f72dabceb7c920db128e7ebc699cc0663d4814f82778382a81dac7b9615d91e7

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260804-jxggjsvbqc
SHA256 f72dabceb7c920db128e7ebc699cc0663d4814f82778382a81dac7b9615d91e7
MD5 22a7c9b5173642cb5aa04f544bdf568f
SHA1 c1f7bc282599971c49c9ca604e204a3cdcc68086
SHA512 95335a14340a43f82330bbbcca944945d29161b4f5bebf54fddc94773e80c441c28c18f2738838050bd7f72844ccbde6ded470696cd6b7104e0cb8a986e4effc
SSDEEP 24576:xvrHWdZcy2uyqWarHQHzwqTMV87BbkjCMvGdLtWBMvjRA+iqMIjmJ8c+hE:hsHLbQTjTb7mGVtNv1PiqMymJ/+hE
TLSH
T10265AD2237E58035F1B36731993A931499BABCB29839840E73DC666D2F706D18E74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4032	elevation_service.exe
3724	elevation_service.exe
52	maintenanceservice.exe
976	OSE.EXE
1268	PerceptionSimulationService.exe
4976	perfhost.exe
5704	ReFsDedupSvc.exe
1796	SensorDataService.exe
4484	ssh-agent.exe
6084	AgentService.exe
804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87d2769ee05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4d909b1e723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf252cb0e723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047cc99b0e723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009759b4b0e723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004de5bfeee723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029c0acb2e723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1671eefe723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4032	elevation_service.exe
4032	elevation_service.exe
4032	elevation_service.exe
4032	elevation_service.exe
4032	elevation_service.exe
4032	elevation_service.exe
4032	elevation_service.exe
3724	elevation_service.exe
3724	elevation_service.exe
3724	elevation_service.exe
3724	elevation_service.exe
3724	elevation_service.exe
3724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4680	2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6084	AgentService.exe
Token: 33	804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	804	SearchIndexer.exe
Token: SeDebugPrivilege	4032	elevation_service.exe
Token: SeDebugPrivilege	3724	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2036	804	SearchIndexer.exe	99
PID 804 wrote to memory of 4056	804	SearchIndexer.exe	100
PID 804 wrote to memory of 3856	804	SearchIndexer.exe	101
PID 804 wrote to memory of 5712	804	SearchIndexer.exe	102
PID 804 wrote to memory of 3212	804	SearchIndexer.exe	104
PID 804 wrote to memory of 5644	804	SearchIndexer.exe	105
PID 804 wrote to memory of 4024	804	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_22a7c9b5173642cb5aa04f544bdf568f_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:52

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77f22d2572386e4f2ec7642236bc7529d235159f79dfab659b73580ccb3489b7
MD5 812c6f9233c581d9562fb84ca5888d41
SHA1 25dc43b92e83093832eba53035bc9b391a533548
SHA512 873e75d737ce9bbf75d4da114ca2c7172d11a3a2954a950de23de894eeb673b81f900daeb302dcb8870b37aa721078a8766376cf93d1b6b961c63c06867ff2a8
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHv1PiqMymJ/+hE:Q3q6mjBGtPiqk9+
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7a78ac764b6715f361ce3831f8741550f5859c5cc23d598f4f743fdcc3469caf
MD5 917d3152b7038069377de0000c76dc9f
SHA1 9b564c0811ee4064b1053db596138cafe191eaab
SHA512 bd4eed6145551e2f2a377a576d483d855ec4f78b8dd37d8725e76aa8d9208869823b2a5a9f80e15e14a8c6c5727276c49264c744d885ae602ecca00be17df491
SSDEEP 12288:s1XLsswWkxy2lRq2czA+rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:aXYfDtczAHBMvjRA+iqMIjmJ8c+hE
TLSH
T14065013963E409F9ED67823CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 28285830003c27920757b1b6238df343175672e9a537fe08891ac145e7dee7e5
MD5 c91284ab3ece99f2418b148569deb155
SHA1 c3afe47493e59fd0cd87e0a58dfbb9d0115ffbe1
SHA512 0c5ff7cf34c4613c690e4c4e8ea4fa0a73a99a3df782993223b74bb2019297a0ab4cf85b56b4303d12afdb9864ee7006d6d43516e3c2751fdd15286fe3e2ea88
SSDEEP 24576:t0Le5ji0hmxhrMgBMvjRA+iqMIjmJ8c+hE:tPji0Azgv1PiqMymJ/+hE
TLSH
T15F85AE26F5748731D073C0B9C5D2A68AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 631c06821e19110ddfffa6cd687414e29829efcaa4b5aff1b7b58399411ffe33
MD5 b14ea13f458b61d7e3db4bf3850c16b1
SHA1 773b8fa87a5b1e0b94e834d9dff6aec35e0f035a
SHA512 3e47dcf3b2b6f1d26b7bb99b8e0191e5dec8bd329149679cd80cf85ca5ed78c03ce5432147bb87390f434397b35eb4425cfda8c0a9d21635894c7bb245cba56d
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyuyBMvjRA+iqMIjmJ8c+hE:+/ezSC6vUzPv+Hjycv1PiqMymJ/+hE
