462828d05a04c34aef189236325229d7527b12d876f7b0fbea023d9e181ea594

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260804-rxvm6sgn4w
SHA256 462828d05a04c34aef189236325229d7527b12d876f7b0fbea023d9e181ea594
MD5 ae409144edae81e26773271afb43abaa
SHA1 fc7bb0e650104711b41ea99017ccd8ec6d7ef749
SHA512 3624424dffd0d69f148df79f7190fd280972a09dafd2a5e11b034f7ed6a7f319283212f6a489f03246c583a798a009c2f8c7d85ca3f5b1abcfa623719de581ff
SSDEEP 49152:L0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3GQ/lFTjN4:L0pxfbf+/4h9hNhBX3RLm
TLSH
T1AEA5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4084	elevation_service.exe
4832	elevation_service.exe
980	maintenanceservice.exe
5996	OSE.EXE
3900	PerceptionSimulationService.exe
800	perfhost.exe
3944	ReFsDedupSvc.exe
2496	SensorDataService.exe
1184	ssh-agent.exe
4816	AgentService.exe
4092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16df4230d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a373b51e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca062761e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e748b2761e24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006830e4761e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010d0d1751e24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe
4084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4816	AgentService.exe
Token: SeBackupPrivilege	3944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3944	ReFsDedupSvc.exe
Token: 33	4092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4092	SearchIndexer.exe
Token: SeDebugPrivilege	424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	424	2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 616	4092	SearchIndexer.exe	100
PID 4092 wrote to memory of 3432	4092	SearchIndexer.exe	101
PID 4092 wrote to memory of 3736	4092	SearchIndexer.exe	102
PID 4092 wrote to memory of 1628	4092	SearchIndexer.exe	103
PID 4092 wrote to memory of 5968	4092	SearchIndexer.exe	109
PID 4092 wrote to memory of 5060	4092	SearchIndexer.exe	110
PID 4092 wrote to memory of 4200	4092	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ae409144edae81e26773271afb43abaa_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e779eda8c2d25068888472f5abbcb5a3d9ee2b96349ed512cb055ea9df8053b0
MD5 ef7dbef39ee5825767842eb6bfd53876
SHA1 3b1c4fedab13780d39d2f0b765e70b3389147f38
SHA512 9a28cd6221e064133501cc5c79192f7f495ba2ba1a0267498154a7846f5c6a1ffb92165cae01d0f924c6a30b6f7e58de9601af3b5ccaebff27199e3bdf195fd0
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/Q/lFTjN4:k3q6HjBLLm
TLSH
T178D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0be5fb9bbb4b3581c1107cde38ba549bd2067abcd80858315cd3c98be7e18a0e
MD5 32899dede5ea4c957bb6e25194ae93e4
SHA1 40436c81c8a955b2a5af044ddd7f3f37221584d1
SHA512 ca1d4381512f3f76e9c352ad4c2c405ffc8286b5169150475c752c1cb666e2a1ba4a19964e05dbb73a556ab17988df437911709dc8e02e3b657373615a2dfd16
SSDEEP 12288:41XLsswWkxy2lRq2czA0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:+XYfDtczAUnQ/tbw/2Mkjy6Fr7g0og
TLSH
T12365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dbbd0cb0cc978bdaf2048738f9f01d0299ffa96be6b612fc2bdc948d3c36db63
MD5 04f3b2ba5cca5af16665c68cd7fd40d4
SHA1 91c95d15aea7e8e69c5aa46a15d9450c50055a87
SHA512 a39c37185f3a99df4cad0e08112ce49d84ba026121aa93b15c9a621bbbf25216e44a1c00bf14a1633cf6dcccc9eaf6b9ce2128b72ef881ef0b5caa6a72cd92c8
SSDEEP 24576:00Le5ji0hmxLrMXnQ/tbw/2Mkjy6Fr7g0oY:0Pji0AlWQ/lFTjN4
TLSH
T1EA859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ee4ef0c7f7db94f29b5f4755fe5c956d5653b8aba6177daa3ec1b017564d06a6
MD5 39a4920320f31573ed9501affeaf9a94
SHA1 1e4208aa2dfa535b9a8d9b2d763e21d09febd25b
SHA512 24d49022de97787546aaf8a8d077169ec5f94751eee7683b1a0904b9c58d5274d3c2ebe90851e13e158d928ae5bcdae3426a4c57e69cdf95ca862ffd38183560
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWE6q8wyu1nQ/tbw/2Mkjy6Fr7g0o2:Z/ezSC6vUzPvxHjyiQ/lFTjN4
TLSH
T1B3755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25c2a876befb6b199a30027977fa14f67e39d9cdf3e522558e806d6b0fe46e9b
MD5 5b3222d139f0d2346104fb94ae011010
SHA1 101e09d8d37fb12f513f2884e5b545529c3b652c
