXicJFFRGN:KySzPM7wRGpj3
TLSH
T115066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 31ed9e5238a5fc63fda6f59e3396ead15aea65d9ee0c4f604b9722f8c8750d45
MD5 91f59f2c5920c3d368faf0873a66fb29
SHA1 6c46672541c4cdf85a7a795e65ed1303e595c3ff
SHA512 52ad7c58435e2bebcea3dde4fdfb0aae9a76c417ef1888652470d76f669222e7b6d2d7c42f23c7a0c164c2f70eb2ccd418e9f37060656b391a188627a0697d10
SSDEEP 24576:j47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j47JUQjqirIhCnDHUPfF/kLNiXicJFFS
TLSH
T16665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 78c2f8670b8edc8fc4dd9f12d9412eeca07967b76999473ddb77f4746f7df833
MD5 10bcd1ca0157dac8bc0692e79741e3da
SHA1 442123a1d78f1ecf2237dc69a7a1f08116c7a003
SHA512 249d19f602e58866a736d8f295f8af6864fbc05ac71fd3c5c9b87719f0ddfdcc2782bda7932970b0e1b37a2aa9a735ab5eaf4fd9f1ebcb8d33cc79bfc1f7c53e
SSDEEP 12288:1psf/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 750e39e7cb8e648730fe46f131eae0b8df4f023ad49fc4c6a3040183663fbc96
MD5 cf8362a70413052a593a97918e944664
SHA1 1658133b67cb6b6c980c29e0cb00d52b47806fde
SHA512 f11363071546c61bb7b44699b2c8e20d7c0deedde04a168e19e374b70316dfb8dc195a6938cd332216ee66a43efea694fd6faa2d84c91096d0eb886502ede8fb
SSDEEP 12288:5C2+ZU3fkv3cqNIJn7DH5YK7rkmisDPZxxXo:5b2UPPOy3HzYmi4hx9
TLSH
T17B251710766BD75FC6A980321E33D1CCA7707D41EE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b2388622610d00bd2bc33dac81ac723fd2ee602d65b3e397616c55b22133d035
MD5 cd549545b01be38161ede232356a80e1
SHA1 362d5ed34ea390004f0c06cda4fdc718ed9f2816
SHA512 4dc8b0ec2590bd8d0603fe260cf64a6429b9a3b8693f333072a84859a0bc47f7f62601f2b2d003bee3d33e6e3c79f38bdd1426e1290dbe72fdd704dfad296984
SSDEEP 6144:ZcZhrL9DHUJGgiflsWL7nrsYfgNoyqA26tMxsX6N97RLDF5GlwF0BZ/HtawlVOsT:EW6sYSWRL7F0BZ/Htal2hTJ
TLSH
T12C65D8816437A39FD1F76032072A9B4DA774AC0373056F26B3C85539D86AB26B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1dd86a5d854efc83bccaffb1ea1901c26015d9c3efcbdddc86eb57abf8103915
MD5 896e9e4002944277d6621885f71419d6
SHA1 3301cb56f4220b4f542b122c73cbbe6f58c5fb6e
SHA512 8d06947b03f069befc58cc3dabb5feb578d723bb09a3b64ebda7067058b5b24f8b252ddca553ba2d1f332b5944f4f61b4f9bb581f3d93d81c60558e9729821af
SSDEEP 12288:fF7HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 68d40e3bbc4511025d368391d053fa0004b0a1d3c1c43a0561d39741249c8774
MD5 431d36413bf68ccd0479b837934f52a0
SHA1 938186f95770ad6f8633a9e5b6c014b769bc6fc1
SHA512 600dfb94f11576eac9ec2f65392b0a58f7ef46e84162cfe2270f227b4e388bd077287d93e3ebec68bdf908f7d4e633bb6d6e44da86fd4853aa97d3c4f97dc024
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ugb4mBIBhGFmLNiXicJFFRGNzj3
TLSH
T14D65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f6c0321a435fd511f7d8374c63a299d5b80941a9b98e8ce286293b1e3b1bf44c
MD5 9d275eb4640d13aac1e099dc7adb595a
SHA1 7c8733144e602577c2e05f71cb4a44c8c69eccca
SHA512 10f57daef7ce1351b8453aed8410c013467dcd848631f79ef5a43542ce53e4d6be05446a5b4bb215a098cdc7d57fdd1d1a9b30912a66475f22ec2c46713c4f24
SSDEEP 24576:NG88u8FpJqH1vzria7/m2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A7ZFPqVya7/NLNiXicJFFRGNzj3
TLSH
T13085F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a49d4274e381c44379fa8e33c439327632127e2324f3cf5f4539af50b59fbeb
MD5 2868e63a1c04e4ef5d126667bc9fa88a
SHA1 e0350c97d3877daf265ecd96667c0dbd998db2da
SHA512 c6fd88d3822a0d9f8d73ff19f7b31a65d95bef245b3bb02a24a8ec52ccfd6f3d8d630a15d6abaf0608ed7353b5f2aef684c9a4ddaa5e102f4ca3b3b66ce1f462
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSLNiXicJFFRGNzj3:dG05lO43b37wRGpj3
TLSH
T178D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8f1c45134fa0a1634589823dfd5e49e117ef57ffaa71cc6a1b98627450b14265
MD5 856b3165e8abfa6b2256b0379991e22b
SHA1 a8fc388fbab94d8a8c4b0940133ceabde71369f1
SHA512 edc0c876a27c9626e974833021cdf39dc369b7d97e936c7174e5fc1f7fc2ce7c20be0dc5945764bc0c98bd2f127706bb3debe1b548a8fa431a2b59a44499f778
SSDEEP 24576:0fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn0/TwSfVcYG3K/cJHlnFR+IGNe8jg:sa5POZ3lJt2pasx2+mqLNiXicJFFRGNf
TLSH
T1ED65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 89ebf9d77e885e667175df11a018fe00b48e03aa63fe1d5f5a98ad027345427e
MD5 f59f2e362139287a5ef58ed937136d28
SHA1 3b34cfe1400fc1786d0df043d1a54c30775f0d21
SHA512 4e6b00bc39ca04a8adebae93d72bb3c4d9b0b98b3148423db7889cf1d19f37db3e29b32ecd767c432acfa84f4b7480b9d88ce3d5d8562b9b4eb5cd45217e0ee1
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tNc/zEOVHFtLNiXicJFFRGNzj3
