4036d4ce1c4ba6446697fa5e093fd60d75868214fad5ee2c0249d34fb571b656

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Size 1.7MB
Sample260804-mlafmshe99
SHA256 4036d4ce1c4ba6446697fa5e093fd60d75868214fad5ee2c0249d34fb571b656
MD5 9e95645710153256a3a53bd7c428396b
SHA1 36b4c4659380e0b119db7b758a27d7d3fc7c799c
SHA512 f1c92d0cb99a4a435311e52bb2afb865b80cc4d38abdade10b5091a1953497c021a1fecee0d5b8f97f01ef287bec92876a541ba900e2ec1c88facff60afc91e1
SSDEEP 49152:wNZCWOLT4P3GRsmRK2MtENepq8pvaM0r+:GwnLTwGRwhg8Qi
TLSH
T130855A0663F95129F1F37B71EEB992645A77BC71AD3AC50E6280125E0CB4E90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
6120	alg.exe
4208	GameInputSvc.exe
1308	GameInputSvc.exe
1896	elevation_service.exe
4104	elevation_service.exe
1536	maintenanceservice.exe
2528	msdtc.exe
5844	OSE.EXE
6968	PerceptionSimulationService.exe
6648	perfhost.exe
7004	ReFsDedupSvc.exe
1468	locator.exe
3408	SensorDataService.exe
3928	snmptrap.exe
4116	ssh-agent.exe
2428	TieringEngineService.exe
868	AgentService.exe
2732	vds.exe
3580	vssvc.exe
1448	wbengine.exe
2908	WmiApSrv.exe
6024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e8e1b713957eebe4.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f572f2b5fc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007af407b6fc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3b474f4fc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd96e4b6fc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1308	GameInputSvc.exe
1308	GameInputSvc.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Token: SeTcbPrivilege	4208	GameInputSvc.exe
Token: SeBackupPrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7004	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7004	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	TieringEngineService.exe
Token: SeManageVolumePrivilege	2428	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	868	AgentService.exe
Token: SeBackupPrivilege	3580	vssvc.exe
Token: SeRestorePrivilege	3580	vssvc.exe
Token: SeAuditPrivilege	3580	vssvc.exe
Token: SeBackupPrivilege	1448	wbengine.exe
Token: SeRestorePrivilege	1448	wbengine.exe
Token: SeSecurityPrivilege	1448	wbengine.exe
Token: 33	6024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6024	SearchIndexer.exe
Token: SeDebugPrivilege	1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1308	4208	GameInputSvc.exe	92
PID 6024 wrote to memory of 3252	6024	SearchIndexer.exe	114
PID 6024 wrote to memory of 5828	6024	SearchIndexer.exe	115
PID 6024 wrote to memory of 2552	6024	SearchIndexer.exe	117
PID 6024 wrote to memory of 6436	6024	SearchIndexer.exe	118
PID 6024 wrote to memory of 5712	6024	SearchIndexer.exe	119
PID 6024 wrote to memory of 6676	6024	SearchIndexer.exe	120
PID 6024 wrote to memory of 6812	6024	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e95645710153256a3a53bd7c428396b_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6120