SHA512 4aaf992c45b0feafa8e7012cfc6de446867cbf0740578ab6ee1cad196b46b693dede54e30797ef2dfe9afc141aa37bc3496727bf0c822a33ac43da4405ba1fef
SSDEEP 24576:OVbqPb88hv/l+6YnQ/tbw/2Mkjy6Fr7g0oS:OVO88hXl+jQ/lFTjN4
TLSH
T19D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cdc6ab10e004128c5cdf452c6f36eda87e29afdd0e1c188d9d3c8a2dcaa1210a
MD5 32e9d9d71488e90efd2dac4d921e87e7
SHA1 8cda48557a03fe78f1de79d69bbb604c476b305c
SHA512 55c6f574dfeb4d420a4fcefd2e4679d328bd519bcb95f1fe11f3c4c141b60402f3206fbf4c93b6400aacac22a19c753d759a82ac66a59b0eb52cf4d18fe47588
SSDEEP 12288:AzbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:AzLnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T15F5523796A14F897FF2B06B15C8284826B7B0EC1BFD4AB4E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 649bd14ab8a75216ffb848be734d706d26aa19ff30bd291bf53670d379e14704
MD5 74eb727fd886c6b3f0cfa0fda2cf6ce6
SHA1 61c76f0aa4d145a2b0a7484737d895437743500c
SHA512 3d5bdab48907c79edcff225ade79303f261070fe330db51333359babef61b3beabb8839b6e738093d45fc063d651fc43a737168629e965159ec52d5d2843fd2e
SSDEEP 12288:4eBNUbTVO86UQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:4JIUwnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C075CF3BEE28FCD2C67E4DB85A918640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 08692a515e7d7e8a08dcd49215e284d97afbc692e0c12aae8366d09e772aa625
MD5 1dc151889885664bb5b6329911f79537
SHA1 8cdc341128d6860d9447802dc1e9fdd10c8fdcd3
SHA512 695d7a024a6ca5046d0b9b862a67a9ce65534424577769d1de41cc2238c9f8c03e8e164ee4443465c24b3d0e40fc891626745543f915ed0953fdcc16f65981ff
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:BQvGAdlCEL8c/yRNw5CKLm
TLSH
T1B0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bfeab8178c7e1987c79d5008f6734a915921dc92334ebc7eedf769e91f0e5557
MD5 e0866b9876a2b97e2ef2f430aef2f8a3
SHA1 c196b89b0873270f2ee10817aeb1bb93dcd907b0
SHA512 43c76d7c89225efa3bb58ee440d9d8ae603b019bab3826c5bc2b0ba34b93e2c473bd2cce60e5ed798b5bd08574a84374f41a63abb5c6f5151fa7537a3d9fd5aa
SSDEEP 12288:yAwSfxL/2Dc39DLLmt0LDQewsAjmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgG:3QewsAjGnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T16975E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e4e535b076575a7574bf29ccaaed957f83833910d41e9aa0af84e14ee03e98f9
MD5 89211be87f1652c79f6ddc98c1543ac3
SHA1 fa439117293959eea41bd2de0b21be3340d9aad1
SHA512 fccde98fcfed59d80b40ae5d93f02cd40afaa5443776cf854067a9ad8065910f3ba9e5adb1d5369cc43d0909229070bafed0e3f2f4bdf97c13d1665f151c5a1f
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpL:uUEtQevvqc2W1cpV2EI32
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8eacdf2fab2904443044e84781aaa9b0d5a9e045580266b5fd388ac614c964a8
MD5 827ceb2b8e0b26b6af2c671645c9fbc3
SHA1 47789ea779afbae00fdbe2a7fc73d54563529ff7
SHA512 49ab4ae07bce8fb45fbcfe62b9bb5959c1948eaab7b4fba3ec4bf4c57ce540fc6342ae62871de20d589f7d9c6e16cbbaa95a3adde49293c768afea64445edf66
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zmQ/lFTjN4:noqtVjnmWLm
TLSH
T150D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fe718ecb3431383253552bf6e6925e41fc997b504d0e3d9eb79edc59d04d9344
MD5 55252072cc5e54fb360db993e80d2ca3
SHA1 1b084a2b02fcd183ffb16db45f7e78e90f7eecbb
SHA512 403a77e7bb120cccf09f8e6a31a153d9fb36460d6a9cd03d30505901eae941b00d5608fcb1d7cd917007f9668f5d5e347358cd5933295c3282b35f6502c04dc4
SSDEEP 24576:8AhGLJIFoiwtA5l7S53RnQ/tbw/2Mkjy6Fr7g0oe:8AMyFoiq5hQ/lFTjN4
TLSH
T1A535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 813986ebfeb9e774ec5751625c6a5a3fcaf626fb01feba43b3eca52228682efd
MD5 07ae50ee8f24e5604d01886c899e534c
SHA1 ad63b132452462adc1f98b7d02ba0bd0a0dbbebf
SHA512 e2e20e5db9e85280c4dd59bd7c292c3794467090377ba49d74f1b31b7319fbe0cd0cf0ef1b9025afcf3890201d20aef11bc6c165d491484fea9a158160e9d3d6
SSDEEP 12288:Umw5HEjsChN2BFgl0WDm+C1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:RwuHOWCnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B765F14A36A45CF9E96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a42b157fe5a9c17c83ef5158e06d10562f4b39efe6e4eb465355f68a80d6e55e
MD5 b9cf9ad7d940fd9d84fdb29b95f5efac
SHA1 ff120d16c1018541fe68b35ea7ec6f9ccc051574