TLSH
T1A4755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75f5aaa5fd65f3d6ab669617147bd9a8fb39ad401cff2c8c41f5929adbf0faf2
MD5 4dd5f2bb31955033a85f13ff9ade2bb8
SHA1 255b2104dd60b2a029174b206277619253ba8884
SHA512 8680ff7c010da25c5949fed834ad51df45b2d1d9a11e16935cb0d380eb8641f51eeacc5717caa00050204e20c99af7668e7f8c39460fd704effc508200f26c45
SSDEEP 24576:MVbqPb88hv/l+BLBMvjRA+iqMIjmJ8c+hE:MVO88hXl+Av1PiqMymJ/+hE
TLSH
T187559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 be30edc3ed76602a44c621ce6ff4467611b9a849556e8b30a49a82aa1fcae3dc
MD5 536c5ff178d66eebb74e7ed0cfcde91d
SHA1 25711db6332b42580e1f0698349face231516fd9
SHA512 03a007d102ab5f6a5f67fec685497d428b77ee3546f6fa9011cd5d5d25878dd27177eae0ef469b42e1db6484646a77db6eaea4a17ce4901e9d603a987c8969c8
SSDEEP 12288:PGNrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:PGUBMvjRA+iqMIjmJ8c+hE
TLSH
T16845233600A80A85FF733F3C6DEB67A3C245EC7DB551A203B51676DB563C1E0A88A617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 98ba5a145c695285f391a57947a62db8674ebbefd3a816786cd593d5833628f9
MD5 3229de16ef8d188833e6e1e4c7309ed1
SHA1 ba3550bb1b4d1ced51d61969ece48991f10fc68d
SHA512 d8fc2e6664ee919dfafb29496bfafd45bad3fd17f71c3ebaa3328fd96e7dbf76c94ef5e61c0a99988d7105b2cc7a45047031e0a5ee1ca3cf71c3d30cb89e7f97
SSDEEP 12288:KeBNUbTVO86UarGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:KJIUDBMvjRA+iqMIjmJ8c+hE
TLSH
T19965DF3BAE28FCD2C67A5D785A918700D77278304B62A3CBE175834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 62a64950ed1fc1c2f9390098ddca381bcb86554824b5d3c19c48e97db8d6b9b2
MD5 cf9676500b2021eaa2962a7abb5c90e7
SHA1 6d8d1d6530394f35c5c592607c58222b9f1c8c29
SHA512 c0c6a3cf188bffe789a1e4f9c9ae4ed43684ee46559e69e4a6654ba11b6c1fe7d161a812d4cd457eb6ce40f7a828011e8b47ed6b625e031c7496fc5a6e9af778
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:xQvGAdlCEL8c/WRNw5CJtPiqk9+
TLSH
T119266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7712413461d56a3561c2bbe04c2bfa4cebf16003e8bf586c231f785bc7ca9120
MD5 fbf3fb3b913d7fa060a56e09a819f2ca
SHA1 a702cf88d74ddd5caa9e23ab368c069df9dca471
SHA512 5c029b13051f82a60702de47dbe497a855167185cc8b4e8b204c052f0906e2882186e9168fb5aedbb69e93c2182c09a06010c994c5ebd4845a2b8dc85c906a48
SSDEEP 12288:xAwSfxL/2Dc3mDLLmt0LDQewsAjkrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:SfewsAjdBMvjRA+iqMIjmJ8c+hE
TLSH
T13375F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8a5da58badd713a24374ab361cf9b1fc4b1099e8c9bf631040b646b1ac9c5ef
MD5 3f7840dc741a3f307c873407d9308015
SHA1 0bb56b02f0ae61d2880925ae7ba88710b5ddfb99
SHA512 67d6dd54bf4b2c7bf37251490f48c03900c56164ba0bfa6cefd73f397c732f2fef4395b52375dd918195c77740478629a95bda93b8975407b726db2900828035
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH0aT9+:jUEtQevvqc2W1cpV20I320aM
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 813da325a156846c4c8bbad1289afe691ba683b7bbb81bd4d524bd5ef78e62a7
MD5 0904001e0f51c8e757dc751c0444f6c5
SHA1 b28d1cc57d29170da0fd815269f9177912b73df8
SHA512 77ec971b126cf56b3bb7d8bb5218ff100a1b9e85443565f933a23a54681be814b7932332584f01b81180722519a420e6ebe9ad1bc6fa9a67cc2fe6ffb44ccbc5
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zQv1PiqMymJ/+hE:NoqtVjnmVtPiqk9+
TLSH
T103D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 728e817e977928407c3959087926a5b00e991e43e2bb52fa2e6ae99e3e4b2227
MD5 69b92eed744bebd2052a1922c4941b51
SHA1 dc07cd20bd1cc0f606902dd3f8e38067c92a2f00
SHA512 573849da255f606f2a2015b20ae3e2ed1875a59d50007e5e57ad501b3f85c07ed8374dec7b1ec47df6b31f326ad61a93b3fcc521001f57683307ae57c71d4a23
SSDEEP 24576:/AhGL6IFoiwtA5l7S53OBMvjRA+iqMIjmJ8c+hE:/AM5Foiq5lv1PiqMymJ/+hE
TLSH
T17735AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 befff493c0fc2c5b14eafb21a9114fca0430ae7086e166b1e8492a4c963c9d0a
MD5 63d483f34062f5314730b18919ca37da
SHA1 51ea8443ad9904a1162b83c2e7ef098e05421222
SHA512 c619764d9f741c7f33806cef2c3abfba7b972a421c88f69584ed7ea9451d0ae5ed4b3a6965ead4aceee47077e5972f12ed65b4e61355c7c3151509775add3c88
SSDEEP 12288:4mw5HEjsChNEBFgl0WDm+CDrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:1wuROWpBMvjRA+iqMIjmJ8c+hE
TLSH
T16B65F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6240b3076af4bfbd4105dc620da0fc7f3c4b10a69ccdb8065c74ecad7120b8bd
MD5 ea40ddb777074e3fa3a87c7cc2cfcf6a
SHA1 51060074a1ddc584e33b5922ae61bf999a5e39d4
SHA512 cd3bea5c26957601a231386a09a179f633c0231038e1ec1a4190724665cd6afd7cf8aef1439024508e6ded079936aabb63f71f75e09c5de8a7699dd7a2ade6c0
