c191dce7e842c28e2378257b67c9c6985d0f53e1b26914a552cbdf8df4892027

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 1.7MB
Sample260807-a3mfbaxydx
SHA256 c191dce7e842c28e2378257b67c9c6985d0f53e1b26914a552cbdf8df4892027
MD5 5ef4e214accab82322884ba263fe3645
SHA1 13fd3e4c23debdbfe64df6cdcf0395bc1c960311
SHA512 3033d9aca46b6d507247c4953880be1ee48b530e723ef92f66222f6ffed8f60cec058dd1565ffa113421696803e930717096a25d8c0463c55228b2bccca2f800
SSDEEP 24576:fsYmkmaME1Cb8NGHnQ/tbw/2Mkjy6Fr7g0o:EYdmaMgCNQ/lFTjN4
TLSH
T10985E02177D0E436D26231714AA3D3B166BEBC619E75438B3BC03B7D9E342D19A3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4584	elevation_service.exe
3372	elevation_service.exe
4452	maintenanceservice.exe
2268	OSE.EXE
1912	PerceptionSimulationService.exe
5428	perfhost.exe
240	ReFsDedupSvc.exe
4904	SensorDataService.exe
5920	ssh-agent.exe
4432	AgentService.exe
2504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a55078d683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4a2c5ed0526dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1ae23ed0526dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000846633ec0526dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000076916ed0526dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a79c122f0626dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffcf32ed0526dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2db162f0626dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaf75bed0526dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4432	AgentService.exe
Token: 33	2504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2504	SearchIndexer.exe
Token: SeDebugPrivilege	1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4584	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
1620	2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 6076	2504	SearchIndexer.exe	100
PID 2504 wrote to memory of 812	2504	SearchIndexer.exe	101
PID 2504 wrote to memory of 5808	2504	SearchIndexer.exe	102
PID 2504 wrote to memory of 1932	2504	SearchIndexer.exe	103
PID 2504 wrote to memory of 3208	2504	SearchIndexer.exe	107
PID 2504 wrote to memory of 5984	2504	SearchIndexer.exe	108
PID 2504 wrote to memory of 4752	2504	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_5ef4e214accab82322884ba263fe3645_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1620 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1652 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1652 1648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1620 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1d8065ea8b1a5cda7f08b3b697215a98fd46f280e54acc8f30dae4064c15bd1
MD5 c1d2586a853b82685e23fc1b4aebd1f4
SHA1 8cd5a3a692490f68f9ff3c4a7399f684daa71c20
SHA512 dd2aab23fc8c8d12d0fa01580e005355c5477f36c2131961c519955f0179ccf970be9cae6ac3fc1b2938ff1b5efb6738ce6ad842f57d61b1be66bafce4ca22d0
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXQ/lFTjN4:H3q6HjBnLm
TLSH
T17BD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3367a1984ccf347925db2c7cf8d8acb4ab1d35ef19d8a20017174b63fc543f34
MD5 20465fddd530728896965860b71115ce
SHA1 c58495585f426fb6dfe1b4388fc5bb6742c60d73
SHA512 0fdcf32f0e1dddd765ee728883a91d580023a2b36fb5af534ff05725a2ffb6ccba2191c62c82ef5b343c49e4998939a90ec42e3cb64f98c7785eea7a3f087a8e
SSDEEP 12288:d1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TXYfDtczAQnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19D75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 eee81d70dccffd7db4ce1b7a8e748a949c0cfd7fe140e96aa58ce64ccfb29f49
MD5 fefd0c065baf08e11ff8618d72d0af3b
SHA1 fe498b8acb26fffd2cbbe169ae7d38ca9b884d2d
SHA512 61c7018073bafda4f238875e0d8d55f4372b0cfe6deb61aa71c7acc20f11d2ac4c946287525c8c808965e2a5607e8eb107989d7042e0efbb43420a8b6d598073
SSDEEP 24576:y0Le5ji0hmxmrM/nQ/tbw/2Mkjy6Fr7g0o:yPji0Ao6Q/lFTjN4
TLSH
T1D5959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 92afca7328177c8a76519acec23451d7b969a71f00433feee2331b8627ff8ba7
MD5 3917e74c258586dc15d45723dfa7a4b9
SHA1 3d081364bcb0487316f1da13b735a3604711337e
SHA512 9873a8c8481ab30988d2dd50ee02c0fe56148fde3ba9f1358fba3ac6565348fda2ece548dd765fce353a8e4a3d486871fac349923185f970dae0a5ea1d67d868
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuFnQ/tbw/2Mkjy6Fr7g0o:1/ezSC6vUzPvxHjyGQ/lFTjN4