SHA512 928bd49e778b6591f456485954373589e245bddaebe480bb3b7103c216b2b1fc5d99a1bf7ddf354678674efe5e56b34adc242230ad91cc838e03e4363f526b86
SSDEEP 12288:3XZ1IyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:nZuvnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1EB55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d50410cdc797ef5e766d579775af2e52822d862ff0d502dd194866751769ce51
MD5 48851f10316c50fee24d1482ce5df086
SHA1 c06fddedaf365af23a0409ce9968cf0379fbcb4a
SHA512 15628d4e4fa46d6536642b7974c7e1c188292e86ccf41036c5c59deffc18d4056a88dcd7f1ddf92f1565a94705f327a4ca8bee151691986dbfff5d550fd9868a
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:MQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T1DD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 585b12db9dfee32ff60051b75ad6206037700c0411b65912e1f3e737771380eb
MD5 dec84d04d137a29c20f1f95e8d250bb7
SHA1 d47318e0e56cb3b584202e6b23eb2a887a98f58a
SHA512 0959858a65cc6dcddbdfad8392993320a3d83d9f0220d2ba86a5be178848cffdb347021a481708314e8a8815f40db8db5861c4270626ed6bc5f1757a28fdc66e
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:rQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T16D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21f3cff2136865a9b7ea52025d3aa2b142a9c871d14424dacf231a1f88acc6f8
MD5 3bfde5d4845ff2694ce4c758ae3cb77b
SHA1 d57409b16790e952931f9aabe394f754d981419b
SHA512 d040d9e764ef15007941e81162d3f340f9e4edb7cbbab03591fd6f99a2b7d522b4280b080bc10032458f5ea5c242e1a13dcf440a2a93e11185869ed298e119f6
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/nQ/tbw/2Mkjy6p:B68Qg55nhheWu7PNU3/WQ/lFTjN4
TLSH
T1DDB55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4de2191b21c5cb25320fae91ee68c25baf14a345bd2b52be6873d0eb2dfa21d3
MD5 9031b32bce3ad1e2a680220b7c511abe
SHA1 2098b8b29d630e43b2aeb197ace6fa4ae5c889dc
SHA512 bd85df6d583294bf0def7b6bb39a41880929df55687e37af904028661c14931e342bf8aa23865404e644a07ea4ef0f289806a94c44864ef0433a47172417bfe0
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:Vy5112gYy5azzVvL69nLKnhZALm
TLSH
T189167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c81ea4b77cd85955fa4082e0599b2ff33a06b64de4effc51fc5eb95b0a3c1cdc
MD5 0f76148b2915b3513bac96bc07e9a6ba
SHA1 1cf3356aa922af14cd2459219081385bde4b88be
SHA512 ebdc536f2883a79758077bfa134930dd58d32a02a3803ffff6d55d28979a4264ee3db397fab91a9bc97011e30aeaba0c66c514bebd3bc28a31c61b2a234dbc26
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkQ/lFTjN4:nu6JmVxd2dXLm
TLSH
T1B5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 667570d40211992afb316d3e9b923df6edd5cad46d5d981cafa0e5718c0816b9
MD5 a686a78556aed50a9246c8294cdc6bbd
SHA1 776668b8e643b0e9d8ec4507962907bab8f05bdb
SHA512 1de912452eeb984f0eee2a82fba0adad000440d01f39201d58be72e191cea9a58ff1bf9a37f201fab598fb584709b21382d2fd51367c756c22c5eb892249d79b
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xQQ/lFTjN4:OmifPbRWLm
TLSH
T14DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 399df8460d2258a68aadc38ddf66938ae15f62a9dd155594de517eb985e817e2
MD5 bbcf044912c903c1a3d48b23d794cbaf
SHA1 7204b5c3ede2f1122886a88424dcf54817c707e2
SHA512 acb85d33384ca56a07425db080377e1885122e2b852bf2419c9ca9309f08fd4d55a75111125de32ec87719e3f78f181ba01fb83a2e4be7e83dd0c361ed6da264
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHqvQ/lFTjN4:h5dKTi61kLm
TLSH
T144C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1a9fc18abbba9da24a08a579b2539b63c89f89818cc39f28af6ed25f11c39825
MD5 ea252665c1827fb18faebf726a82bcce
SHA1 11226a1bc36757a3cb0dd838b12ce1e654119ef9
SHA512 774b65b0b9f0de9bdb4b4e524fbedcfba44d930c7e1bf25cb529e679a588ce5468a3ab067c37d2510ef6630ba8597d0ed5f822149b85995c75b9ff80838586eb
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wUQ/lFTjN4:ZX2iyphiLm
TLSH
T14D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c26b0c3efbfece35fa3cef3e1812afd97be87069b43b524bd12f8c46d222496b
MD5 f788143383e511b6ace1f4abf8d75eb1
SHA1 66d1c2267fcbca39071cf67ca56644f72e281896
SHA512 21b560a03d437eebc29fa5dbd243db5d45b44bf4976dba508392f4073e3344ecb4229fb6baca5784c8a41fe066cdc8e2d7c3186a1cdc2dd24cbbdd2b26f332f0