SSDEEP 12288:IyZ1Iy0rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:dZu4BMvjRA+iqMIjmJ8c+hE
TLSH
T1E755122A22E821F5E673173CDDE25742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 62dd845a3ae78473655c676afcb45d4b296d5c6751e9798990f9eb54f8729c57
MD5 f9fd9f86d29fb58c7b9b41d278b223f3
SHA1 b6987dde6c5d8909d9df6f3cb2c1f1ee745ce895
SHA512 c0c08fd756b6ed3c50b29a876d056beb2f5b3d2f7ec09c5078bacb32c4a069580a3c6a58157d3c96c11f011376836f166ed235f7dfe0f167d2aff0ffd931d207
SSDEEP 98304:aQRQyi36YOcPDLvw2gAf+PN36tPiqk9+:RQyiKanX+PNqaT9+
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4cdba9d56ba0d2f12b3d1a6a233448ea628597a269a9c0f01df06b1f36b7c00
MD5 c884296d4bc60fbb573559a227406763
SHA1 0169131ffaac2c8ce6734736071ef34b9bf22a44
SHA512 c74a1f419bad454f030d6b7ebfbc6bda68d1080083a2ac0446ff335bb7f92cbb8132e8ecd57c771709aca7a342cdda76b0e265df57aeec10715c8e10a2744c90
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN36tPiqk9+:DQyiKanX+PNqaT9+
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 004402e914796c9cf7ece031f3580bcf64d5e39e0b6befffd083446ae45c8cd5
MD5 b67a69b372e881a2e69c6f75f260cf79
SHA1 181c20704363f6a6180e535ce83d6c6e582682fe
SHA512 a919e52665015de2874d71042abba835e806fe0de0fb40bc7667c30db0c2f6b8239082855b4ce5f37a7b8b5416436ef9cd56748f98338248a55de70dffc5c68d
SSDEEP 49152:968Qg55nhkeWu7PNU3/gv1PiqMymJ/+hE:7thTRc/gtPiqk9+
TLSH
T180B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3541edac939707f19a31eb78da65797d7de6cc755b94a7ee8de55cec1fbf5f06
MD5 6cdaec2c8db3b2a7372adc64746fe48d
SHA1 87964ed210fe58f2bc3040489ee01836956f630b
SHA512 90ae290ffd280a13199c495872b269261c50934451da65b508d926d1ba8073b229993dbc241308beabb4362de8469be87a0ad4900c324904a4ac26afc6f2b815
SSDEEP 98304:Ry5112gYy5azzVvU69nLKnhZztPiqk9+:sLIHRWhHaT9+
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 de4502430dd471a59c303232ecbb5da73aaf2831d6238f4341b574addec0fc12
MD5 dc040738c9f437391399493b0b1ff2c8
SHA1 db2900ac99761c93a7373251998275f3390bd10b
SHA512 385aacd3494f22fe9d298df72de5ebc7395c253883d645473e9c637ad101e4a9ef000b86057648c4d2e3182c83b82b25f74de0b3b9f0590920c481e47fb1a2bc
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gliv1PiqMymJ/+hE:zu6JmIxd2ditPiqk9+
TLSH
T166D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa43de31bc0327e4c1b7ece760ea5844114d004f2997863959c483ad140c8013
MD5 8532b7cf33e6fe30e1516c4b151431c0
SHA1 35f93835f8fab342fe1357407f8f82782798493f
SHA512 213f98eb11c8a92cbdb6c08e9f9f9fb68a011d568a25e1a91487e9a9de6a4559aebdd51ef4f6af8feef521f64498cd4f7029b9d029d570504f6d450480bd223b
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4x+v1PiqMymJ/+hE:6mifPqRVtPiqk9+
TLSH
T128B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 72ba9b3157540b18011dafe40e69fef361fac9e4de5332257cf520e8e612b69c
MD5 de5d48febe56bba88cc10d2e906b090d
SHA1 994fd32cdd9f656c314aef548b9b14ab52ebe22e
SHA512 1de94129d7ac5cde16492d57033c6594a1ca0589c172defedbdcd8257df21cfb4c9849a60ba17929e4202e00f9b9d20b5a804723e18bc9447814753cfff255cd
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHqXv1PiqMymJ/+hE:+5dKqi61XtPiqk9+
TLSH
T156C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9ccb56afff2b02317535f5518215b00ce14c2498e55c49b81feac43acb54cb98
MD5 0c253d958e6aa9773bc72a19c49f4790
SHA1 23caab013819a4a675cdc79beaedfdfd2577aeea
SHA512 4efe07b36e48f31ea0daa16864ab276d0c3c4ac89e2917f9076fd7376607d7098213136f67e7195760b6f1b31703e09f43dd4d3476bc8c7299206f9130e2af14
SSDEEP 49152:thtSn8EApI0figjgiDn0AP5wyv1PiqMymJ/+hE:8X2iWphhtPiqk9+
TLSH
T1B195BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 097def4fecd67acb9e6184c3f69d2e5ec4d0573b2941c5e213e09c14ed39df9c
MD5 b4bb742c74deb712611f76faa1f65a4b
SHA1 ec88623bc7f3caa730c39cd62c68c4a4780991c3
SHA512 297f37d8bb2d0471bc4f5256dba8f3a797c6e481a5e6c6a2b4f8a1ac89562f49127418591bc939be3b01db4b8baa6b2fcbff0f2262f5c57bb5e0db1322bec03a
SSDEEP 12288:tVrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:tsBMvjRA+iqMIjmJ8c+hE
TLSH
T18645233A00A90F86FF323B3C99D75392C285AC7EF651A203761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f16d5affd530fd088b14160725a8bca73a6d1f9df2f5c771a5ba193efa34c174
MD5 4512ee46c6304d357ed346fa01c23b32
SHA1 c53bbc219c4d67a2d26288f1b6dadb34bf323e24
SHA512 23f84b9879743ab0d6e42c7d4727e3d7d882ae659d40b396d7aad2e17ab78edee35c9f000df20e100561c2ee259f0ac0b7c32a67b0b96c10874cb8cf29149b4f
SSDEEP 12288:WIrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:WxBMvjRA+iqMIjmJ8c+hE