TLSH
T181755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 405dde8e7b57397bb6e99d114a160836e9383de1fe9dfa6afa997bdc4fab522c
MD5 30c4024ba71c4c285b11e39a0d67195f
SHA1 d18596cf40a11d0834b68c377ab45a6d237e79c2
SHA512 dd66d55e8e0ed1a0ce39ef46a8937b37bb541bb94e5be805491deed907bc5abf2b5d419f18633ae6f81f842a813ea729efa746ff87c784a9e4419b191c91ba77
SSDEEP 24576:RVbqPb88hv/l+6knQ/tbw/2Mkjy6Fr7g0o:RVO88hXl+rQ/lFTjN4
TLSH
T128559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1ea1fb4a3fd4656c09ade28550244464ebddcd19fd5ba6a77de3dd3a6c8d2b50
MD5 4e3d680c8e7b3f1ff1b6a4f636760591
SHA1 0ea2bc22ec4bb7483d2614afa0e22abdbec7a937
SHA512 ad866cf2c64156629089e4ab247b3be6d64d8524613def2a13ed5a212d960bcaea5e9348c9400778e884b8e8aedc2207606afbf4437f732e81d72376e79f171d
SSDEEP 12288:/9zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/9jnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F55523696A24F887FB2B06F15CC38582AB7B0DC1AFD4A74E6744322DC53C39486DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 cbd6a9c908bffebe3f0a9790d21f05651290dfd69cf4d282ebab418fd1c45b7b
MD5 5576f5a55ac758538ba52573ab38e351
SHA1 5138146f8cd2b81da64b2ce59b8d4e9dc8957058
SHA512 66d48b0af4a742cfa74bfd8105fc2134380fe91c3f17eea1558958112002965d2424e06dfa4b493c44b2ffbf29d81840cd50501dc83900116d38c140e809c0ca
SSDEEP 12288:oeBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:oJIUsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11775CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 20a703a26fb1086ed51d21b41c1cfdd8f97ba70a2ef727881a7bb0d32014879b
MD5 14654e25e319cca4e369def40a6d1d7a
SHA1 e00d55a0272bcdb341c94af4248dfdabce609d2d
SHA512 8525a5bbfc5a618bfd79631be2ad13f3f3be14df93ca9917bbe27c3bf611012e91a06606567fedce7ffd0005e70b1041e9eeab224711b20285f0bcbe3add02f4
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:lQvGAdlCEL8c/yRNw5CaLm
TLSH
T191267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5f47de76c8f539cfb774d77ab2d5941a7ec690272687ce9b6a23e5c546788134
MD5 44d7d4363b09aeaa3627852b2c14e29d
SHA1 9afc3dcc50aac9a7a61ee1c41a5ece66381cea88
SHA512 1e258480d149c765bac0e8dcf88fbd9474428b83913e9e763a6b5ce4f0417d723da23dc37389a2fc2334600c7f11386eac7e750b2ddee168ad625cdd49054e9d
SSDEEP 12288:NAwSfxL/2Dc3kDLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:+5ewsAjqnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18F85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c710229795ceef8e74092f4c057b26d1804fd47da6f88d55383bdb6869a8577
MD5 69948fda7fd1b257ba291c2291586174
SHA1 bb7d3fe272a52d1f3308d60197db6fc44708d093
SHA512 8ca1b904c4127877e49bea9d1ee20e50be6b0ea743c48b54bcbf8d9368b9e378d50ef325add3f6122f70d092b34b006ad0704f5be919aea71d17508cda044593
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNL:YUEtQevvqc2W1cpV2EI32
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03ff33b184b8d4a9bef90ea09a1e24cc74c23cf1f163686d87b95b6e296392ce
MD5 d84615e20c047ff11c8947ea5a835a4b
SHA1 97475e57f74afc75bce30afd02fdf4f35b37d996
SHA512 e78105d196f5142191ab679262831ac3a1524d755f153d7254576f68ce0811903ecfefa8995c65dc32c7f92b38a808c2f654daea04ea8d11ce172aecddf60ceb
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zKQ/lFTjN4:woqtVjnmmLm
TLSH
T19AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a2d301b334b5b3e2f7f3e0eeb4cd714e4404e871fc0167fe57cbad48f6e9c09a
MD5 c1a84adaf3606f4446b640a859b79df6
SHA1 df2d9ededd6745f986684d525d6129685ce0bb9c
SHA512 93728dc555198b41990623351d1f0ea82de58cbd657a5225671cca1150cd65248a695d04760d5fd9e45b27b7cd3e1a5d9ea6259688f5b6072a4f1fb7221fd187
SSDEEP 24576:1AhGLJIFoiwtA5l7S53hnQ/tbw/2Mkjy6Fr7g0o:1AMyFoiq5xQ/lFTjN4
TLSH
T11235AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 63d49c69e2c9d7e534ab285c6483db5ec496411e2740cf964d9b9870b671a91c
MD5 1c2fa86bf88465146f83d1b9d5131bef
SHA1 881692f79fbd8947c9ac88e58a5d159e72039b5e
SHA512 dafa1552553915ec539b5f1312edefa81e4235e9f1395aee88940806f6af43dda47b41b38d968ca7ea2d08b462f9269f0d3e7be48c37ccd4cc89f3b8b143cf38
SSDEEP 12288:Zmw5HEjsChNZBFgl0WDm+CFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0wu0OWmnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14675F14936A41CFAEA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 f58d274a7c0c7872f49ff9c13d8c479099746e2850e88b506cfb24c7d9301d5d
MD5 92ed5e45f7a4e14a9dbc33ab1b3a960a