SSDEEP 12288:9zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:9jnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1455523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ed374309b1473111d764212c3838debc5b3154f1807a52cc91b378c3458f9183
MD5 70e784c5d3cdf647489e4c0ebe0ab006
SHA1 0ac05caaa5fbbf5d4d71c4b193c8d06e2ccfd21b
SHA512 c5e988f23371e5b9d2041271c3b8ebc2eaeee3d277ce33eff03a92aedc44e62804ad7d17ad02674f26cddc2eeb5d04fb6c3f5e095de591da0f41e7b51539dfe0
SSDEEP 12288:RqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:RqnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1175523797965F98BFA1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9bef40f00bd38719534b33d9abee403dd7fb367b368171c770fbf5e3df91b1e0
MD5 a735303eedcc907cfc3457ee17130986
SHA1 5c57f685f2380e8965b87ade6fe33f0b136f9b5d
SHA512 3afe45dcab6772da59a875961a1fbbc0fdda66e4aaf3e45dd27ca2b991a8ee709aaac60bac6371163a1029a7524b058076267b188c6b074748df4134fa460a3c
SSDEEP 12288:doGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:donQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1C45523697965F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c7777574505fcb40f9fdef0dbda2d839b95bdad7b6090e27b6720693d170877f
MD5 664579bbbe107a3c37ffa42e0aa8950e
SHA1 2b5b012196638335919554bbb9daf687dda17c65
SHA512 e283e8e1a20b59813a8f72ab7221aab8a40bf7295d0223cdc7dc2b5c5aef77e04db352efc29556c0509d7097c7c09f57a64ab00617061f027a437ea1603590d1
SSDEEP 12288:iVhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:SnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1865523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 612dd528fa1d12a78d06dde120ff4c1c5e3e04da12571a3048f865d5b6d82a31
MD5 5becf1bfa5bb933c414d51aef42aac22
SHA1 325037d8097f3523ef46f422deaa9b13e8a68cc1
SHA512 2852a66160c314b013694a1c2b224df529dd8a6f5129f26bbe082882c4fb03987d360efaa58ef722660ac735c90c06a6210749337b18207da178bcbb96b6512e
SSDEEP 12288:SpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:S5nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1EB5523697965F98BFA1706F18C838182973F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f074e28676c4fd22f3443cb5ef190be80a434e2292a3ac8f10c4b9345491220
MD5 a5b769308f943244db0620465e3de5d2
SHA1 c17d386bb2ddf62a2ab4ff2dbabe179e7119b2f9
SHA512 99e52091025228e85c7a7de43bf62c2b05ccdb8796b2f7591704dd68eab28dc6fb15c767746c75cd29162a642d8245aea61ccc506ab7ddae4941729fdc835142
SSDEEP 12288:V+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:V+nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1775523697964F98BFB1706F18C828186973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f5fccaa7e2f9c5e242e794e96af4c0a3baa78d8ea99d870ce6e30ff70ee7a51e
MD5 d1ca3e12b84da024a00d1c8aa956e446
SHA1 80df576200c11747e032d7223d8cb74d9f15cef3
SHA512 59b055b2c1f2bcb0b272ce3ec088e08991849c7441d12017d83bb4b693719e97dba3736e39635d87fc805473bb57a336556607409ef7b58c1d1af203be665fe7
SSDEEP 12288:YSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:YSnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1DE5523697965F98BFB2B06F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9c0e94849a4301edd156aacda67da51361d0c583ffa8babb9518e1970d81f60a
MD5 93ec2d9458aa3abd46209e8e6518ee80
SHA1 bbdaaaeea09f121c0afed34e099307b3ddad044e
SHA512 f06de8750149810dbac6711fdaf65e9ad50fa322c3ca8a0dae9e77092f79954fe5caba9fbc365cb9d6a61ed086d75c0353e805a6626ddf03dddb985306124cba
SSDEEP 12288:YiZwbDzzFEoS2cPvyKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:bZM3zFVSOKnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1AC7501A5B39058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 596165ebf8b06c0cf8e4a97aec1c182824166092914931852a7cfcdeef691282
MD5 d3576b8e382d4528c09baf9b8d6aff5a
SHA1 8242fe502e98047743180fe5b449916797e37bd0
SHA512 d536bfb15346981e8648cfa9cde851b76bb0d30a0aa1610255ac2445b75a8de6c667e87612c8e8f7b08319396a0eb67aa97ecd3c77cff20e5ef40e85f8f2a5bb
SSDEEP 12288://GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:/fnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1625523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bf7830f79ad06c5b9a24ddacecad297bb5906df2387aab630ffcaf0ddfbd5697