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5844

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:7004

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3040 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3012 2980 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3012 2980 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3040 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1d40c8f08da75f233cdc4913615464f5fa2cb90a7e792da2d3f2c8ec051f873e
MD5 273881d3c29aaec1508968d3f6e3ac14
SHA1 52d94845531adb878b1c4a792c46a09084b77cdd
SHA512 2f736cd5392d9af0c02aa996b37144033e81bc21ddaeaa3f9d9dcf582b0a2ada634029afff5ff92f10ac4920c02f7a081d0dff6a9578afc5d0ab8e9d60f0d3d9
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkpq8pvaM0r+:Y3q6gjBzg8Qi
TLSH
T14BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 c3999c1f581e5c40350b3e2d23568a107588446b8140e5ff11d3096afb3244b0
MD5 c75c97b6a4fc057b813a8c8f87cd2ec1
SHA1 faf71666c5d2e6f517eaad28cb0783977df9f0ba
SHA512 6b4aaa888ed7665d86f7848b6ceeb67737e376aedec273be17c96c6c6391b044d10363a77f8b554ad47ec834dcf2e07b101ce72a1b9a425cc25d2c260fe9e5e6
SSDEEP 24576:GXYaEtczADDZ4qSywz0Tp5IgaMV7iYc+:ltcmpq8pvaM0r+
TLSH
T16B05F12863A508F9ED6B817CCCB2C516E63378554760E79B03A499394F237D81D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 eab97572a868586c48308d8896a246a6824e580a3733b83902a05a574ce9bff5
MD5 c209a8a5a439699f4f830fae4dc01d8c
SHA1 71363b6e6134cc8369e1fd3ecc3ddd841e9070d2
SHA512 aa116b1c9498c4047aa74177b355bf3f8b5e24cfb9626702345d3aa3372ea8bb001eb86f6b1038fd23e7f29dc6b48e774b350d40a51953760f0a30023c9e6bbe
SSDEEP 24576:H0Nehha0ftxOrMeDZ4qSywz0Tp5IgaMV7iYc+:Hxha01o/pq8pvaM0r+
TLSH
T13835AE56F6788335D073C0B9C5D2A69EED7230821B308ACB4286D77C6E67BE68536731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0609b5240ab0eeba745586a8e4b8230e51dddfcf2c8113d2aa3cb8518604310a
MD5 f35e8e0f97df59ff2b657e72919b0b6c
SHA1 ad923259e45fd9a9c6fd004fba401451499d0be0
SHA512 aa380d902134d20a9ccc27e03fc90595074672c5add4612951dfddd612bf9ed5435253bf417d1d9927774cad418cfd53b6a92c5115992dbb03f8c344afd67099
SSDEEP 24576:YhG/ezSC6vUyD/aqgrvW/6q8wyuzDZ4qSywz0Tp5IgaMV7iYc+:R/ezSC6vUzPvuHjy0pq8pvaM0r+
TLSH
T187756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 653eaded58c5c960bbd23be16e1a53e2f1e85ece8ebc389d9210c0a85bb58818
MD5 3d21b78899fadd5554e2af5748097487
SHA1 64fdac038686434c2d454716ea8d0bf9701c4b23
SHA512 445a4853b8ff377e7a21207cda5de4017fa6845cac5ade7eed6d91330228ded14087c7d74a133683ceb1803b84567f921a93bb6f55f8d9ecc02bf84af752845d
SSDEEP 24576:Cab+PHxQCv/l+deDZ4qSywz0Tp5IgaMV7iYc+:CaSxQCXl+wpq8pvaM0r+
TLSH
T1F4559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 8303291fc627987cda366d553e3ba85b94e46692ec7acfff6b2ead2e1cdba609
MD5 a6701d1ffb4d6619816ff321b8a3dfc5
SHA1 082f27477a6747cf1c1c3ba6ace2098e4cd2c282
SHA512 10f3252b245c6f98dd2cc382967b280c7367dd81b482d5b05e102f4c003cc1a69fc0b2ce6194dd76b521e9cf1175defa244cced3ee2e761ec0ac947d91b2b081
SSDEEP 12288:QpidUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:QpvDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1DED42389823C14B6F69DCDBC58BEEB1EF4371EA21472C5BAC768B53D8C6965020503A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 c8b4ef67c5b495c2111f866888ff832cc4fbb96db5492816116c33571adec673
MD5 af493b5c8c18d77cbf0790f6511f9640
SHA1 9951d16999363e9c730768b99431655bc7be8c79
SHA512 40eb46cecf2c109a326915451347823d2a3284cee37760ca3473464e7ba7415d8c6d377d223143ec767859537d70ea04e1b63f8a6ffdbe627b5d767028a7e37a
SSDEEP 12288:7eBNUbTVO86UkdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:7JIUlDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1D115CF6BEE38FCE2C27E8DB95A918700E77278714B6293CBD265820ECE135E01D75D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 3.6MB
SHA256 9a3bba2ee944fdfe8ee1c97afdfe2803bd6247b202e598283cef7a347538b1a1
MD5 46d7c37ef86bdb5f8da7bf58a69fdde7
SHA1 bb3da3d03d100cbfef911a6c51180cb5080c3c09
SHA512 68fc58b979b83d76937ffbdbbfdc7ae3046e7b17a502069353eec133b1f1254ff108fec864f8b0f7a65deec799b706364f3b021fffd85cf7d539e4110d4af156
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J7NRV3THm:XQvGAdlCEL8c/yRN35Cz
TLSH
T190064A556BF880F5E1BBE178897AC972F7B278421D30A75F0291C62F2F33A505D29722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 39033017a7780610168686d90c09de959505ee268fb670105fabc4ef94809bf8
MD5 eb5d1f8bd340dfcef49c8c48baa27e0c
SHA1 3ec4085c265fa4123ace3e19e5279d2cd95135d1
SHA512 f6e1f17a7aa8e89d16475b09f93ea1e6e2c55b35667f8e6c2c71191e516b2a2197f32f3b22ea765ee9300a77718c6bdc2bd0b4bff668ec6da360ba67831aec8b
SSDEEP 12288:VZwSfxL/2Dc3bDLLmt0LDQewsAjZ8dUWIDZ69/iSywdB0T0ne63U5Igag3eUDQec:XmewsAjZdDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1DB15E031FA74D436C2BF0DB61B36C71A643D7A204B621AC3E3A89E9D49742D12376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 2.7MB
SHA256 17705cd64d8eaf91b69b70a5fd454949db59b52e78f31533cdf4265e8c346cfc
MD5 ff53d7fe0e4a0c4c82fc638e4aa147a0