SHA1 810610f9871b2d2b4f0c5ab3ba39fe1c87613552
SHA512 982574b560acc2814fd24877527fc5ebb2774a1e4c63cd384684070f21690ea4e876d47e6cab231528cebb993dc308996e3319590000d0bcb76808d5a4f68dbe
SSDEEP 12288:C1Z1IyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IZuHnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B265126933A470FAE6674278CCE28646E77338926BB193CF275442695F3B7C01E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d7271154ee8bebe603bc09e0f877bd416f998c522d8aed8b979fb56282d51724
MD5 33cb46d4ce38091e419b6763c590b3ba
SHA1 feb39dba613bcd2e9e5811adb8fea5c58fd41f93
SHA512 068777fd9df37249175857b46e586aba748c5ef15bf50e8c9efa3b476565cfef3ca987d207e8f7ee0908556a5c5c5911a66afbf8d1d00e842d46c32f61f98d32
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:VQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T1BA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 05619a27c815fe2a0f06b7c7593b0058a979e5833fb132ee20c180ddffc8202c
MD5 53e4bdbd178b6423ac725bf4bead812e
SHA1 5028e06625d6df9cca28a6186533328db187ade6
SHA512 9cd08ae512fbcc35d150e95436ad2a2c1392a57e95d545ffa9fa47838e63650e937052498719a9bb8ec34d5216941644b8b1568ec480535eaf6e7fd8ae447c9c
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:RQRQyi36YOcPQLvw2gAf+PN3bLm
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 40d88152e76d8747607895d26cfcc7f52376fdd64b58f5f0bae68f94697641c1
MD5 d0785611fe9e7d1bf1596038588d16a6
SHA1 1cee14f65c5bb5b5c85cce03d614e8e5f96d989e
SHA512 35b6ec8a5c46c7133783c763f97d58a59ff8acb9a4e2bc3cb377170431c76f77f4773cfd9808d5d05f65521605ac83c1fb60357032ecf66b8747e37544c881d9
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0XnQ/tbw/2Mkjy6C:J68Qg55nhheWu7PNU3/6Q/lFTjN4
TLSH
T191B55A33B2F60099C44DE1769F46872196E27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0053f6120e303c03924d297eb4871444e6a4d8460d415d7d9823dbd000261c82
MD5 8385570be508a218fd207343ed7493fa
SHA1 28d65624e50d954e5752017ad4c38bf452aa7711
SHA512 cf8657aa5b32ab579ef05aa4c17fcb074c31f0418aee300103af3f400c9f951a6b33663be53f26521fe5cadfe35304a166997f7d317b507551591c9422373445
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:Hy5112gYy5azzVvL69nLKnhZILm
TLSH
T15A167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 002980d7e5289a32fb237c3b248c9599d25757731b70d125aedbe10d82d32427
MD5 ecbb2ff69a999880ea04202ae2553ebc
SHA1 4ae3762785c121c5d49b6440145fb7161a238e8a
SHA512 1da1ef3fd00409908daadc7858ec03140e759c6854543ebc6837ee788cf592c760f5536d1fd9c57b8b6b0277f3bb84fc8c38a814d06db17a0829f5a17e2ab6bc
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:Fu6JmVxd2dzLm
TLSH
T109D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 640f3a14eae127fbb99c74955f7fe74d1ab4fe949c43bc58c44cdd7fadd219fc
MD5 0c182323dcee738bdd277baa58c72fad
SHA1 0a52610d4a55c7a16d7f82bc170ebf8310d7a465
SHA512 050d8d4f9941dbb2dcd00ea9672ca42580192f5cd45abbf914577b8d3a1e15965ba6826b487c2a473ffe42f57c5f5e62625ba550da07b7ff34335391ee45e5c6
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:lmifPbRmLm
TLSH
T18AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ea1cd0402179512cbc41ef9e0343fd330b07cdf02acda35626db169d5bf77352
MD5 c592a0edd890c80a4e71732664d07bdb
SHA1 f76de954e3c28bff4172c5c7d905fd3fc56829bc
SHA512 c60fc72056bc443ea2c3e3f36fb495d74805d139b2e5df83e95008ec202df0e8beb7277fbde44d457edf9ae1dea6f377c7556187c23a28c214fc00e3bfba4819
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqHQ/lFTjN4:Z5dKTi61sLm
TLSH
T1C5C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b455d4dbe6c8127ea9a4e8c965dd93e4de8f705a605371a6591800d7da8e74b1
MD5 7e7599945c92cdca2b6461295c52eb64
SHA1 eb90a7f2b8404278051422cfbef3dbc31cac462f
SHA512 a2a011919ef636dd08358e73c27753bbbdefb666689b236ee1c524bb53e063f3ba32d6d99d0ec77a23f8207634273b2736d60a6c5b4d0c859eb7cbf3830a1545
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wQQ/lFTjN4:TX2iyphCLm
TLSH
T15995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 2f678ddcb65ac8c17d5655c543fab978b6586f59b94b9be9a388ed97c2033a57
MD5 3609ea7e984a39b531ccd47e34160f69
SHA1 f59e637bdc2e30cebabc1441512338781d0f5074
SHA512 8420a34b3b16c0040c4a3f392da87de085629514c53e78120ff7fbd727496a0b1d9de9fcaf7849219f6e540c155f930429f45d512bd080305387318936e5766e