MD5 e3af93bf709ffd525200e3b5ed49479d
SHA1 71ea77677e364e86e3c30b542803f83887a10557
SHA512 409a07c14c586a2335f529dc51f4aa5648ff7aab44c0445f30ad932c07bcb47309f8565ae87ef87196ba9b13fbfdd0664d3d06e71704404b01db150d5741b136
SSDEEP 12288:bLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:b7nQ/tbw/2Mkjy6Fr7g0on
TLSH
T1A65523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6a901e37861f37685cf182ccf82752b5ee2ded754461269adeb240a6054d8335
MD5 733cb91f1d945b45722bd38153b5ffc5
SHA1 a6b616f5d062d553140cd962f4f2c040cacad3b9
SHA512 4a52f6def4e407809f800e41974f820e0e1e74df3386e960651f15cde3a667c69b25e0dfa37dab423b834ad770cccfdb01791f467775d12d312025e5cac8c13d
SSDEEP 12288:GyPz5L8WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:7zy2nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T12665021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 776efa4495d110a25893e7bb2c1723b086b80188831af39e44f45fc51fbe0854
MD5 980221e408f7300b71219b73b81d7099
SHA1 b2a04aa80da2ed3f1ada259705517517554b4ead
SHA512 91f3a4be0c13c56142b644e6215cde777dcb300506fcd8a6764f42c588f1c71cc5a53ccb762b44d2ddad7ed74ea333b969ab4887c63fb1a68ba125a996d11980
SSDEEP 12288:T/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:TfnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B75523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 82710e4a118c8c9c4279f81b519e3a43bc55bfdbae36c2085080ee788e0e8903
MD5 f0aa361f42b0a3ea69e1702c65307bc6
SHA1 c8f6d719f79e9f4e7c7729dbd5b331170ae179e8
SHA512 b42e5ffc959c62c2331b02639194c610c542614e48ece8198b59665b97bf449b73a4291a9d968bff8f1e07d8f0f535bf472f2a1f594a6f220889ce425301d09a
SSDEEP 12288:M/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:MfnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1CF5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 737dedf6b87da9820810dbccc2b7a85577d52091228f745c41e58ce93af28c2b
MD5 798fe65e8e6a0514b558d6c069a06bd0
SHA1 ed936ed881e1ba4d0a53567c50565ceb860e81d3
SHA512 b8752f1fd16a0d2ffb9c849d42f59bb3616ad15f2902f48ef60ad6e9f11d8f1af3becc354d51c68a8ec191cf5ebff93dd1ff272a7ba2ba6cbf39ef80359135dd
SSDEEP 12288:zyPz5L8WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:+zy2nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T10265021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 284524bbcef99bfbfb312ff993f2d7c6daafacbb76d976b4d7c73e99e0aee115
MD5 6cb2adc11b39b316978a5122cbb1b31f
SHA1 85cbd2a643b96bd969a6c51131c730b2aa042eb2
SHA512 cb4acc2acd0acb97a657cbada35fcc6523001c8c9947990019bf6defece8b36c4dde836594af5f040d78aed4315032b5a937b5f0fcabccc25ca1ae36e3e50432
SSDEEP 24576:BT0aLl3z0zD4nQ/tbw/2Mkjy6Fr7g0ol:BTDLlj1Q/lFTjN4
TLSH
T17A7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e235bc3a4b3e6d3e964dd36f26374986135a02d25e2563ac7d50399fac67d3c4
MD5 ea8877aba800af80b0decaad8ef27f14
SHA1 635ec1058fadfb64d7bed3202686874122a7cd86
SHA512 6d9d9c2b15f3c72cd4d07a40274b4956608d709181508f0c64c1947408c3f562ab00c1655d392c10ba250596c362d1cffe823b073efc0aff505825f40a7a5c9a
SSDEEP 24576:931d9CHKy7GZsnQ/tbw/2Mkjy6Fr7g0oY:d1d9CHKyauQ/lFTjN4
TLSH
T16585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8b055a1d6a2c223e23792ed524816bdfe393600ef84c21a12aa77489b2cfeb5d
MD5 4831c5a899f6f3c8c4d5e3b49908d53d
SHA1 d0cc236d577057fb9bb5b4f187d6bb704a30fa0d
SHA512 d295c6ab806a84f01a20f83bef454354cf63b650581ebecde29c87464d0dfa0e8b43113e85dfa4af65ce2af6982a8c1ddb2a231bbfcfdb094945bde65acd3d9a
SSDEEP 12288:aIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:aInQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1005523697969F98BFA1706F14C838182973F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f2d9d6f399a4aaa8b1c1aa311a53d4376012680481886efbd09b0e261e7569eb
MD5 50e629ade5feead2b1ea8ba31a4f3a89
SHA1 0b7c5eb41168af81c9c2f6ce0d885ac5596f24cf
SHA512 3e76b06772bec95ca727a52e17af66f8006b8f05c2ba2400f06c45f6f56afbcebd4a386904ba3fa57452e6cf52124631d9b990ec3a16a7916a9daf288eccff6d
SSDEEP 12288:V2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:VWnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1A55523797964F89BFA2B06F14C828182A73F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bfaddb73aa6e5b213bce034e7cb53576d18d2b24b22baeb86a3d63287a4e9bec