TLSH
T15A45233A00A90F86FF323B3899D75392C244EC7EF652A207761E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 976bc7e3a606438671b92a4c961c8144eb8223260736c15b62cebc70f7b9c4bb
MD5 e24c4b8faa7795e682116ffcaa456d7c
SHA1 6c029fd24f65a4c2328de1dd4a1b7ecd8e5019a5
SHA512 16d434b88fb86444483eebb526860d5ab4e679b32dac104f80620144a87e36032aea728b150c14979263889700bca29d949896fc96db4ca092b9c15fe920ba03
SSDEEP 12288:firGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:f7BMvjRA+iqMIjmJ8c+hE
TLSH
T1E645233A00A90F86FF323B3C99D75392C284EC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e20091c35fcae333b0091bf02c1c947ca4101811fd2977399833292c03f0ffb4
MD5 d6ce57107b7325769dc830476352bc66
SHA1 8d9e57ade50f548be05763a918a3296709ad76de
SHA512 3c2d4068a24d1ac9f1452b1d5ad4e4a10be7ad3863f51844589a509a2aaa1a4126858de2116d10135016a6cb4370e09f955f251b1708f3f5e65ed297f72bf10e
SSDEEP 12288:rVvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:IBMvjRA+iqMIjmJ8c+hE
TLSH
T1FF45233611A906C5FE32AB3CCDA75352D395FC6DF732A30FB605259B0B392E02869B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 706c34228f649c45b08348e6c43903d3e2f1053d34deb6ac52d5bbbe6c48a1bc
MD5 0212c012c3749cdca919138560830e7b
SHA1 4a0164cab7572ba88823a2d8f1fc249282dd821d
SHA512 a913989bae31fe3ffba9d4f7144c62e3bef7212b010dbd543e7053454c0c56a9389623c89b2c7972120d22dc9d03fe2bee224e66697f11bbd8bb498e6e72f9d8
SSDEEP 12288:JHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:J2BMvjRA+iqMIjmJ8c+hE
TLSH
T11445233A00A90F46FF323B3C9DD753A2C244AC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 958aab84d82a954c4f9d39c4b98bbc3abd62652d9dc7b337cb2e789efe8f8b61
MD5 a0b7c0e105f7c2ab2cd8a5f7e02809e9
SHA1 866a10841e67722fd567f776da2c90dd99d7144c
SHA512 ae600c55a7b512145b995efa921f5ad626310a76777f736b7227e9dbb80a93aa807a9552c7ef5cd06e07b7604e70aa8a5aa2b0c2734d69f0b1d4d8aa7b94fd9c
SSDEEP 12288:8srGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:81BMvjRA+iqMIjmJ8c+hE
TLSH
T15345233A00A90F86FF323B3C9DD65392C244EC7EF652A207761A719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fb5204e17ae8cee5e15c51d05d9a920d4975fe315c1f7c5c1f38192e53298673
MD5 e7069b1f6462bc65b3ee2dd3ec440fbf
SHA1 506d609a0593de08cf29f65b2f051aee677634d0
SHA512 8a63c2d62e922923b516b5dc6c993adf241172baa165b8f5b3515e864772435769970f9788d2454dc9f40e242186a8f8e731c9cdaa269670fb4d5ecf324134d6
SSDEEP 12288:ZArGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ZZBMvjRA+iqMIjmJ8c+hE
TLSH
T12D45233A00A90F46FF322B3C9DD657A2C244FC7EF651A203B61E719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 799c28da5e48a93937420ad5d4f9d2de8b2cd2f29f1ea06d2228079f3b64d5d6
MD5 1ba926295d191c5be1cb938343327471
SHA1 1c030dba6c0ffe8ec5504715a29c5cdff8cd3e08
SHA512 88f57583d609100fd180cad98513eb0bb623859098043de938f14f70f8a1ae446130a614710c5aaa207381a709d9169ff243560c2bf19b4eaa6e5ca871552423
SSDEEP 12288:UiZwbDzzFEoS2cPvyorGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:3ZM3zFVSORBMvjRA+iqMIjmJ8c+hE
TLSH
T11B65016573900CF8ED63423ECD568A16D2B2BC6A5770C60F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8f556700ecf251059029e3b46f6f887a9f2d528dc007504dadcc57b2451989de
MD5 61c36727130b0a26737e1b48c8e802e9
SHA1 08680b85306e709f9c9087f283dfbc95e851431b
SHA512 06d27389c14ca7fbfb07d636c4f266665f84fd3a6f9f03084edcd1602ee8118fa5bfc226c0a7b51c3fb9c42edbcadad94c97332c0b48f34d23fc2ab2c8ea70ac
SSDEEP 12288:SRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SIBMvjRA+iqMIjmJ8c+hE
TLSH
T12145233A00A90F86FF322B3C99D75792C244EC7EF652A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ddabb5ddbfd3bdce07000ba25b910c51b583ad8639317a418ed3c6e0d4ca993b
MD5 3cac3779eb7b2cdb0ef05039f7e2d80b
SHA1 6f54a7c6561140f5acdc026a1920c34359bb519e
SHA512 a8cb0ff796bd2601440bbd58fbe2720a1eeb8cb0b72e1918d97fbd0f7dcef391c328426fbf1ec4cb4fbfa3b23231ae02ea92528f53f2b828f9f3bd1b343b7f5e
SSDEEP 12288:SdrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SkBMvjRA+iqMIjmJ8c+hE
TLSH
T1D945233A00A90F86FF322B3C9DD65792C244EC7EF652A203761E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0a486bd953e18d8084674aa8f07ffff118af5f2f1a14abf1cd37d7fddab8e973
MD5 5b8c3f082d75bac4cba88119ab91eb27
SHA1 0ddab7875d9c2662bb5cb6e22384f9360ca2dad0
SHA512 e4cb03ab063a4781d8620738cf1c131c7bbe66898f0be84384d46ea109cecce9469aeb08b77042f709d77fef46b47254a7f5474ca86299c8b8d0d826b006bc01
SSDEEP 12288:QyPz5L80rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:hzytBMvjRA+iqMIjmJ8c+hE