SHA1 69c8c927d0f601774a3b2d9bfd91cb365bea0b1b
SHA512 a0b5d53bcfca499bd38fbd9cba3eec0361621cf401b0e65114f639875c7f7d04054bc9beabf2136acdc36ebf491c93fa0edda87f17a3f2ab3687ff887f15f16c
SSDEEP 49152:yYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ8E:pVJ3MXER
TLSH
T15CD56C965BA801FAC57BE088C79B8577FBF0780505346B9B87B1C75B2F3BA60592E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 1.6MB
SHA256 45cc7685f0bf1ecb27328e407a9a4755a95a31ff73c330c9073ad191885ffa86
MD5 fdffe55d18eb95a38cb208f65a2a23d8
SHA1 6ca675713b9cef86325720f00f653d5634deb8c5
SHA512 e7ead2e1479c46143ecd751096505ba57666afa5e81b9ec341088dd0fd89542b982625a08358ff98089ecb45ce94e46eb85e96340021ae72f69c74df90b11fd3
SSDEEP 12288:wfpNgskg2gMjoKU6aUANzA/vu2L95o5YgDa4ACTXfKqfS9LGzW+0yTljETMo1lQS:mNbRquA/m2z+L5WqJGrHCYRFiV+X
TLSH
T14D754B5A76BC42D8D1F6C7B89796C503F37238190334ABEF4261854B1E33EE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77a104eb0d473b233d522deacf69a2c7e9dd3cf8969db2ab06e0670788d56492
MD5 c3566c035e45dc65167103d0455839c7
SHA1 76c1695ebd5237446be5fead7c3e7c39f0537325
SHA512 375ac43ee2383fe73a6e174d23e7cb08767fc5ee26342ee65142b04436db9c97afbc7c96cbd964ea49aa58463bbaa95e3d86076d968c71e4be08f181e54bb8d1
SSDEEP 24576:BAhGLv2FoiwtA5l7S53eCDZ4qSywz0Tp5IgaMV7iYc+:BAMaFoiq53pq8pvaM0r+
TLSH
T135459D81E7F905D4F5B3AAB899B69571EA76BCA65E31C20F1260D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 ca840821eb5e956a2739e4c24d2dbb1ce592227c9cccb60e51635482c5ade153
MD5 0b3909d8fdcf52879be4ef728cc31768
SHA1 2f8f56f889a1d9817f28660fe75b656f65e530ab
SHA512 9b1027283a186e8869a1a3a387b341b586a3f662df58faff077d8221b440abb8f978182b3b3cad380fb075c78df5086b493640ee15601d2d9369bb7566b3f47f
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CWdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTdg:Owu+OWADZ4qSywz0Tp5IgaMV7iYc+
TLSH
T14E05F14A73A80CF9E9A78638859BC536F7B3BC122A31D71F4760C61B5F273606D29760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 151538de39193316256cc8aeb34a1286982b261ca2202203445ea67f448b81da
MD5 18a380ab3f820d321df5a4b524292da8
SHA1 5bd44fbff6015580ca9154622f6f689e46ddf61d
SHA512 baf220350f60dacd1767a3454ddf36e20d5214f173487af2d123d17cb8e83e35ba7ba7efa75af74016e883324cb2e6db2cc3b202ef8a076f6df3e3f546fd4597
SSDEEP 12288:i9h1IQTTdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:UhuvDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1D2E4128923B820F9E197867C88F99B0AE77378622772C3DF476452694E63AD01C35373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 2.2MB
SHA256 4bcc2421ecc30ccbb124489db0e06df5f2526c3e4074ce4fb45c9b3a070668ef
MD5 cf7eaf79474b525e728a96478bbb85fa
SHA1 bd690486c785fc3808189da69e2d8a759e49759f
SHA512 9fcc14088d1b0bcd9d6f798576c2df4ce4f9f13d40342089d50d3d8d2280a02fe3d9cd34fb62332bfbeebaa38ad253a85af389f460eadf313a044f2093bfdbae
SSDEEP 24576:fj8eZAA4v7Je3GHt3pB6jLp3DwQf5SUYLS9hG1kDYkJpggu2aG:fj8dh0WHt5BUp3DJf5SUYLoDpgLjG
TLSH
T162B529E7E36111B9980FCCA45B2D64629429748F4735A3EF09ED4A720672ECD6B3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 2.1MB
SHA256 ee58d5d15cd5f4f207ae3eae89cbba3ab07389270331c6885a72942eebb93593
MD5 9f7863fb8ac3931eb326026d07cdbcf0
SHA1 491b3dd3be5c9122151cd10465febdb0ee04d190
SHA512 eda903ffbc84428f602987d9a485e6e5d1aee60c8d1ce8ef716115303e4d633ae562f6f70df96ba31fe16a4cf4a3979f3acf384fc5b4c695d202616d8fd0d710
SSDEEP 24576:fj8eZAA4v7Je3GHt3pB6jLp3DwQf5SUYLS9hG1kDYkJpggu/:fj8dh0WHt5BUp3DJf5SUYLoDpgL/
TLSH
T188A519E7E36111B9980FCCA45B2D64629429748F4734A3EF09ED4A760672ECD6B3CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f55acb197a1c6648de561d721092c836d2d800989fa6b1adab59e944f6a8d3b5
MD5 248117b101089f922b9c86fc6d033b80
SHA1 a85050decf4b7ef9121e49590241401ad26927ed
SHA512 32a23230fc41e8563bf5aa560c3a27d2ec074993c7ca680cfd79b81a32395e1c12b69ce2f3c23e3d05f9bdc4755ef6e7634b0cfab1adcc9cfea070f8f7b6526d
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0ODZ4qSywz0Tp5Is:s68Qg55nhMeWu7PNU3/Xpq8pvaM0r+
TLSH
T1B8B55A33B2F600A9C44DD1769F4A872196E27C718FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 2.6MB
SHA256 67a54061ece868a21608eb9c8d8d991d17f28f8124c74205f5b5989bd45421da
MD5 8c46e9b13f1e9be4939becdb1bfab02e
SHA1 bb0e668bb13af0147dffb8b5c104365c9fd529f0
SHA512 85818421f08eee1d0b4b45e2666a2304e80610bd13f09e65b7c27dcc2e7963e6611e521f0ddd4945325504796663a99c1b3927621fe7fd877195aaec9d9cb9a1
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nhb:Cy5112gYy5azzVv569nLKnhb
TLSH
T132C57B13F2D911E8E05DD1B98B8A9233F9B2B8454B35B6DF0A5047622B7BEE4673D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4dce5f7709da859d972e44445771777b0c3998073888d8efb5d83287539918b9
MD5 cdf29bbdc021c3af3c3e57518b5d2945
SHA1 0dce8901bb2209cb5324f6c4423c030b14e68034
SHA512 8b0e3caa61a3cebff173c9a73abdaf950bb95576ef23c734af0e4aeda89b39944764bc09e65f4e4d73a36a3bacb941186a591418aae21665860c98cf528c3dd9
SSDEEP 49152:FB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glwpq8pvaM0r+:ru6JmTxd2dwg8Qi
TLSH
T191D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.1MB