TLSH
T1E6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b96aca1ad14e7058b58244449d343cc0f0f10631f806140816df22af49e41ddf
MD5 4985f88d4b9efe1e51335103f6cac969
SHA1 38a2ade1bd97e0ab7c1c9017375797b6c4030fd2
SHA512 56b19a8d92bb2be421a6dddfce823f7641c8446f8040a3878789eeb5c3dc7eb9f84ce84a2d9de190b0e79431a378dfde5fe34f1a7ecff928a3c2d54baf57fc92
SSDEEP 24576:kzkNvNnaFeYhJNtmZBmY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kzMwBtOmYLNiXicJFFRGNzj3
TLSH
T1AE55AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a795b74674b1a5b25f1d85e34db344022a56f34bca11b6e2342160f8457f75f7
MD5 eef6435a8f5ab4a6518f1689761c116a
SHA1 21cb695f14dd5fea4c17e5a1c4ae85b29db97055
SHA512 54ba263e0641fc369d3cfaf73e7bac0c359c7dbf48895bde625bc05f7d4c55687caab61c94f68ba4377404e70fc11fd091a99caf3cb9399d938a75a079116471
SSDEEP 24576:iPUr+NQC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJQCLNiXicJFFRGNzj3
TLSH
T1B565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 068daa8ea4a311cb5fc0051167d89d6ebff65bb7f0c077ca9570944737f74fbe
MD5 f7be0ea000dd82c0a03bd500d67ce7a3
SHA1 ffbd840f5caec7601c068f20d860ab253cda5f08
SHA512 c9bef9dea94298bf96519f85c6c31bd86d9b74f58f29197a9cd0b3364685d6f35d57b251a93dc3552551590d354b89440d21d6a55b8cdd04624ed4bb59a5e4c1
SSDEEP 24576:kD3FHshBIYQgAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kDVHeBIAAnLNiXicJFFRGNzj3
TLSH
T15B75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-305-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1128-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1128-62-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1128-64-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1736-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1736-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1736-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1736-132-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1736-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1900-81-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/1900-76-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/1900-75-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1900-307-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2232-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2232-118-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2232-111-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2232-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2308-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2308-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2764-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2764-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2764-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2764-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2776-6-0x0000000000DD0000-0x0000000000E36000-memory.dmp

Download

memory/2776-85-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2776-1-0x0000000000DD0000-0x0000000000E36000-memory.dmp

Download

memory/2776-7-0x0000000000DD0000-0x0000000000E36000-memory.dmp

Download

memory/2776-411-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2776-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/3944-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3944-70-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4432-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4432-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4432-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4432-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4784-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4784-48-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4784-56-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4784-291-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5492-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5492-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5492-310-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5492-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5492-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5492-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5804-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-470-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5804-472-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5804-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download