TLSH
T12E55021722A521F9E5335238CCA21B52F372B83657209A5F276457BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 902cc4d4125649b222312980e7ad8a2059ad39a69c2b7bb7019be736a1498a6e
MD5 bd09e1cbec3f6a8df39955a032f4eba2
SHA1 562b094200b13a8bb7be8c0c670300f193f715f6
SHA512 3d5b85e0e7bf573fda04e6c848b410eac91257ee9cd23cb4737e93b208d2658394ccc12d78afcde436e6ca4c6f23dd0601d7bb5d6a900153266f56ac64ededd9
SSDEEP 12288:sRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:sIBMvjRA+iqMIjmJ8c+hE
TLSH
T15745233A00A90F86FF322B3C9DD75792C244EC7EF652A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aeeb113623ca28b6ff2246bdfec16b5bc698bc3d99fe25aff64436e163ae2165
MD5 0ce8fefa3c7f4dd96360721fbb296cb4
SHA1 404af1cc71b6f45c4470f18c4289d75527072197
SHA512 a80a0f33aea7588172a037b4168d89187028ff103b481e952a381bb3a68c3920e1f5b69f3553638281298f9d14d568afe05f60150d621b05824dde457bbb1d8a
SSDEEP 12288:jRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:jIBMvjRA+iqMIjmJ8c+hE
TLSH
T15545233A00A90F86FF322B3C99D75792C244EC7EF652A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 062f14cb74911e98b946579102e6030da7641b91570b9cb246a4ce8f5bf866a3
MD5 35175d020db89183d72573a3a7b853a2
SHA1 ab8da7280a57fdb2a541a1ed38a7e1a6505fe30f
SHA512 46c7492cc3c47295894edfffc8c74da9984d78dd94419c075750b683331e0a7b400462fa0c8d1e074d0df87f1d64d65d1538170d0df953e9b57957f75c45dce0
SSDEEP 12288:iyPz5L80rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/zytBMvjRA+iqMIjmJ8c+hE
TLSH
T11A55021722A521F9E5335238CCA21B52F372B83657209A5F276457BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ac4c58fb0f90cf01169dfc795010ba7580088bc2a5a231c7051b2989906a2d9d
MD5 214cd707deefedd76386a5d41ad4ebaa
SHA1 8e893e3d0cccd80cf7ab862c9da6badabbe7f364
SHA512 14dc403fc7f1a01323df250643ae1d2964227eff7a8e0defbadc1303fc776a95b6c8020011a4f9e075c1a07f89ae434a5f735f541961fe4b56849d534647d161
SSDEEP 12288:9Cd91WYoaLHF3z0z04PDvhSrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:oT8aLl3z0zDrBMvjRA+iqMIjmJ8c+hE
TLSH
T1DA65026573900CF8ED63423ECD568A16D2B2BC6A1770C61F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bf9032d9d7157d9c85763a6cc8c25626c9d63904ba5937da0dc829e1ef0e4168
MD5 07ef9325a5159c0bf5f14ff6ef447981
SHA1 0964200fc73b626f6f91b6c7cf0f6d53de575e6f
SHA512 7f35e78b98466a7a98211897924522256ff6d35d9a3b485be3f021bffbac639bd788ef65ede5cfbfe7f3f6c77d5941282630a4ba8f6aa337b923d39f802b5114
SSDEEP 24576:z3rd9CHKy7GZfBMvjRA+iqMIjmJ8c+hE:Trd9CHKyaIv1PiqMymJ/+hE
TLSH
T1AD75DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 89fee8e508be6110a63d4d915845583bb9bc6be327469aa834f610ce1e7f7e7e
MD5 5c43a3054bb03d390e46bc0c1371725f
SHA1 eab51f0e96f27d38f6cfc92f4c12d20c89869d2a
SHA512 c3b3a000c324dda081367c520f052944fe1eb62bc378148ae5734fc8da23f5d9ea458dfeb7db9effab285110f554934f7f41a12086b0f91f5df9a0eca7bc7475
SSDEEP 12288:KCrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:KbBMvjRA+iqMIjmJ8c+hE
TLSH
T14945233A00AD0F86FF323B3C99D75392C245AC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a8c11113231095735fbff0c188fed2a4da76555895886f361c4696e194066923
MD5 b84b56c6252dba937c85251ac24bc9f5
SHA1 cb3717b79e5ae0722c6067346361d367a8909f6f
SHA512 ebc9157a606091392a29ea908e72bcec91e3ae47ca807d1b1bc76b70d2daa6fc1dbbccb9f9fa24dbef48f409da849d983eb426cd4137cfcb32fefa50f510400e
SSDEEP 12288:QUrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:QNBMvjRA+iqMIjmJ8c+hE
TLSH
T17545233A00A90F96FF323B3C9DD75792C244FC7EF662A203761A719B573D1E42849A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4ebf60cf608f7a69a623f64a7f8a936ffce425095e8789274d0fb988253a3da3
MD5 a5a8c88efa941e347f3f74dbf9a0d707
SHA1 234e5844e73631ca0e6b5c715ba5dbaec967c9bd
SHA512 9db36659cdaac330e44a4125411ea5279115dc8e336e97b2e73f65bf8f23fc8a0f96b29e320b456f8c5a06b56a3116631bdd91b4e74f39c5ea044d1d490638ca
SSDEEP 12288:rbrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:r6BMvjRA+iqMIjmJ8c+hE
TLSH
T15645233A00A90F46FF322B3C99D75792C244FC7EF652A203B61E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ec0d61a1245ef7006b7e348a7e8dbf59a7224d89f494556c71afa6d318815910
MD5 801492779fb2b7f64c3edf7805a662f2
SHA1 ed966e26aff691b1931efa6f530d82620e347fde
SHA512 6a12818fcbade3f238da2bf6007eb87320eb8fa78341c5923a55c27c4e8920da210b26ef0bebb3e470b79e0d5b2c5a3ba182c27c955918b41c2899668f696cd6
SSDEEP 12288:BRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:BIBMvjRA+iqMIjmJ8c+hE
TLSH