SHA256 088ae8f6b03a07014cec57ac79a2e3df35baa562906edd55c82f40b9800586b3
MD5 7be2cb0d9b7010a5e9c68e5c0ed77b6d
SHA1 2facdbf937759bf4055e7f146969bcdd9fbcf4b2
SHA512 5ab7800a9591979fa8a79ceeef79a0c98e5d01ee2f6452f4fb8ac3b4a55f55bf58433e9ec0a6b1ae119dd399311fdfbf9a8d02750c6410c91ce3439ff7d66b72
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xspq8pvaMZ:/mifPbR9g8d
TLSH
T1C8A5AE13F2D900E8D05DD178875A9232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.0MB
SHA256 ad7a1ac525fa0df5c7398290580dfeffdfd621b5ae25d5791e085ddd92209527
MD5 a3ff359f4495ada6dd174e4a6d84dda9
SHA1 6782379239b29d3605f0102787107255693f7a92
SHA512 39cc85f28eee98c4849c00fde2c3402a8b5de6d06878380fcda3a79f1e384ceed29e570b8cdacd2e88972bf51834b77795e5a880714d14b1a6464186878809a0
SSDEEP 24576:M4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSMHnqZDZ4qSyH:MSuZQIY0Be2K6RVtOnks6NMHqZpqa
TLSH
T1ACA59D03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.8MB
SHA256 fcf1ddb417ead674a7e58682bf430cde614836fdb5cc433ea41785bb90596658
MD5 cf65bf05a2ea9c0864babd68958ea410
SHA1 6c1496ccbe682e6dd360e696ac18bd35c48fc14f
SHA512 52477864dd8847900392f9833afee9cc4ddde01302c1990bfbd527e9fe9c4219bfae56b682c45404e9754c5fa692a35caa7bad63c23cc5a712c42a1f59cd9404
SSDEEP 49152:22tSn8EApI0figTgiDn0AP5whpq8pvaMu:WX2iyphsg8a
TLSH
T12E95AE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 5f538d04f6a344fa2a9edfff9bb3c404a0e908e151b3d90fead63e3c363f4699
MD5 fe4de590fb904f033620f7c30e8a6a44
SHA1 cecb0d5e9e63ebdb80f002a3fcf742cb8e74494b
SHA512 714588f71900658c79c154b3ee1556f1d273b56062f3e817d35b056505b9d44b471337a6611c54b65030744749ba4e89c2bc47fd45a200c8906c051ec7a2b99d
SSDEEP 12288:2agdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:22DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1DDD42389917D05BAF149CDBD88BE9B1EF43B1E972473C1BAC76DA13D8C56A5020103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 0959c55c853cf0c746d8a8d85f560b6c5e1f29a80a5bffbc5085f3d268d140eb
MD5 2fb126bf44c2395d1ac56efcae323970
SHA1 ac46e2ccdc13d51a2ec067f858806fae160d7b7d
SHA512 c6c5056056fbafe4d29ec7f3a71b881c4434b7933a81229458159d25a20fbb92461d0e9d1423f606253852970539d3dcbaad90662aa54c9edd9a7950b6f7c96b
SSDEEP 12288:QAdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:QRDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T1C9D42389917D09BAF149CDBC497E9B1EF43B1F972473C1BAC76DA1398C4AA5020103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 6c3f08127ffc83a45716d2c65c9244a052f7c89b93b03d290ca5915006cef75b
MD5 9f1c14e2c63499cb6009ce6fe733df47
SHA1 e49b42a522afd72b26f0e199d07c80eefa596ca8
SHA512 fbc90e086cc55e17014fff1a849c0a6a520afef3a7228abd1675449e5a9b68212489a4d26935c6d86115e19a53e027393707bed1304d91ff6b61314d8a4e4f69
SSDEEP 12288:qSdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:qfDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T152D42389917D09BAF589CDBC497E9B1EF43B1F972473C1AAC76DA03D8C46A5420103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 022b50909ba97dda9c73a95e16ee8c411faebefdda1cae1f45fe12707b891626
MD5 48f214042147cbf391e406d35d5e06c2
SHA1 9044b55721a0c402b7fc16292022781b88d88a25
SHA512 44d6887d39732bf7753d1b081ddfebba0e3dec212c7d6405f903c7b968021e995f0559319c23f5521ababcb24939fdea3b4ea670a113ab3a32282ef024d764da
SSDEEP 12288:9lgdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:5DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T19ED42389527D04E6E49ACABCC8BE971EF5773EA22533C3AFC724542E4D6275024207A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 c6de052d836b5a17cc1d28d0c8c3bbf2ae07675d5bfc24cf3c353240ac1e89de
MD5 9bc5006cd033a6f54f0f170299d5463a
SHA1 00958fbca7048a9de149dbd0433101779f748ad5
SHA512 90dae43a57878220ed08a90288d71c97c474c39691f3eeaff8f74cd3a606443760d7ff7d88b04406d97413d84ea34afe8a79558f0a4a2d64f9aa312ffdf98ab0
SSDEEP 12288:ZQdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:ZhDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T105D42389913D05BAF149CDBD487E9B1EF43B1E972873C1BAD76DA13D8C4A65420103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 dad0ad3bc1c09dec47112c1d3094897d43b0bfa134073d0277eb11d43e97becf
MD5 580b9b6346711fc66e51017a43ff6d9f
SHA1 0fdacecbae6c9e0303387ba55b51187a59f1039e
SHA512 2411d7417fcb9ef42f2d3721a604d9dda84d9408ae9b237e5e6a98ac5219229700e2328e03867fbca934f20316b64edbfce390e72c9242c1c0c813f2b8b85a2f
SSDEEP 12288:agdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:axDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T12CD42389913D05BAF54DCEBC487EDB1EF43B1E972473C1AAC76DA1298D85A5020103FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 c5f98ee4a04a029cf1a046958bf7426b1ebd20829f822ab23b657faff5f7727d
MD5 58594fd669716cfb2717a19c28093aee
SHA1 0472b9b435f3717477b5c697d306832afb804df2
SHA512 9d2d292efe79d2164af95d9b4acc9d3e50953e2a5664e2e0287440751e415d78457f9ab609ee715caebdb2ce6e238bd786f321e548c7ff61561ca5a6f3ad69f8