SSDEEP 12288:07GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0rnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1545523686958F98BFB1706F188838182A77F0DC6BFD1A38E77482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 122ca225dab6b4d35b0b6ec4c07462dcee1e7c119e4218b69a165cbe11a130bb
MD5 b3a27eb30da4ee29b5b363a40bdbf4e9
SHA1 3abd5541f9bce22582bb937aedbf3dd474f049d3
SHA512 460eba6e3bb0dfac5f389df0f569f3a3be895ea60011ca9618e01d3b4a1ade19cd7bf6f0c47263bbc86d0e3cb80de1a32513b753a02c225c61dc4b0b89522e1c
SSDEEP 12288:O+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:O+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CB5523683965F98BFA1706F188838182A77B0DC6BFD1A38E77482129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 29147866d649e0fa43b7b288297ecbe47653b7c673c94b7fc155e894a11de5c4
MD5 0ec4c1fcdf762eac957b66ae5ae44c69
SHA1 93246b98429875c55d2de33c4bd56e5d5fa88f29
SHA512 0e0a0cfa5483a1146524b88cf2bef9f3c1fbba2b04288699830b86d4040cfc21ba7079c1cd6f91115511a7de9a3a0a3b91545c4340677871cccb5ddbcd9c06d4
SSDEEP 12288:1UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:10nQ/tbw/2Mkjy6Fr7g0o
TLSH
T10A5523687965F98BFA1706F188838182A77B0DC6BFD1A38E77482128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6e2a82a4b5aaf16b183bf82b9a80cdf4f4f24231e141dc7a6155b223af4b4883
MD5 535d7b965c2b055ddc6c8336e32ff286
SHA1 69ce483ec2427159e100b20c488def56477ad244
SHA512 f5c10285153c54cfb6fb1088cbf5e139a6c68950ca164ef0a5998e4a64473f48fa76338bb6ef4c24270c136c83b26f1df2cfc1071c99d3861906d3126356c259
SSDEEP 12288:iVxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T10C5523693669B4C7F92742F5CC938142F7BB3CC5BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 80cc1ed95647d7be15e82bc54bfcfa87da1578d947b3cb9ed2a570fd375e8ba0
MD5 57e5b2fcf307cfb8260e3b930a0c3892
SHA1 c35ba5e655fbcb64880ed39f0c6125b008a08ab4
SHA512 c343cae65016640a6d65275e22d237d6a13ff61f9c070e4038073af521fb2c66adef9e6b227f858038e429ec635e3260360f6be4e2bc7584f9a1fb8295615f9e
SSDEEP 12288:OpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:O5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T19D5523687565F98BFA1706F188838182AB7B0DC6BFD1A38E77482128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 65c711b0ad2c57063e15eea2d90bdf058e5fc31b67b33272de8a175fd946e833
MD5 7348670e72005e05ecb1dc9c1dd04537
SHA1 64304f55643984587ee159e42c82b9d28eb68431
SHA512 5d15c251ac8e3c037744a9ba15e959749b292980aaedfbd2889d41abe6e3da45f04942b2159eb3f13ece725423990bdb288f79ea02a23b29a91395dd07f3b5ba
SSDEEP 12288:SyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:SynQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D65523687965F98BFA1706F18C828182A77B0DC6BFD1A38E77482129D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 81159726b34114722643fdc761cedda83df687c561cb43ef85fddbfd906baaf3
MD5 8e0a25d9aa1a677735e066d04436dfa8
SHA1 11737b8b134891a875a2bdcf0ee682e8c9fabea8
SHA512 d2a0705a3e7efc63caab165c9ff17ec122b48398a1d791c58b01cc369e3e5be8bbd20e4675c5b6617bbcdf7e25f9d6c71fb0f32edf345b3991ba889f04733828
SSDEEP 12288:GWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:G2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1335523686964F98BFB1706F188828181AB7F0DC6BFD1A38E7B481129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 46469e8336dc21ede570e1c4a0ff235bbac8fa335324700f29a028c8a7d58850
MD5 7b39af068c0e833487b29ce82aebe070
SHA1 082a82b3f12077a6c2561a6b2d834dd5792241c4
SHA512 99058fe55b68b11a4837b669820e8461190c7806e0bd3031da958ec65440609f77f21a76eccef4f153e932593ce4758757e54c58032642c907853d5c93fe34b9
SSDEEP 12288:uiZwb2zzFEoS2cPvyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:RZM2zFVSOenQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C77501A4B35058F9ED67827ECC528906D6B27C5A1BB0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 441f6613fb415360c89fecade9cb275e5d2fabcec6cfc3eceee7b5507c5a5121
MD5 1aa8c83721abbf79dae660a868b2bbfc
SHA1 ea3f17a82a058d9951b2dfb7cc8965995136792f
SHA512 68c021c7c9e873ab954bda55318b38513dee55bd2b31d07d61ee026c27cc15ea1520a0f39e0f833adf1239eee917df9fcd1b8ad9ced56ef301890107a0a2a310
SSDEEP 12288:ZXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Z3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T11E5523687565F98BFA1706F188838182AB7F0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 b0ca4eb97e11255c7cace6b2f4d0a5d5122f4eb4cfc82c372e7adba4e178eb12
MD5 c8b0aeaa677a71acf3a7a29c8ee381b9