MD5 2a4eef90dde4e53c8f7235cb8b9e086c
SHA1 672d62f8e7f6e19baebd78a19b4650338593177c
SHA512 56492c9f2da9fcb9ae9d218781a6d4f4bfd900a22db5ee9258cd10a6d5d5b4be36b8c48cd6ff70c94ba49256232bfa599aff5ae45e97ae2c69484f62b367ba54
SSDEEP 12288:T9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:TdnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1455523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 85f8979b485473101c3b78e7e659e41d8781eccb123cf546b7bcc6d31f88ffc9
MD5 96c0bb9c44680fd83d65f0c069a93030
SHA1 e7490487dbfdf5ae94d8d72e4ae92a974de1ddf1
SHA512 ae02fe4ed275dfbe0fdc3a22e1243a2975e067703fca1e5d26cd8228aa428397ae585474f3e35ec01f554f1ac6fe91f89ee8f74d53b12681b71b35b8bcfa4c3f
SSDEEP 12288:z/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:zfnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T16D5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b27b3b4467e60afe1abdde0ab44466d905fffccc9e2ad83e108823704c009c13
MD5 ba01f21b7538fb017c3fb042883895ab
SHA1 ec58059eb6698a7311c223ccb023f2a2d6c030e8
SHA512 66769268a24fa95e1fa53b80b067f3f39f9bb60661a5cc8f93b296a7b3e1e3d3094b6748a2cb668de423e6ffdc8ec2f3c0f9b2821592ee1ad09ac0953df61c4b
SSDEEP 12288:hIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:hInQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1D05523697965F88BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3fd9d30a4e354c364c13995583e553d3dd3d39c83142fa9edd80c4dc09a27827
MD5 cdd8a8d035a53504d248c8a61edce45a
SHA1 e580f0497e760fafb9766b4aba63b87486d42ab5
SHA512 bfc93369a66e27213ebafc138c2c4e37e1a0c473c9d3f2dce8bc2c2286ca6e4ebe0e26f730b2087bf1ec51aad7eb799ade873b411e6ab5120487defd58f73b18
SSDEEP 12288:MHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:MnnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1365523797964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2e12d09af53c37233a6c562d955cc58f9e311048436486acc51258dc8fc2fe02
MD5 8d717090fb08e6ff2efdf96f0d1f88f7
SHA1 67b9aaa7962eb46b3898b325c4f6aa372949e740
SHA512 20258541f07534c819ec373d624c8f06494069d58f4b18daa70b4ac14a75c7045d37f0a548654f5ecf1759d613624a3016a4b6ae5d999260be49a29e41f5a2c4
SSDEEP 12288:OpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:O5nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1FE5523697924F98BFA1706F14C8381829B7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9291c7090199d11cc4126d93ee8557be0f60b2d94ef26a47dc712dfff841bf8a
MD5 290928157a20b60a8e5f68606375f5b4
SHA1 9f00d0550bef22a06eef63738710887a14ea07ff
SHA512 ef635c15815d03eb694e1ae50aeceada04015b551ea7c1242daa7e2c4cd75c2abf2e4e0ffabf5e64fb7a6dbb3090a04beefbdd2747317a1f04c4035b4d6b4e6e
SSDEEP 24576:sfwv/k9RX6wkyAIrnQ/tbw/2Mkjy6Fr7g0oX:bMnYIrQ/lFTjN4
TLSH
T10385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b8bddcd09df60c841425d5284bc1d96b3b1678f304e29e79e71eda6ca58d9c90
MD5 50b6335b099a4da1c1ed9d15c01f292c
SHA1 35985abe9fd1a122f12af0703237c316d9dd7701
SHA512 7042e9bbee31ea446631f5e6b9ebd591a9988a09f31cc85dccee9b19dc271fa791b7b3e5920880356db4966cca09bb78ad84face823f40512928302de61d5403
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Q/lFTjN4:bySzPPLm
TLSH
T167066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bc63bfdfe4449266d665ada22a82b94d8e01aa7dc5d46a6fba65267e0923d066
MD5 4fe5093e4bd97dcaba8104a6b9df165b
SHA1 f2475f6350080e569e747785d7b0a1179906218f
SHA512 ae09b61653b1485e8fccdc4241b2e2c32479590bb233f57543d8550205b61da43e266f2f3ae330bd9fc6e4276cc862cb64f70f697f9f6daad158b54b2d6f6522
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY6nQ/tbw/2Mkjy6Fr7g0ok:z47JUQj1irIhCnDHUPfF/kQ/lFTjN4
TLSH
T15A65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2b86e00c0286ea0f99a9f6b81a8d5a6c718168ef04e13e1ea17b43ed9d61fa42
MD5 fe75c0a3225038250096f24e65102183
SHA1 346d6e8641af3f8beaa24c5907f6fa1cf911af1b
SHA512 1bb2356ad7e10079128485d1123697e5c8fb90dc6158760e9b27ceb8fb79347d7a6a56f1a67987d56ff695760a621daf1c9e581486c6528e4b4ab4677b96348b
SSDEEP 12288:sssfPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:ivnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1A965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2eccf2568b928d9026588d036ca7ae2851a4397c004df01f8fe344fd7f4a6e9f