SSDEEP 12288:/9dUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:/yDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T123D42389913D05BAF149CDBC497EDB1EF43B1F972873C1AAC76DA0398D96A5420103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 ba2f098eeb8fcfde254aaf0ccaef37f4a7018eaaef07577c557d1884e704fc92
MD5 81f9fc93fc61576e508e579b003f5813
SHA1 297eabcfdda39729cb2255316694d4ac6c47951c
SHA512 aff0204b79b7857d81ad70847d65c93e47342d5ff87f33e7d55520947e78e1929220143092a87305e06671d4753ea315fcb9d678f4c1334b338657cb7dd18cf1
SSDEEP 24576:BZMTzyzSWyDZ4qSywz0Tp5IgaMV7iYc+:BZMTzy+pq8pvaM0r+
TLSH
T169150295B36418F9EC67853ECD65890AE6B37C560670C61F43B8362B4F733601C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 3158228297c94d5a8f38f76ee9e091be4d14509cefc273352a962f4ac19fd147
MD5 18ebe07d6e07f8ba361b0805701aa933
SHA1 f1cf76f576125cf3c4186ebdf2d6e1a8d1445789
SHA512 3d3c7d312eaa4072d2683d41a643a2bee370479ddef7ec6f87350e1dd1917729f4732c49ce46dfd5fb4c7c3ef406752a6362a80a6a7478bb71c0a9eb3176dfd2
SSDEEP 12288:2uZdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:2uuDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T139D42389913D05BAF54DCDBD487E9B1EF43B1E972473C1AAC76DA53D8C8AA5020103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 f81677d784a4fac6ec69eada4dbc64e6987a448146729cff838d168c279ecb38
MD5 793f51b74ccf1d164b21b03825fa9f45
SHA1 146d25c83dae12fb5c04d577d4c8db1b46076002
SHA512 ecacf73ab3e6713f3118f803320ee50ee08cbbe7602f739620832c19430a06175f6d5decf567a96bde1e796e2706b7d78f64aa69495489d5d32dc7d2b1bf5eff
SSDEEP 12288:QNvdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:QNADZ4qSywz0Tp5IgaMV7iYc+
TLSH
T112D4238D913D05BAF549CDBC487E9B1EF43B1FA72473C2AAC76DA12D8C9965020103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a68714f2329842d4fac16763c4e4b43aa673ed2cf3d2f22f49dd78c4b674caac
MD5 390266e07f94c48c42c000f2c39a8c02
SHA1 985b3d672de5ca297962a58d62857a53841532f8
SHA512 66d442ff48658c3451eb25d4950335e9979fa09a1f6016cf665eba958ca3cb535c0063906ea3051e25480e28ea9ef1674b65ce931c4283ec023d5aac5b31f65d
SSDEEP 24576:6Iwvtk9RX6wkyAIUDZ4qSywz0Tp5IgaMV7iYc+:6MnYIUpq8pvaM0r+
TLSH
T10335D029EBDC04E5E1B7923C89B7460AF6B278691B31C2CF025A536D0E37ED46D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 e805c119ee4b46f71e309a6c07de5bb10092405ab01189665b4c803fbf3ad2ed
MD5 723d32ef9b5bfc508b54bbf1ae8073e4
SHA1 fd7226828f18eea91640bb94181d3fcc813c58f6
SHA512 d743e82124c5492ccf32081ef43b87f61d69eb5714bab21a06b6ffbaff0b09c70d95c826e01bcbffdc02ef5d733c47e54e69db045b19bb8a5c8fda44d5c4cbc2
SSDEEP 49152:GYAaNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02pq8pvaM0r+:jySzPug8Qi
TLSH
T177066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8b93083a6e2d9eeacd1b21c7a51174fa67562f4ec94cafd0016f06fdf349de89
MD5 231222cacbbe8a16d62e608d80b91daa
SHA1 b0d89719c16267108efff944a83144f469ab05e5
SHA512 d96ff6c971bd47813c4bc7a97f42a898500a7eb0cee8123f56090b918a126ad3b5c2a97c252b7445057865401ac660910c5af6077aa65bba9e25628652662495
SSDEEP 24576:o37Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYqDZ4qSywz0Tp5IgaMV7iYc+:o37JUQjXirIhCnDHUPfF/Mpq8pvaM0r+
TLSH
T1C665AE1DA3EC01E5E1BAD27885158A1AEA71782E1F31CACF1270837D6F63ED45E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 0a49405a239b0e7205ff4c75ea83f8cd0e64cec2d997f35e7cae6d78525c9605
MD5 69818e7d112259e6dba1322e33fde9b3
SHA1 2f4b1cc53e9b88147a1a0116ddd70ebe448ec9a6
SHA512 7b90131727821a3fe2d1379d2ab28b24b626736f93255414d500703340e906a48ed190abb47ca544019c4231963461c9b345d4dedcffaf38f1ae4634f972acba
SSDEEP 12288:3JsfDdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:4UDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T18EF4F149D26802E8D06E9279CB6A9A05F3333C6656F2D3CA93D0F53E0F766901CE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2f33d5f9544e7f4ca86a825f2cbb7795546edaed89c7782bda9c19f0a9e994ca
MD5 0900a5a6f22a2b9da34637dd36c5e8e6
SHA1 65990786df95b902b6c7421f63ce4e8dad17fbe9
SHA512 d2f7e01fa97348353fb8ea81466b43e231383fcd05b6ac28627face034a41c463ede134a4bd33db1707040c57f0474a7ca2410ede5b065aacbcca8838bf157c2
SSDEEP 12288:2v9BOQU3fEkZeBqYq6fJ/qy4j/bV2Nnj5lPX0xLLJXpDYJ6ycl:2v9gQUPxGfqKgyaz4NdkxLLJXpDCcl
TLSH
T169452840766AC74FC6A940325E32D5CCAB707D51EE056F0373C89B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f51248b546daa02edfaada9e0ef271a8a4079c487e37abae0340da21146d8a8b
MD5 5bac00131ee6c59ee0164192da02f1e0
SHA1 24a2073132d393488a224b21769a7dffee8b0199
SHA512 be6f7124b4e04e40adb2eab02f14f8a7305602f4edd5bce13f23b62d596c3f83ba30838e345834d2fb132637265f0d7f36fd743edcb1c2383c20301b609174fb
SSDEEP 12288:oSwgQtWvgbCdN5K+YONXkSUGbWgxFaIUfx:oSwgQtW4+cONUSUGbWgx+fx
TLSH
T11665E7415537E3CFD1FB603207295B4CB764EC46B7096F26B388453ED82AA25A4BE3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 04cce132e2685ae0ecc4e02f577d4940e9a8009e9df2174c974e405ee83cd26e
MD5 5abb596d1f171d6bdcc47846f6562bf5
SHA1 568d97a8e8ca4867a90ce385b03a139d8eeea5e6
SHA512 4f38a6398c80ed9eb3dcf254c182e32b93689b3b7c58a96d5a69390213ee659fbf7571e52157fcfed4401e4fe0c4dd22d5a1af9ef9f341ed779025c9c4927d16