SHA1 1a1c2f4c723f469400ae984b9996c5614553caae
SHA512 e77365da83e4f2c10c42f19f21858155981e067351d5e8137891d7735972c661e5bb2d535df6153a78fa4da359b76fd449efeb4b1fcdf6e52f0e3271999edf26
SSDEEP 12288:sjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:sTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1815523687564F98BFA1706F188828182AB7F0DC6BFD1A38E7B481129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 711230a7bae35244f7075a47d4fc802b05d6b4577a8ec58b5b6db49aefe8d064
MD5 84b907fdf69905d0c7a8865c5c71c0cc
SHA1 d2d2225e9ae18dcacdbe10c375a2507994080f64
SHA512 26bf973591d64c4c3c469ee698259822e550fffe6a17e1c2f8cfd874466264deca938ef76841244cfbda66e5fea32ac471c9c147cb1c85b84a822c47ea1b4a98
SSDEEP 12288:jyPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:OzyanQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F365021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 841f30b1d58ef01bf13a5cc7f5d3f8352c59e9680443502d9d804950606bfe7c
MD5 9572711937889bcbf03bab94c70b4a41
SHA1 75019f3a81dac204a733f2f999f73bfd70cbe32e
SHA512 096e576105f3d170fda200d97bd00065761572cfe9256df0bcfc0ea0fc1d058f03904d7d3aa8c40c542ce90caa4484a83107fbaaf878ec6801c0f44199fa2843
SSDEEP 12288:sXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:s3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T10A5523687565F98BFA1706F588838182AB7E0DC6BFD1A38E77482128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d6512bbda0f70690aa84e2922c805f8246899253a98816d8fbabd65c67876ae9
MD5 c476c7916fb6d8aea57cd63fab9d7a31
SHA1 cca73e09d0dd6acc7cf6dc0f3a32be8c115fe66d
SHA512 e5504892b418ca3129965f2950774d4b3d7d20b04a1f2b9eb1a4ed233daa737034b3dff0d239d56b295053c3920e8a932b227e83d6a41dcafd600da4c15556e0
SSDEEP 12288:VXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:V3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1575523687565F98BFA1706F588828182AB7F0DC6BFD1A38E7B481128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 8ff38df04e19e8adad7921a9a8de8f8b07ca549fb87941514af2b33fbd053658
MD5 99b9348ad1b6e00fcc62626d3f31ca0f
SHA1 9042ccc27216582e0d7e761f5f34c3097f39376a
SHA512 cb2e96b8128ed2b5cd18c0abf6429b75ac0faf43d6c0ea02b357e4c79b8db2c9d9f413c9496d902ce93c0d52206d58e03e372973b6134d4bb02ec3fccaa40c92
SSDEEP 12288:PyPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:izyanQ/tbw/2Mkjy6Fr7g0o
TLSH
T11665021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ae242de8112d03e8322ab2b7bca6600f03d39f5043c5e0b6c146140f99a46063
MD5 857415832aece1fa2f039b855f3c75f4
SHA1 840832c8e65753c9054a2f96bf396bbe2cd96f69
SHA512 ce23e8949b38d0ea7f829de8ee0102f9be8241841fc511889766e707a632c5c90dca7ddb13fc384c15b198de49679a0fe40c95dc40640eb041c2e442be258d10
SSDEEP 12288:jCd9CWYoaLHF3z0z04PDvhkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:OTDaLl3z0zDEnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14A7502A4B35058F9ED67427ECC528906D7B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 3e94ddd95194a9030e7517c2a558f364d8ffb7866df0a85b1b71d35a1f02aaed
MD5 3dd807bde935501a8af8418ba1f39653
SHA1 3c579e04dbe0d5d671e45059a18408c6c3914b34
SHA512 79d2ebaa982b5d0155c1293247b7369474f0d45ec2ce5e5053a30835665655b75bb1a72f3445a95c1abf196d5d170b145d43f17601efcc57e6a42bfc8304397b
SSDEEP 24576:s3Hd9CHKy7GZYnQ/tbw/2Mkjy6Fr7g0o:WHd9CHKyaiQ/lFTjN4
TLSH
T15885CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 bc297299f58d080182f837b4bc88e543d5941558c970e6ec6b3948b5ff2d5d06
MD5 649e4d389b6ec32f9bde22845ab1c80f
SHA1 2c4931469435b34eaca847990009a5684c8fc4b4
SHA512 07222fd8196aa4cceb57138f8a5593952a552fecfb40d3880fc3da293f3e80ddc2af089a99fca1dd1e582d985248189c2997fbf1d632da9fabffda74f806d227
SSDEEP 12288:U0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:UUnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F55523687565F98BFA1706F188838182A77B0DC6BFD1A38E77482128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 0e4b0c04e5d8582c0326136b6b37f702fbd6bec38c47558a2805e6529e9e15b5
MD5 0a5839d56bdf1a87632778eaafd72feb
SHA1 a17c86fbbf642b1b27f4cca619c17a0b903d33b2
SHA512 7784d26b3c0ee5519628be0653e36b8e1886f78515861799f35d12228d5f09592b3aaded4661d2dac04c3d35520cd7c8362bfdcd8af798c33033824a9dbfe236
SSDEEP 12288:P6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:P6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T12F5523787964F99BFA1B06F148838182AB7F0DC6BFD1A38E77481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 8459b8ebb1923ee7aa84b03d97deef9fbb3b393e05776d2d0b7c4c4924967b5c