T19645233A00A90F86FF322B3C99D75792C244FC7EF652A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f113eaa4c45d77354fe9d734ef3d7489c9ae097b7fcf105b6b3f76a111a1a2ce
MD5 3257263d737130c97a908f6ce38b9cad
SHA1 2dcbb6571c797095f83c5af1dd91fc74cc5b9fd0
SHA512 d6a438d5b42439f90cb5588485e11ec63b43438a3e14837e46664189c79efd92559886197af6a9cc9620c7669fd87db9f08bba2d35b95908d59e78babbf510f9
SSDEEP 12288:4CrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:4bBMvjRA+iqMIjmJ8c+hE
TLSH
T1EA45233A00A90F86FF323B3C9DD75392C244AC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f3c1239cc1909f89438431dec1bcf6ba1301286e51a4ec56ddb535398d34ae6d
MD5 5c26f4409e7068d567bcac73c73ad14c
SHA1 c456c353a9da510dd19ae3a9582e9d31eb5a770e
SHA512 b160b51c21356bd2b0395dd76c469801b7960a334491d0337bac1c37df99c942109b9d606020d216387f8b2fcd4b1ce403791a85d7622e8fc32c0fe9080fba0b
SSDEEP 12288:FprGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:FQBMvjRA+iqMIjmJ8c+hE
TLSH
T16B45233A00A90F86FF322B3C9DD757A2C244EC7EF652A203761A719B573D1E5284DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7fa459feba5645530d09652bfc3f43d465c1391dada8b8af520a348395ced9e5
MD5 4b3b39e21008f6e762d0880705e991c8
SHA1 934a4c4befc641feef1a29bbe077e01ed928ec92
SHA512 a1f5107c85c34b952ba566a8d09c2f7ccc0d9938a47fb6988df5aeedd06c19c4fac2cda03f52d3468c7340fa3bdb49f36d9ca4b353e89502a912100a307f3794
SSDEEP 12288:sHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:s2BMvjRA+iqMIjmJ8c+hE
TLSH
T10945233A00A90F86FF323B3C9DD753A2C245AC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 eb6bfa06b4d812a03bd1879d21fbf73d12a5b0438c55f2877792a9c2b967b37e
MD5 bb463a06f00351e055b3848c8c52ddcc
SHA1 d7ab61167458566230073108ede168dfaf09fc2e
SHA512 34c248c7dce0e592197f9295e3b8219f14d71c45b5e198a553bc7e8472abf3b79d3a0a329e136aa8c58425b59a55646dfec112264511b0edb880e48130fe301a
SSDEEP 12288:+qrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:+TBMvjRA+iqMIjmJ8c+hE
TLSH
T14445233A00A90F85FF323B3C9DD757A2C248EC7EF652A203761A719B573D1E5284DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 c8cb327f9bd63308ddcde9a8ae708acbc3f1d5c13b31f7271a5cc597c0a036eb
MD5 05d6b388887ec62a8990c08686d731dd
SHA1 0b3621d4a300d7064481316bdc5d315eb239b87c
SHA512 b5e37ac0bfb3867964e085406df99d0d5fc13240d4313217e57334635ee90968c50f33324f894e4cc13ace43a1c5b7d108e6fe25cd8e75f1682f112fd37efa36
SSDEEP 12288:LHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:L2BMvjRA+iqMIjmJ8c+hE
TLSH
T14545233A00A90F46FF323B3C9DD753A2C284AC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 40639b359c6b2034f74efcfbea09e614218dfc332770039b7a40c1b7b561b0a8
MD5 2817085caea89315362e8f5c59f66c62
SHA1 9446c7e11cba41c8a59a6aa6ab6fb15669552136
SHA512 32196618e8dab977b0bef9f4ec1aa3e469b60a535d471ed6d6024b0ed9fd51d7d352c3b434f76e9091994a1328d664816f4de9078416a4ce33994b58d722d5a3
SSDEEP 24576:Gfwvzk9RX6wkyAI0BMvjRA+iqMIjmJ8c+hE:VMnYITv1PiqMymJ/+hE
TLSH
T1FE85CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2915cd2a949065104ebad580b2806d0d84d532a98221a1f0bfd2d36bef2b6cb0
MD5 51752d4e1559a145d3f9e82d3f57700e
SHA1 2f5e78ceab1b0ac88e3e93e64a4543ceab4ae448
SHA512 7eb1d795ce73c3397187f538a3f5e051c2cf0d4418566b765c95f6cc324053d3373ad6030ab91c174326ecaf961eae158fe166c5c22801c9994a682696b203db
SSDEEP 49152:wYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Sv1PiqMymJ/+q:PySzPatPiqk9+
TLSH
T1DE066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b9cbe9caf59a4b006354cf7316ceff20c68b05f5e4b3055c0fb49b773c954639
MD5 6bdc6dddcdb4dc08aacfbfe621ba5262
SHA1 6719e18b159120ce99132a12d17f00cc4369d2d2
SHA512 fa908af2be5934b5c21c3b9862b084db94c24967056c843556b01338f491a239343e07f91e92d462a34a9d7069c9bc99232fc3044ad4cd86a9dff9dc811a0459
SSDEEP 24576:z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYhBMvjRA+iqMIjmJ8c+hE:z47JUQjqirIhCnDHUPfF/iv1PiqMymJJ
TLSH
T14A65AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2835272aaa6a932790d928e6f54c4b90fe9c1defa0f587276f8aeee3ee7ed08f
MD5 3cd1a94648ca66ffd4cbde1edbe11df2
SHA1 b4189a6f106f91667ef08ad850cffa0668615a91
SHA512 9e0fec6fb2ca4f144faf3a8f2a601364c9f3598bc7cc73e9ab4269a6e1cbef87c2e867af8fa7f02ea6f1a8ef1f5f71b459a0308c19d05ec4de01fab48aef6da6
SSDEEP 12288:opsfBrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:J4BMvjRA+iqMIjmJ8c+hE
TLSH
T1EB55F11AC29802D8D56E6239CB964641F3237C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0eff29daf3d4950ca954a3f3ad086a6a1ac3ab8643f80b185022d441708efc6c
MD5 1d35c9675946cacf0d394ba1367b3fb4