SSDEEP 12288:cJ7LmdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:s3DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T12DD42385837D0866F4ADCDB8487ED72DB53F3E671E62C1EBD718B12D4C65A80286039B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 31b36ef0c8b0edf0bf14cbc81939aa587e22bf190404496c4d5e695d214dc1d8
MD5 fd78c31b1fbe879d4130d1eba3f8069b
SHA1 2fbf80c68666670c9a23e2d77f00ea4a27e914a1
SHA512 c8af10a23701e2ab9118c49e4a768018e1db8e0784f3803148fc92a03dd5ad47bc205cf9486aade0ed5e97a611a992d24009f069dfd75ebd07092a027194261d
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bY8DZ4qSywz0Tp5IgaMV7iYc+:Rgb4mBIBhGF3pq8pvaM0r+
TLSH
T16E659E1E22EC02F5E0F9D2B89DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 d650aa27feec5b83708854646321b9f472b86cec1bc421108c4bd8f89f25ceb4
MD5 5d949468141155497e209df5a72af8e3
SHA1 5dd2dcec2a26430c68516748fe72d0e62bc90bca
SHA512 9b3b3401021f63444f022a619c63892b22e8337568fe5e8f703b778bb4b2b9b9ba08356b9dabb3aa484506249c1d37bc6a6375a5460e509d10d6fe845d5d2663
SSDEEP 12288:z0G6dUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:gGHDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T14BE4235D21B924E9D47DCABC8879961BB4333AA11721D1FF87E4E0398E55AE03034F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 39b29504b03a48e6734c8a82e31c04fa20695364aab10f07764c584efd6678b1
MD5 f8c2c404230705c3413c0de55f0c2fae
SHA1 09380f0398f5c5f6ecef07067d5dc7d9e918fede
SHA512 56479eec279947f82b32cbac77f99d2c7f3d613092b54434bb4708fc4f25a10651e1e81f7c6757753f313f0a4a03220f6a6989ca76f96ec03954dc694ec380e0
SSDEEP 12288:mbCdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:mjDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T176D42389513D05AAE559CEBD487EDB1EB5371E631773C2E7C768B12D8C8AAD020303A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 202f756d0cef105b4b8ba93ba2ba7cb0a8cbf2af3e8b1bad2804e1c8f506a330
MD5 46a3619077e7c47558b1604c9815e2b3
SHA1 324f741c093e7f73696adb61ac78c20e057d2291
SHA512 f44458af7cc94ad85bc8b895707dbad514d211400001d1290a3f489254b8274c1f16e0083259e1fb08f84d0f6b51282136ee24404ccf84d7db004b606d9c081b
SSDEEP 24576:EZJ8u8FpJqH1Vzria7/mlDZ4qSywz0Tp5IgaMV7iYc+:UuZFPqVMa7/ypq8pvaM0r+
TLSH
T14835F16563E501F1D47BD13889964667F6B2B8260370EBDF07AC8B550F23AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 7e984408160fb6a343b54fb96e6ab6bd42e3f7c8599405e9c692312416c2f618
MD5 4711b196e96e1b135089140ad41aee3c
SHA1 98bea8930b85008f768e79fc3e3e5612bbd65b29
SHA512 6f50cb4687ff2453afe6f68ab22325af595bb004ef064c9888b502789b548260991dbfcf091c0a67e75150529c6cbf14f4bab1cd0d0d6798e3d621eb1c198ba2
SSDEEP 12288:JHvUrBFrEjwaQydUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:JPUr+NQ/DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T16705E11E62AC18E5E67AE17C8996870DF77278621712D2DF03E0813E4E67ED87C39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 64b8fe58f371eba634b9bc6017fa491fc0c18f8b9279bc529ab5e7d01b7c1139
MD5 c57a3e885eb96a11776bdf8d4382fb34
SHA1 04924c3c07f5224208df4ef6fac63752bb0c0dd1
SHA512 bfd1164a0f2ced27eb82896b555f7bbd025d0df626d02e416d0ba034b03147f3671c3a66494c32ae620cbf46db701bb9d1d1d389b2f560474a4c61f00633d466
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxpq8pvaM0r+:sG05lO43bEg8Qi
TLSH
T1F1D5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 9c07e5db99378be7944e3ccdc5b2ccb95ff8fff5cef6f0c2f21f6f15f78e4248
MD5 f4c26658dd874da2b6df0039c3ee3660
SHA1 92899037fa818772632046c37f4754fbe5f268ab
SHA512 2fb3b5f415cb31cbcc6024c87224d35d4a96ee43b177ea52575468537b610df138307c8e4fff0e35cb58342ff1a4aae85693b3970a48bf4d39f3018f26996bd7
SSDEEP 24576:09a5POZ3dpbWVM50JicR2hG0lasx2+47eidnjCDZ4qSywz0Tp5IgaMV7iYc+:ua5POZ3wJt2pasx2+mJCpq8pvaM0r+
TLSH
T12F65AF5EA6FC01D5D5B9D17DC583861AF5B2342253329BCB022182BE3F27EE85D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cd39c0a4404daa6df4c3467b157fc54e4a9bb584d23d36f0b694d00eeeb88b59
MD5 0c429779d37d256abff1ab51453cd11f
SHA1 ab9432074a4d811dd5ef41a6bd96b91dcc057a76
SHA512 7dc47cb7779abf0b93834cdf190d2a0e2ea4a112a561fa4a17e36623369dbb943d5e4435a7a05989184bda3c390d76991c87907dfdde5f3deebee66486559064
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkhDZ4qSywz0Tp5IgaMV7iYc+:INc/zEOVHF6pq8pvaM0r+
TLSH
T1C6857B5622E901E4F5BBE1BE897B9646FA717865133086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 32df1f75756e93f1c55d77ad262703a5fd9c27fc5903b93cdf47322034350829
MD5 e4707176cec658a3d5530b8dec3641df
SHA1 d127f2d3915ee0928adc0abe06e93b6d2df36c92
SHA512 fb9528155b9d9373dd80704a54a5d1c23348a5de94b24ff984f865dca26145d34d6a4562ca44b021d1a107cdfaf46e8d1de835e0db4f9da241e9007abf01e0f6
SSDEEP 24576:EJnJPbzB4SzHDZ4qSywz0Tp5IgaMV7iYc+:EJnJv6Sjpq8pvaM0r+
TLSH
T19515E02DD2A810E8E4B7C2B4815A175AFE32387D2F2269C759B4D5343F12FE06939F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 767b9b3f1517372747ef5879ae5fd0d3b5297d24ce1d1c080ed97eefb78578b5
MD5 e5f9108bc78ffaf75bf3d75b172886b7
SHA1 f220298aa428f197c340197e05764493ecda655e