MD5 cb8131a2c684ed8c53b33b62abae36f0
SHA1 57a31bff87be77c585cd7ef4fcc07c66e8dd88f6
SHA512 6c58e031e04bdc232a444c3bc6e18f28d2eb0d6141be8a4e67baf0eee93dee297c8f5d2968fd4c8a1c219ff5d0e927936279f64354461e186624f17bf424219c
SSDEEP 12288:odGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:o9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1935523687569F98BFA1706F188838182AB7B0DC6BFD1A38E77481128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c6c7578f41229d11aa98ec150dbddf30830667d91f38f0dc931cb6a84324f462
MD5 0470e6cea57fc0ce4b2eeac3d97962bd
SHA1 4531a5f19df4a172f79246c1976650487ec5837f
SHA512 7e300fe76f31159faf34b58026945c2fb3772e794ef9e8e8e0e3fba0a250df3f64326b1ea7202a820d98411f7cbf8f906c55a0c86b9a13f3a7908be919b0b440
SSDEEP 12288:pXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:p3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DD5523687565F98BFA1706F588838182AB7B0DC6BFD1A38E7B481128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 048e3828d241dfca26801aa008dada6ed595a90be16d7aa898e2049d2be855a2
MD5 2bf2fc0df74d389bf87ccfd5b2ecde15
SHA1 01595b7ec1e032302ce90ec389a8b0fd38d74e64
SHA512 30a254b501e4d81dbba0ada01fa9d25658cb444270fdca06a1327f6bed38e1311336961f1a5599d7858ee8dec5e42fb8aad6f25e05520f452bc73717f5ec70b2
SSDEEP 12288:+0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+UnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1445523687565F98BFA1706F188838182AB7B0DC6BFD1A38E77482128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 6d6e3e48c659069ddaef22be55bb666f25696fd35848adea53350c1f488f7d45
MD5 1ea6361aa30766817e87af0aa522d4f8
SHA1 0110d66d96fec80aeaf99d07556427f1062db5cb
SHA512 ddd7f98e6d89830461d0d3289e9aff5a7a4c611879bc37a387abb291301675582ad8367b19e3c69013595a256754204968fda8a207bb8ce2e35773fcc63ae3a0
SSDEEP 12288:NvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:NPnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1985523687965F98BFA1706F188C38182AB7E0DC6BFD1A38E7B481129D67D39405CF784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 32041a9fee053ea4fbf0c3d3531c4c0ce29068536f985a505987ac9582348bcb
MD5 a208082637e5f22daec6cd45e22b4298
SHA1 dad3ef51687002c6edaecc1d6884063c2785f0c2
SHA512 b58275e741899011f25bbe25fc0c8565902ed1e1c6ae51a105cd201c566bd7b1d3a5df8fe4cb4c0d7d80789760e43b310ea70d62a6d0c3528bd4935cf0c78aed
SSDEEP 12288:spGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:s5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T12A5523687565F98BFA1706F188838182AB7B0DC6BFD1A38E77482128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 e2d2da0b6999a70e1ace7182ed85124af72e0f9ca49b42b167b63b5984239216
MD5 1586238d7bca9b985cd501aa2c8055bc
SHA1 8c4053747b82372c0ee98dfc1852ba9b8ccb3d74
SHA512 78dfd8acb83f2a857939c49f6f431c7d1e343c54408a8a4354d351617022f72b19a0d329837a016d4027a53ff7a94542dee7c1aca20b365536c98ff2d5672bed
SSDEEP 24576:sfwvZk9RX6wkyAIDnQ/tbw/2Mkjy6Fr7g0o:lMnYIDQ/lFTjN4
TLSH
T1C485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1e6462eaaed62e534b30faa53c9b40ec9ead3b768abab91c0ce34521d20b25f0
MD5 efbfee82b22a3ca7c1df791c38d49ead
SHA1 6ad061e4d85f6c635328ad27b5056319f57c0fe2
SHA512 b072b00045d6aa203b3708e605f18a02d3ad7f964063ffbc1104454ec3da1bc18de948645e7dbd742f308a649accd69b87bc12b0f815046ff1b883a7a4d800aa
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:7ySzP7Lm
TLSH
T109066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0c2a51efb071e9e4bb7d1f39fef5a02a43f1a3e9e02ede6eefccfe5d9201820c
MD5 e6fb73eb1b866e1657dd8729edec271f
SHA1 0d388fe3bfce5788b39391a1ae0748b6729f3eca
SHA512 9c26a2b5259cda7c8e6635c0f0043b9d4c7e3c57f924e10cb460cdab996dc36a87a13eb1b5ef90255d0bdf28ea24861eac1f5db2758c8b944f0e131531468c8f
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOnQ/tbw/2Mkjy6Fr7g0o:z47JUQj1irIhCnDHUPfF/gQ/lFTjN4
TLSH
T10265AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 712c114ce7685bc2272a58374e12c1342b6f9770e4e62664fe81a43d9851d7ff
MD5 16eeeca4625a1f074e513279a99929d2
SHA1 9920679cec697c5c1a6c5f4e4accf3b649812d80
SHA512 b8864832703505582ee36b70439b016e67aa91b15993734423a8eb0c033783e2b98bedd522c5c3ba21725c0754c91f0005c5594ecc3ac45e279922c8b418f8f9