SHA1 2fcf0128acfb8c41bf2ba6811a7b447edb7f2425
SHA512 a7356d201c7133bfd085a7fb641caa687840aa898661c26058b954e6635223996c9bfe4988e279c70adccdfeb5a0be48e3d36ceba1a1fc3a9745829e7fa73b73
SSDEEP 12288:PyTp+dU3fnQ0EahNYA2Omu6Fag5jraNJ9XfkMz:PytKUPC22A2Omu6FXjraNPvk
TLSH
T19C352900766AD75FC6AD40325E32C2CCA7707D41EE05AB0772C8872FD57666DBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 936a76489d8dd6647d7bd2bf211fb129b566a65e5812d0478c291e24fbdbf026
MD5 339d27bdf1d642c3f8004193f0fb0706
SHA1 f6dc0d1fd06add3cda30d29bfe26187240055d66
SHA512 c4bb1234f0d765c2ea3d9624a85a8cf45733de24b4956ab1a239e0eda440a89b07ca574cdef97acba38679cd72df94e06e47eb6dda428027e6d198a232ec088d
SSDEEP 6144:Dh9DxP7lcUHws9xOzvvEpEEcezQ3r5iARQvpIe1NeYJK5QnD26tMx4AZ6UR/YA4d:Dhn7Gj1qNeYJABS/x57aEZGyT
TLSH
T10B65D7816537A3CFD1FB6032073A5B4CA764AC06B7056F26A3C8457ED82A725B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 d3107ff8bc504df02a9d8d2021cfc6376b171786ac631f13ccf6670dbc703840
MD5 c0f1af182478e0b53539e56b5b7c5834
SHA1 d72dd0449dfd1d12ab9fcef09e2c2de2cd5edfbd
SHA512 1f2827d274f9e52f38fd1500f8c51aecb272898a0b29c8f876f1eb122f91f59ae18e83e830d4a25508b80075b73c12d350f3d7aee59ec2c04d0ea3766b4aadbd
SSDEEP 3072:DguRCDBLFX9HmT8PWAXRODmkntzSSoCclHs1bpcoM6LM58w3l:HuoM6LXs
TLSH
T1CEF333CA851EC9FB30239AD7C3795C655593365A839E491C23CF82EA7641D03CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f6830cf0bef133a902a5ba380ff79b3125e91dc73043c0c0238502c0b37f4030
MD5 b9d8991148e3f0f77837bb8088b126fe
SHA1 c8eba88cae240ba163555ec6bc8239881c7628f3
SHA512 f7a0f271957609dfcd134a304ccc2a993bc7878a444c53cec08d983a56ddb048c676f7ce5cd46ba751da8191cd47b7d5f2001649940c28a0a576dc9bc00c071e
SSDEEP 12288:kM7ZrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:FABMvjRA+iqMIjmJ8c+hE
TLSH
T1AA45233601AC0E46FE723B38599B9332D249FD7DBB10E183B50A72DB56395D06C69B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7c11407d6319dd2d9486f22c39f22ef4c3cc52be104fc272a47c8c14555634fe
MD5 56dca1da5c4e8f505f1f18db99cfbf39
SHA1 862ee428175faf7dcfade1e4eb71377d2f1611ae
SHA512 b9340df590065575704add56da05afaef9ef3b961ac70dbb38bd28e423edc01bc12788b6e992f39f4af67a547997a2ee7caf16c1fe36d5c9fee42ad0abd12984
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYyBMvjRA+iqMIjmJ8c+hE:Ugb4mBIBhGFkv1PiqMymJ/+hE
TLSH
T10E65AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b1c8b3d735340b491756e1d853bff49c1a37e49155e078ba81efce778b71402a
MD5 deda7cf9a4829ef63dffd2624e0f72ea
SHA1 515981885d6196cfaee808d80ea90ebd27062bc0
SHA512 b20bcc05d8b198841ec6570aea6ef397db1fe4eed54b64ce534b88c728bb3852aeaff7014a442a9aca8d1ae56b223ee161d762bf60310cf52455dd282af101e5
SSDEEP 24576:EG88u8FpJqH1vzria7/mRBMvjRA+iqMIjmJ8c+hE:37ZFPqVya7/Rv1PiqMymJ/+hE
TLSH
T1A885F12566E102F1D477D13889864763F6B2B8251360EBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 890ee1935d230f2649a0b87c118001809dae24d0e17135f84ebd1a4522abbb9b
MD5 e1622baf851568b9f51f392f73a8b46a
SHA1 ad030b4cb5cf892fc1a3f5afee2d671fd33b634a
SHA512 b2c7990698baf116c982f18ee64cdb985f957390071801ff81e701daa3bae5de5dc395f84c21140cf8e6ed4a20b1a1dccdc43b06c6faf7ed94e3e2133c01712b
SSDEEP 12288:yHvUrBFrEjwaQ8rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:yPUr+NQFBMvjRA+iqMIjmJ8c+hE
TLSH
T14C65E12F21AC1CE5E676A17C89868719E771B8661712D2CF0291817F4F37AE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a15d01155ca66031a18d3aa41ccf87036983af784e6dba2f2261ec55a83fc4c9
MD5 f0afbe292fe957c3a23c93ff0520ff88
SHA1 95d392548b62c5a0c3f7abd65e7d57235bc356fa
SHA512 e31b4288efe94d5742baa5c3a6a9d1a2b3a32c8039133aa6f53cb538aa8fd3a64f6e92f9ba3dbad3982103a3009e2192557431b0b37ed0d14e988ba80f662cc8
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4v1PiqMymJ/+hE:yG05lO43bLtPiqk9+
TLSH
T1E8D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6241e8e5b565e287ff3a1154f31f09c7a598615c059c0dbaf31db71a5b90b40b
MD5 284989d76dd237caf88bd5365cd85f2c
SHA1 1d0cdfc977e7281ff90aef236715fe8d67071e06
SHA512 91755b3a454a016c17a127c99e93cc453989848136072333cc4f7f99ff613e95dd6ce983eaf21d72603f4906e28556f72306195014650d72a8fee3b7755533d8
SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnnBMvjRA+iqMIjmJ8c+hE:Ma5POZ3lJt2pasx2+mgv1PiqMymJ/+hE
TLSH
T13B65BF5EA2FC01D5E575D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 080e695ce6184e12eec6eab6b65e98a3014271f7c83373d77e68b7477c8afaa9
MD5 5bd97fa6c04af4625a603db8cca95305
SHA1 a8fcadd59a380462d583c845efb9f46c357b05cf