SHA512 5dbf3329a404deb4eb0a81f34426abc391b9f820f4d86418790e3aa12bc9a528b6b5438eab9c314bc891d09ff78de509b40e29e8614fb1bed4bf2c5f1d70b90a
SSDEEP 24576:vCLHGL0MoeVtFumTijCmlKQWDkODZ4qSywz0Tp5IgaMV7iYc+:vCLHGeeV5ijCmlDWDkOpq8pvaM0r+
TLSH
T1F2A56B05A7EB5184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 77eeb795465ea6c0fac93b48b680bf1062569d12df73ddd7621d29c48ffa6aa1
MD5 e72096483cfd8d30c56e0b7ad9d0347e
SHA1 5e381b8da32c826558793d8af33817a22f7ad29f
SHA512 144ddfcf06b846bcdffabc6fec26f435895b30e8607a419be973f8cfe8258638f8d7ad7c3e474eaaac7e9bd57968a8185773556ff45a6627aad83459eaa3bd7d
SSDEEP 12288:p1Hck6j5ZI7FdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:x6DIGDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T14FF4024C237A10F9D06BD03D85974606E1B3B5B1872296DF47A8C57D8EA3ED87838F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 a71149c45f4244e851a28f3e81a4109e583dabbe13d7662a78d46db72603d8fd
MD5 50d9fa235d6301ce7b35e4ec1126e275
SHA1 3b6db4848af22d5a63faf0b9d7dd4b6a269557b3
SHA512 b122d8da5901fefc7cb15a42a895891bf5ae49f4744e790d5de47390b2ad11538bf97f858c8e4241ec66bb9236b0c3616984b77ce6b99a383952ac05f11c1166
SSDEEP 12288:qG6ky2dUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:jtyTDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T158F4124853B814E5F5B9867C89778259EA367C215B22C3EF87A0E63E4E36BD03830757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 263536b071e3e3d39dd19efc956b3ce00a359fe25ba5f6b5b30369045d55dd1d
MD5 d60fafbd38e7d768e049fc9c653111ce
SHA1 3dafc1bb7737f27abcd0e031dc1bdecf7b840680
SHA512 90dc522bfe946e3b309bdb1526f0c3ce1ada49222f9672488c13a939c0b3a3d9d734f87d072872eeb081cd933628ef9bcc9966eca3a9acb38d7094822537c634
SSDEEP 12288:1F6KdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:L4DZ4qSywz0Tp5IgaMV7iYc+
TLSH
T168D4238C523D15A6E459CEBC447E9B1EA0373AB21B73C1FFD7A8E1398D5A6D02030796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 21cb65da79e873aaf2fb1ec4ffeb23ef15eec5ada7d4194a9129b6c9c7bdab41
MD5 8318abd3ea0a4d6ddcac3b32f95de62d
SHA1 ac6bbb57da9ae7df0a31ce2f10cb97ea755e25cb
SHA512 18866bb3d907d7cd54569eb76881e4188a45570e491faa3ebcc88bca9a8df43ab9d19f7482c71c7d7b91e7b0d2b9d6e1ea19db2a03e70bb2a78160d747f1a30c
SSDEEP 24576:Z6gBLoTfaidZODZ4qSywz0Tp5IgaMV7iYc+:EgGTrZOpq8pvaM0r+
TLSH
T1B5559D1D63EA05CAE2B2D679D8725493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 90d374248266d33df3b0ce9031f1484f848c135bcd4d5a06332240bec5373d5f
MD5 4735856e9c1513d43a1375f4ffbb4fc4
SHA1 b67c463938275faae1abac273dbe3da507ade356
SHA512 e6f39ca15de8c82b035d201644c0abad21b2643ec7ce7e43c5e2adcde288b31fcbd8bebc23793a557fabdc8dde7827e336e16e0b2e8606aa3d5a16b646e2faad
SSDEEP 12288:0pJcm8CNqVdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:0rcmRFDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T15B05F04EB26E00E6E1BBC17C8896461AF6737471272293DF42A1C73E4E57AE83D34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 37c1d24d95f5f35a37750a1bf6002a435a6a24ee9e3ef7fec147b6297425de7a
MD5 6b7038da0f591debaa207a7738b20a23
SHA1 de760d080ddd6783da127a25475f0acf0894d9af
SHA512 e07e999eff932f8a3e146ec1e3a44c6b69a0f217133e94ed2eb0ba2c952d8e3a68cded6f3fc9b3902c4836e28f81ef37cb34151c2065df9ce53939d41385c220
SSDEEP 49152:xDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Tpq8pvaM0r+:C3Upow8sBGg8Qi
TLSH
T170A58C3DA2E800A8D9AAC379C54213A6EA71782E3F3055DB0174C178BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 38a73e86d2ee7beecbe525cbc2c63d45253d9f57d9bd487e08e1e48641198e50
MD5 b9f3f69c48b4e714edaf7c52fbf2aa0d
SHA1 0c0b75908103fbf321e2a8fdb2a1521bb9260f60
SHA512 93ba8d864d3f498dedf22c515e728eb234c1b1f8d8f6d9caa37178ea81ba50515100edfc4fb761ca0fa14fc2d99588073837cd7d260bc492ae3e3ca005f663d9
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmkDZ4qSywz0Tp5IgaMV7iYc+:nTMwBtOmkpq8pvaM0r+
TLSH
T1E655AF6EB6B806E4D1FEC6B48D238516F6727861073293CB9390C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 0738f5f53c0f6bf2cbc8b2ec09ca3e964522232e5966a5093a98ad7e4bfcd4f6
MD5 ea6246a3258568232bee712f9cb81040
SHA1 1c949745554e7469deca25120b4888a764a2e91a
SHA512 e39a669a6d0247eaf48c077f80f013b4471102e07e6a18d6ec31d26d34d73006b3b9a456e294080b4a7f25361b07758d3962c4b9d4c86e5879123da3e9e9277d
SSDEEP 24576:aD3FHshBIYQgA4DZ4qSywz0Tp5IgaMV7iYc+:aDVHeBIAA4pq8pvaM0r+
TLSH
T18F25E17DE66C04E4E57AC1BCCA638A06E67238A9033295DB02D4C17A5F5BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 2391739293838ce2cd11027d4598c6d1ea8b77a8d584c45375c67528a063e6a5
MD5 917e40c966f872e43deb6b175eaa9f7e
SHA1 6a57b6b4019987e6979db6b7ce3d7b1641064508
SHA512 00be15c5ff962f8b3a118bc41b390d4575f3f730acb6dd4fd97a3ff932a86f420073bd477decb0ea8caafd98f746f3b9024b6de509cfdf7f83dfcc95b47bc12e
SSDEEP 12288:kyS6b3IkxjbBzRdUWIDZ69/iSywdB0T0ne63U5Igag3eUDQeYqGOTd/mTktdSxE4:S6UqjpGDZ4qSywz0Tp5IgaMV7iYc+
TLSH
T143F4134D52A814F9F0798678D87AC22A90367C721772D1FF63D8D53E8E36ED0543AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-260-0x000001DC51B20000-0x000001DC51B86000-memory.dmp