SSDEEP 12288:JRsfnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:SHnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CF65F119D29852E9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5a192a6312431fac0d606ae3347a5be4cb716dfe8bfa339f9cad264c21d00679
MD5 b13f26f2f522432ac122b80184947d7a
SHA1 11a1152a27c4c84864aa2f0271ff8e2ef87027ed
SHA512 a32bb66d8ece16195dcaa6a113ad917c2bcf52b36eaaa4403771bc8d6c9f26b53c6cfb878ef5dbb12c895af824e1af203110d1fc14e0d4dc36dac584e6dc5bd1
SSDEEP 12288:MNqUU3fhMmxUi7msDnFPTdq08Cp6bJGeLFZo4Ni:MNHUP1xUi7msDnFZFnyJGeBZoB
TLSH
T1D3251700766AD75FC6AD90321E36D5CCA7707D41EE05AB0373C9873EC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b891ebfa821ecf32cbb46f9ba988ea48206204df6d00be0f9ffe0f67381972f3
MD5 d2b4f3d307963fa6b69fbed03f7e30c0
SHA1 27cdc19aae51a9b477db8a22fb6b717e616e68e0
SHA512 333d8e446319f0e98f9d92e7fc5698cc404020a9d743b87f13ec8b94beec4f3c45208d21554163ff9ab5d1c6d3a2a94579b4ae15428a065f3b6d434dd9f1d3fd
SSDEEP 24576:BBUi7msDnh9Ui7msDndNUi7msDnLHUi7msDn2jUi7msDnBMUi7msDnfGsASYshHy:3Ui7msDnbUi7msDnnUi7msDnbUi7msDK
TLSH
T17F65D6815437A38FD1FB6032072A6B4CA764EC4773056F26B7C8453AD82BB25B1B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 cab0bae5c7143e2278d2bb804a5e70612f073e4792da714baf2624b2f44228b5
MD5 4b264f3277fcb78a8a8e743a15fac980
SHA1 61b724e5f9b036f0b3bea1d812d806edf09ba322
SHA512 ef482b7ea89eb2c5529da740a8bfaca5c989ee4665ee10115703d48cb4c841a95962bef3038d8ce0f372cccfacbaffb44e57ce72ff793334c03ac081f3089827
SSDEEP 12288:Yo7/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:9fnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C65523696668F94BFA3B06F048838111773F1DC5AF9093CFBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 da02bcf761fabd561b566860e248f5c324f17a387475d0229bf9ee2e5236fe16
MD5 bfac2780f2019f7d3d5b9120648d2d8d
SHA1 deb42cd8a8acea59a558fb3205908d255e042bd9
SHA512 20d99d01941b8d17584d683d2b840c9a26ea29f6e099b15b0e24c4a4fd41cb21797445c3de39ff5cc7c7a5d0723ae42e8d3f5db1c3d7d14a68034f66ae3fbdca
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYFnQ/tbw/2Mkjy6Fr7g0o:Ogb4mBIBhGFOQ/lFTjN4
TLSH
T14465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7208dce47f83fa961765579d82a4adef56e7b8b5641e279bde276bab4e744232
MD5 80ff3e8cb1d678aaf86e00185b9e1815
SHA1 502997040a56c2b718d5d1104355981ec1cb9a92
SHA512 b307873c388bb4ba1a05b14909672c93789c0df25e493e79e0d724eb1491929bd1d15bc05a25b769555bfbf8313eb188997d1aa870322bfad9ee35eb7a5b17b2
SSDEEP 24576:dG88u8FpJqH1Hzria7/menQ/tbw/2Mkjy6Fr7g0o:w7ZFPqVaa7/dQ/lFTjN4
TLSH
T13E95F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 90ff78e6f8ce1cf6d4b17d032f3f96a0ca29d076c2b48a18ecf5b2eef5d31292
MD5 59d5d63d4e486d555fb9e64c2f54ef72
SHA1 137b79ad52883852f0727f2e2f221864c1079ce2
SHA512 03eed584281d5583aadb115885e906b38d5517921ef3ffebd1d55f967f4591d0fa6b18f5ada556bdfbb281f6c0951389e80dedda6593e690ac35054176ebc570
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyQ/lFTjN4:aG05lO43bQLm
TLSH
T1E9D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ec5077a72d4beb73641b2d11c1291f8e68625ef5282fba4ce3d1959832b2b94f
MD5 84ba0f14de4c475884e6222a581097c0
SHA1 53627235d239cc9203045f65aea19d065282caee
SHA512 f970fc2b1b0a8c00665f6b20cfdddcaf83c82b0135d57b772203a151379b62049349b6c3caba74e651ac4593c021a01546f859f43a3409ab088c6ec2d54ee597
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0o:ba5POZ3+Jt2pasx2+m6Q/lFTjN4
TLSH
T18C65AE5EA6F801D5E579D17DC583860AF5B1342253319BCB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6be041f9aa85dbc7a63ad3e9912514e5594485c59356632b3d4cd55513e6e7de
MD5 a1cf1aed1555cdf0a4019ecdda206647
SHA1 aa33459ba9b0f8e6debf3fef8aaa70fcc6247ccb
SHA512 1b4df744f67794cba5b51c89c9ac173d0e89b7c3693e0aa0aef9cd59ccffdcd4f8fcea5a2d3ce9d6b0d1df4d2bbcfd04209b353983fb186898f7cfb49432362b
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkGnQ/tbw/2Mkjy6Fr7g0o:aNc/zEOVHF9Q/lFTjN4
TLSH
T11E858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0f74103c73eb32e89d313a3dc955e4aee948cbe589d8ed5d57455f4be69564e3
MD5 344174510ffc6f925a1c76005e31a451
SHA1 a2c225d56817ff2e854e90ca97c174b58d522cd6
SHA512 1c082297f30f0659b8c761822795f650c50ffc0f6ac79441210c5e1ffd191efad003cca627ac70e90ea855fdf691eea9b5628212efec720ae7284007504e64e9
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmcnQ/tbw/2Mkjy6Fr7g0o:R8MwBtOmcQ/lFTjN4