MD5 9bf2d14e14004aef4b1c993695ca8736
SHA1 31cd635472f3087ea8b0938db0ec45e1432d3c98
SHA512 75cec99d45c3d4c391401097a2aedc79f03fc732f7a44e246fad19461b055c0d723386d1df34263ba99f87465af03747dbd7c1ce1f04633eaece966d3edd2664
SSDEEP 12288:4HWRAcOU3fS576avqiEHJRP/K9JIgEKxmRcPRstnjl:4H6AfUPGvqZRPYfEKxmKRstj
TLSH
T105351851766ADB5FC6A940325E33C2CCAB707D01EE056B0373C8973FD576668BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 52e8fa209084e1697b3494e17ac40ad5ad2b36c567bbb6b1999af351b5db1f4d
MD5 4d652b740c3ae7597b36ec71252db9df
SHA1 cc2ca7bae15e6fe273b42b71ca523bec76a5e987
SHA512 6494bccb13f88281100e81f5b97a3403a326d31776855f72648b5f23734f041e58600596fc54a70e73972ff459e7b4ee2d6c6bef5f5447af3ed4ec6ef25f1b2f
SSDEEP 24576:1PexZ1FyIVQkeN3rO9Ebi/Fn7PeODgyWTpzX:sgm7WN
TLSH
T1EB65D8815537E38FD4FA6072072A5B4CA7B4EC03B7055F26B388453AD866B66B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e5407389080adad9b419a3a701decff2e7bd5d3f0f7a96f01dfe8fbdb02ea431
MD5 71f5a0b56aea5618667f87e1793308fc
SHA1 2bfc11b6da025efc582144851cb29cae7ac919ba
SHA512 c9c800cf6f3c9f352f7c56e8c12b0dc6187370ded184780e8b6f7f1ee84323b5bb7965e25c6a90fca31ab889166de6c25be8db4c197311ac37ea74f220514a3d
SSDEEP 12288:w67XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:b3nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1F45523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 50582c98b96fab5ecd80da59d1fd8abb51ab7d2142cc9c0c19ef3602b7160c0f
MD5 b452cb5235053ffb5fe31213af88b0f3
SHA1 9e38876c54c0df1410d19625faab3d46c61f09ea
SHA512 11b7c3360049d5d83737120136f1b6bebfdc2478d8f2fb039155355d89528ab968a89f1c089382b98e783acddd5c15f1c300465a8ededd34887dd05b5de6e974
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY1nQ/tbw/2Mkjy6Fr7g0oc:/gb4mBIBhGF6Q/lFTjN4
TLSH
T14965AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c672352b2e108f842c68bc845740357faf506b6d795de2fe385bc80822ebeecf
MD5 4f7dbdace31a6e3880d8c6038c965f26
SHA1 2ae595518c8703a70efa8ec7e8891752524f2ec8
SHA512 14514b0b69c29a2f6a0c49e24d643f40877c369c52ed332a8c04b9e53f84b42b4ec32f8eb05578f52be7890c8bc817930afb74cc887a29c305070c2291807ce6
SSDEEP 24576:6G88u8FpJqH1Qzria7/mKnQ/tbw/2Mkjy6Fr7g0oy:B7ZFPqVva7/9Q/lFTjN4
TLSH
T13285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1cd466ba29b8e594780841acdb0902d9c025030050540bede85aa1b71a99e40f
MD5 f9b3dbd615dc5817bde8d6b9024c8a50
SHA1 42243f005427493d9a949e9993f2997f0a2daa87
SHA512 1a9d6c4cc8fe44be52f1e75984a18e9d144d8e4ca9e8c761dede9ebf961716fad867c690a79dc7e6e54eea71eaa53530261ad9c32ec16f226b21d3d5b0593410
SSDEEP 12288:UHvUrBFrEjwaQuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:UPUr+NQunQ/tbw/2Mkjy6Fr7g0o0
TLSH
T10665E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 16d3e89b36b2023ca3728483300e670f152417ece061c0db4ccbcb41b273e373
MD5 562a27eae817f343e0639d10f0b601b9
SHA1 3a902dd9416ed628a822453ab87a74445cdb4cea
SHA512 6b1d73d152f2d5d6b0b40e627b8da438bc9db9d530c291c181b41e9fa6dfbc95dbecdb76843385f0985940101ea4ef79f6a59a42e91874fc665600fce878bce2
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+Q/lFTjN4:ZG05lO43b4Lm
TLSH
T14AD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ba123a72c4d59a9fa93a072a4a54642d236ba10a18520fc24c7c985515a523fa
MD5 269c166ff7864374be753135bdb24ba7
SHA1 a1d9c1110b04ce9dde7c7cfa227b690ddb04d3df
SHA512 864efd84df35bd404991f068f54fa7f430edbc58ad6250e0ee0216ee95775f9af14d9c57aedf2d9627feebefd6dfe65a8991e3f816b48ec630a6e2e6f9cdc1ce
SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0nQ/tbw/2Mkjy6Fr7g0ov:ra5POZ3+Jt2pasx2+mWQ/lFTjN4
TLSH
T17B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4043ffcad80cd2ee49cd5757262bbf2358cc73164b0c7aec70918145aa7cacc7
MD5 72277bf77b11e2f70ae1b94aeb67f6bb
SHA1 730601a29313181e44a1fee794950f0d76a2c106
SHA512 4cbacf95509812e1d017c48fa516ce14a1d2ada4fb7345927fab03e7b7d1b67fa95456d00eb16e3217754542c25e4d756f9cd2cdd8d2a9fe5643d29518808f98
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkinQ/tbw/2Mkjy6Fr7g0oM:BNc/zEOVHFdQ/lFTjN4
TLSH