Download

memory/868-256-0x000001DC51B20000-0x000001DC51B86000-memory.dmp

Download

memory/868-255-0x000001DC51B20000-0x000001DC51B86000-memory.dmp

Download

memory/868-254-0x00007FF700710000-0x00007FF700A30000-memory.dmp

Download

memory/868-262-0x00007FF700710000-0x00007FF700A30000-memory.dmp

Download

memory/1152-0-0x0000000001920000-0x0000000001989000-memory.dmp

Download

memory/1152-5-0x0000000001830000-0x00000000018C7000-memory.dmp

Download

memory/1152-7-0x0000000001920000-0x0000000001989000-memory.dmp

Download

memory/1308-98-0x000001F2FC040000-0x000001F2FC0A6000-memory.dmp

Download

memory/1308-107-0x000001F2FC040000-0x000001F2FC0A6000-memory.dmp

Download

memory/1308-208-0x00007FF7F5AC0000-0x00007FF7F5B88000-memory.dmp

Download

memory/1308-35-0x00007FF7F5AC0000-0x00007FF7F5B88000-memory.dmp

Download

memory/1308-108-0x000001F2FC040000-0x000001F2FC0A6000-memory.dmp

Download

memory/1448-284-0x00007FF7B2DB0000-0x00007FF7B32B6000-memory.dmp

Download

memory/1448-330-0x00007FF7B2DB0000-0x00007FF7B32B6000-memory.dmp

Download

memory/1448-285-0x000002099A5F0000-0x000002099A656000-memory.dmp

Download

memory/1448-283-0x000002099A5F0000-0x000002099A656000-memory.dmp

Download

memory/1468-209-0x00007FF659000000-0x00007FF6590AD000-memory.dmp

Download

memory/1468-210-0x000001AAE78E0000-0x000001AAE7946000-memory.dmp

Download

memory/1468-293-0x00007FF659000000-0x00007FF6590AD000-memory.dmp

Download

memory/1468-211-0x000001AAE78E0000-0x000001AAE7946000-memory.dmp

Download

memory/1536-154-0x00007FF74A2F0000-0x00007FF74A457000-memory.dmp

Download

memory/1536-152-0x00000289B9040000-0x00000289B90A6000-memory.dmp

Download

memory/1536-146-0x00000289B9040000-0x00000289B90A6000-memory.dmp

Download

memory/1536-147-0x00000289B9040000-0x00000289B90A6000-memory.dmp

Download

memory/1536-145-0x00007FF74A2F0000-0x00007FF74A457000-memory.dmp

Download

memory/1896-131-0x0000028AFC4C0000-0x0000028AFC526000-memory.dmp

Download

memory/1896-129-0x0000028AFC260000-0x0000028AFC38C000-memory.dmp

Download

memory/1896-130-0x0000028AFC4C0000-0x0000028AFC526000-memory.dmp

Download

memory/2428-247-0x000002077D100000-0x000002077D166000-memory.dmp

Download

memory/2428-246-0x000002077D100000-0x000002077D166000-memory.dmp

Download

memory/2428-320-0x00007FF75A190000-0x00007FF75A324000-memory.dmp

Download

memory/2428-245-0x00007FF75A190000-0x00007FF75A324000-memory.dmp

Download

memory/2528-157-0x00007FF707370000-0x00007FF707489000-memory.dmp

Download

memory/2528-253-0x00007FF707370000-0x00007FF707489000-memory.dmp

Download

memory/2528-159-0x0000014CAB4F0000-0x0000014CAB556000-memory.dmp

Download

memory/2528-158-0x0000014CAB4F0000-0x0000014CAB556000-memory.dmp

Download

memory/2732-271-0x00007FF60DD20000-0x00007FF60DFAA000-memory.dmp

Download

memory/2732-267-0x0000018AB36F0000-0x0000018AB3756000-memory.dmp

Download

memory/2732-328-0x00007FF60DD20000-0x00007FF60DFAA000-memory.dmp

Download

memory/2732-266-0x0000018AB36F0000-0x0000018AB3756000-memory.dmp

Download

memory/2908-333-0x00007FF729C10000-0x00007FF729D3E000-memory.dmp

Download

memory/2908-294-0x00007FF729C10000-0x00007FF729D3E000-memory.dmp

Download

memory/2908-295-0x0000016790080000-0x00000167900E6000-memory.dmp

Download

memory/2908-296-0x0000016790080000-0x00000167900E6000-memory.dmp

Download

memory/3408-325-0x00007FF661B60000-0x00007FF661F76000-memory.dmp

Download

memory/3408-323-0x0000016FB3180000-0x0000016FB31E6000-memory.dmp

Download

memory/3408-218-0x00007FF661B60000-0x00007FF661F76000-memory.dmp

Download

memory/3408-301-0x00007FF661B60000-0x00007FF661F76000-memory.dmp

Download

memory/3408-220-0x0000016FB3180000-0x0000016FB31E6000-memory.dmp

Download

memory/3408-219-0x0000016FB3180000-0x0000016FB31E6000-memory.dmp

Download

memory/3580-329-0x00007FF742E00000-0x00007FF7432D0000-memory.dmp

Download

memory/3580-276-0x000001A9B01A0000-0x000001A9B0206000-memory.dmp

Download

memory/3580-277-0x000001A9B01A0000-0x000001A9B0206000-memory.dmp

Download

memory/3580-275-0x00007FF742E00000-0x00007FF7432D0000-memory.dmp

Download

memory/3928-304-0x00007FF6FC8D0000-0x00007FF6FC983000-memory.dmp

Download

memory/3928-228-0x00007FF6FC8D0000-0x00007FF6FC983000-memory.dmp

Download

memory/3928-229-0x00000273ECBE0000-0x00000273ECC46000-memory.dmp

Download

memory/3928-230-0x00000273ECBE0000-0x00000273ECC46000-memory.dmp

Download

memory/4104-138-0x000001E2693E0000-0x000001E269446000-memory.dmp

Download

memory/4104-137-0x000001E269190000-0x000001E2692BC000-memory.dmp

Download

memory/4104-139-0x000001E2693E0000-0x000001E269446000-memory.dmp

Download

memory/4116-236-0x00007FF7A77F0000-0x00007FF7A7A92000-memory.dmp

Download

memory/4116-318-0x00007FF7A77F0000-0x00007FF7A7A92000-memory.dmp

Download

memory/4116-238-0x000001DCB4FD0000-0x000001DCB5036000-memory.dmp

Download

memory/4116-239-0x000001DCB4FD0000-0x000001DCB5036000-memory.dmp

Download

memory/4208-197-0x00007FF7F5AC0000-0x00007FF7F5B88000-memory.dmp

Download

memory/4208-29-0x0000021EE5380000-0x0000021EE53E6000-memory.dmp

Download

memory/4208-28-0x0000021EE5380000-0x0000021EE53E6000-memory.dmp

Download

memory/4208-27-0x0000021EE5380000-0x0000021EE53E6000-memory.dmp

Download

memory/4208-26-0x00007FF7F5AC0000-0x00007FF7F5B88000-memory.dmp

Download

memory/5844-171-0x00000119D2DC0000-0x00000119D2E26000-memory.dmp

Download

memory/5844-170-0x00000119D2DC0000-0x00000119D2E26000-memory.dmp

Download

memory/5844-169-0x00000119D2B70000-0x00000119D2C9C000-memory.dmp

Download

memory/6024-334-0x00007FF7C50D0000-0x00007FF7C540E000-memory.dmp

Download

memory/6024-306-0x000001C235000000-0x000001C235066000-memory.dmp

Download

memory/6024-307-0x000001C235000000-0x000001C235066000-memory.dmp

Download

memory/6024-305-0x00007FF7C50D0000-0x00007FF7C540E000-memory.dmp

Download

memory/6120-177-0x00007FF7FC200000-0x00007FF7FC322000-memory.dmp

Download

memory/6120-15-0x00007FF7FC200000-0x00007FF7FC322000-memory.dmp

Download

memory/6120-16-0x000001D2C4BE0000-0x000001D2C4C46000-memory.dmp

Download

memory/6120-18-0x000001D2C4BE0000-0x000001D2C4C46000-memory.dmp

Download

memory/6120-17-0x000001D2C4BE0000-0x000001D2C4C46000-memory.dmp

Download

memory/6648-193-0x0000000000A10000-0x0000000000A79000-memory.dmp

Download

memory/6648-274-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/6648-188-0x0000000000A10000-0x0000000000A79000-memory.dmp

Download

memory/6648-187-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/6968-265-0x00007FF6C9410000-0x00007FF6C9559000-memory.dmp

Download

memory/6968-180-0x00000270832C0000-0x0000027083326000-memory.dmp

Download

memory/6968-178-0x00007FF6C9410000-0x00007FF6C9559000-memory.dmp

Download

memory/6968-181-0x00000270832C0000-0x0000027083326000-memory.dmp

Download

memory/7004-200-0x00007FF765F50000-0x00007FF766693000-memory.dmp

Download

memory/7004-202-0x00000261BF190000-0x00000261BF1F6000-memory.dmp

Download

memory/7004-201-0x00000261BF190000-0x00000261BF1F6000-memory.dmp

Download

memory/7004-343-0x00007FF765F50000-0x00007FF766693000-memory.dmp

Download

memory/7004-289-0x00007FF765F50000-0x00007FF766693000-memory.dmp

Download

memory/7004-341-0x00000261BF190000-0x00000261BF1F6000-memory.dmp

Download