SHA512 6847f289fd9108ce2ab1c13bcd522e92f490142bd5746e966c18e4735ea878d13aa414666327cbeaf2b0cd21ea97d91766203722f4ff53a36a444465db5ca8c7
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkJBMvjRA+iqMIjmJ8c+hE:fNc/zEOVHFxv1PiqMymJ/+hE
TLSH
T1F8858C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb2a5ef0225ab6406173c10ab8dac66e3889e5263f85ec60a61c17586f1eeb7c
MD5 655cfde4f57c053783409a37ad0aa366
SHA1 9b52b3187188b6861baa4cc88fa9f31f4841afe1
SHA512 062d0ee168b270be63c47bcae8de579d91bd9eb0667c3558d25f5cd8ea534d1194206765404b94262d0429db2dc3311f342ba8b5fb7db1ce2eeb1a9a4fb0fb6a
SSDEEP 24576:mzkNvNnaFeYhJNtmZBmTBMvjRA+iqMIjmJ8c+hE:mzMwBtOmuv1PiqMymJ/+hE
TLSH
T19955AF2EB6F806E4E1FAC6B5CD238512E6727461173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fe396e72f395218b962f39b4b8b51563515f8088b55c47193df8e12d527a6d81
MD5 00b0ef550627470b90380da2015ba6b0
SHA1 4be71dd326a1a4897c507db0dd935502adee8a7b
SHA512 14cb16b5f052d46da3dfcd89e5b21fc03dd6c04c79674e3cd664bd11dfcc06d96bd004ddd1f07210e828878e52bccb158a2c1d0ac891b9919b935ae27498aceb
SSDEEP 24576:5D3FHshBIYQgAMBMvjRA+iqMIjmJ8c+hE:5DVHeBIAAbv1PiqMymJ/+hE
TLSH
T12975E13DE69C04E4E577D17CDA638606E77138AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-61-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/52-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/52-65-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/52-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/52-55-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/804-384-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/804-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/804-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/804-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/976-69-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/976-70-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/976-76-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/976-252-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1268-288-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1268-80-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1268-82-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1268-88-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1796-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1796-361-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1796-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1796-122-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1796-116-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3724-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3724-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3724-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3724-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4032-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4032-27-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4032-28-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4032-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4032-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-129-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4484-135-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4484-383-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4484-137-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4680-102-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4680-1-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/4680-7-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/4680-6-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/4680-297-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4976-351-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4976-92-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4976-93-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/4976-98-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/5704-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5704-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5704-396-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5704-397-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5704-104-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5704-110-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6084-142-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6084-153-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6084-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-148-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download