T1BD858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 31fb764801d6918d045b4aaa15570685902bb36a010f1ee02b0050f6b8089552
MD5 e19de4d68d6b9c63f33d933ef190647f
SHA1 0e8906745765238474246bd5d7287fabaccf073a
SHA512 b5487ced37626a01730e0cad233e88d1c2cb45f32212c2be270ce5e81a8585c70126f4f90296e78e80a1225d1cc5474b4c8638c1eb748aa40b5aad66d627e34c
SSDEEP 24576:z8kNvNnaFeYhJNtmZBmgnQ/tbw/2Mkjy6Fr7g0oR:z8MwBtOmgQ/lFTjN4
TLSH
T1EC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6aa2a0751f8aedfa953067f5c78e7c9ad22c78bb2f19ed1b1e52680b8edd3aa9
MD5 db2cf5d784686950ec241cd14e3d3daf
SHA1 91a610433f6c1052fcec2078581187b66571d168
SHA512 f12c1fd8c6738a5cab3633730e0907289fdca53ecdc3b61988e0de8b6df8ad638adf9108fd52f60d35219eb579565f820ae3575e3ce903b57ec5fb222ac67b33
SSDEEP 24576:6D3FHshBIYQgADnQ/tbw/2Mkjy6Fr7g0oh:6DVHeBIAADQ/lFTjN4
TLSH
T19F75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-98-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/424-8-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/424-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/424-1-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/424-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/800-82-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/800-77-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/800-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/800-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/980-45-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/980-59-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/980-37-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/980-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/980-61-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1184-119-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1184-113-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1184-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1184-111-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1628-405-0x0000024AB80F0000-0x0000024AB837B000-memory.dmp

Download

memory/1628-404-0x0000024AB8040000-0x0000024AB80EA000-memory.dmp

Download

memory/1628-326-0x0000024AB80F0000-0x0000024AB837B000-memory.dmp

Download

memory/1628-325-0x0000024AB8040000-0x0000024AB80EA000-memory.dmp

Download

memory/2496-310-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2496-100-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2496-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2496-106-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2496-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3900-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3900-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3900-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3900-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3944-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3944-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3944-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3944-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3944-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3944-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4084-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4084-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4084-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4084-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4092-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4092-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4092-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4816-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4816-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4816-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4816-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4816-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4832-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5996-49-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5996-57-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5996-50-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5996-298-0x0000000140000000-0x000000014017A000-memory.dmp

Download