TLSH
T14955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 faf638e7587ef2ee00410b7801d3a71ea71389bb125a54f4023623d68298013e
MD5 258466491805636f4f17752ac130cd99
SHA1 9ff676c56a0bf5957e6afaad2335a7c7ae056fa6
SHA512 e0e84844b813f340e301b1e813d3d7ea02e3e45c882b166e3128d728434b4b1c5789f828563819dadb50d2468620d09a11427074167b12e541bf701623578815
SSDEEP 12288:wHvUrBFrEjwaQiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:wPUr+NQinQ/tbw/2Mkjy6Fr7g0o
TLSH
T12675E12E26AC18E5F67AA17D89828609F77278521752D3CF02D0817E4F77AD87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 891127e62885febcf0a26703c514e8265166ba29238422f34225faa4f69af495
MD5 9255dd219a92e3fdcff1ec72e8fca8f2
SHA1 24543b84ad0eb0244ff5311c189e08e0c967473a
SHA512 57397c6c3fad38840f667e14573446706234dee8873ff5229a7232450eb6719c31c7dbc615e56e0fb1b38a8458b0c1338ed5829fd7f5dd8d576ab0947f7bcb62
SSDEEP 24576:AD3FHshBIYQgALnQ/tbw/2Mkjy6Fr7g0o:ADVHeBIAALQ/lFTjN4
TLSH
T1DB85E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/240-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/240-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-329-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1620-0-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/1620-1-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/1620-8-0x00000000024C0000-0x0000000002526000-memory.dmp

Download

memory/1620-65-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/1912-294-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1912-68-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1912-66-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1912-74-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1932-327-0x00000141306A0000-0x0000014130D20000-memory.dmp

Download

memory/1932-397-0x00000141306A0000-0x0000014130D20000-memory.dmp

Download

memory/2268-54-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2268-276-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2268-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2268-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2504-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2504-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2504-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2504-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3372-101-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3372-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3372-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3372-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3372-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4432-133-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4432-138-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4432-127-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4432-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4432-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4452-52-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4452-38-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4452-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4452-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4452-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4584-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4584-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4584-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4584-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4904-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4904-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4904-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4904-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4904-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4904-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5428-309-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5428-78-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5428-84-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/5428-79-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/5920-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5920-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5920-114-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5920-312-0x0000000140000000-0x0000000140200000-memory.dmp

Download