b21837718c5164f0ad64e3f30f20c36d4a959f9bcb5a68c908827e76249af0d6

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
Size 4.2MB
Sample260807-a5rstavblb
SHA256 b21837718c5164f0ad64e3f30f20c36d4a959f9bcb5a68c908827e76249af0d6
MD5 4f6143f1959da02950ef1c7186900017
SHA1 c6ac3b302115b4d77aa4dafd18e65cdabe743961
SHA512 13e8865276867bcf0eea1a65ea062cf9ffed4585a96724885fbf11e7133b81ddefdc224b7d7eacf1f68b358fca4c762a3bc3ead04afb5d96a58d9e741816820b
SSDEEP 98304:182Pv4pBHRMtulf9E/o7WjxQ6kmRhmMMHQfK3hRgD527BWG:1TPv4p9jIHnYHQfK3hKVQBWG
TLSH
T1C8167C2177D6802AF6B30E7599BD611D903DBE320F3090CF939C192E19B59D2EA35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6152	elevation_service.exe
6640	elevation_service.exe
1800	maintenanceservice.exe
6316	OSE.EXE
2676	PerceptionSimulationService.exe
6456	perfhost.exe
4800	ReFsDedupSvc.exe
6732	SensorDataService.exe
1960	ssh-agent.exe
5296	AgentService.exe
4216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74c36d70957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001efafab70626dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2b7bc760626dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d7814b80626dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004036c5760626dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081de23b80626dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6152	elevation_service.exe
6152	elevation_service.exe
6152	elevation_service.exe
6152	elevation_service.exe
6152	elevation_service.exe
6152	elevation_service.exe
6152	elevation_service.exe
6640	elevation_service.exe
6640	elevation_service.exe
6640	elevation_service.exe
6640	elevation_service.exe
6640	elevation_service.exe
6640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	244	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	6152	elevation_service.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5296	AgentService.exe
Token: 33	4216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4216	SearchIndexer.exe
Token: SeDebugPrivilege	6152	elevation_service.exe
Token: SeDebugPrivilege	6640	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
244	2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4612	4216	SearchIndexer.exe	101
PID 4216 wrote to memory of 7080	4216	SearchIndexer.exe	102
PID 4216 wrote to memory of 5992	4216	SearchIndexer.exe	103
PID 4216 wrote to memory of 1208	4216	SearchIndexer.exe	104
PID 4216 wrote to memory of 6016	4216	SearchIndexer.exe	106
PID 4216 wrote to memory of 5632	4216	SearchIndexer.exe	107
PID 4216 wrote to memory of 1200	4216	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_4f6143f1959da02950ef1c7186900017_amadey_bkransomware_darkgate_elex_expiro_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 92bc00c6a5bd3cd36aa0c4b235f02e35e2d27dc6c210d1104187ae6fb2d6ad38
MD5 8847556e232ca8bdeb9dcb035f22b893
SHA1 07908ad5d3962d305efc02e5d5597f13bdadba5c
SHA512 473e028016bc5ec5498de044cf1b1b179fffcf5edf2c309e0cf05e8e8d3314360f5bc9c9be63dbdf1a0fc01718093f5a5e7ceeeeb07bdae0b99e19b4ad4e244f
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnWDmg27RnWGj:J3q6sjB5D527BWG
TLSH
T132D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f0d168898f862e6b7d0663ab1c082c84d9f847942cdd41544f7370cbf9bed279
MD5 e53e6ed4b752dcf8d77fa7d452e71d90
SHA1 97ef5097b2ba453ec9d1d084f486bb934d4ae6d2
SHA512 9b38c4570a861c8eb709d1fc60a6185df930a6a49e6afa03494f15c6c9c18fe171279704ea61de73c412fcd1570b833e8eb44bc31bff15ccbadf0cdd96a09006
SSDEEP 24576:lXYfDtczARsqjnhMgeiCl7G0nehbGZpbD:wtcUDmg27RnWGj
TLSH
T1B6650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a579d1daca4cb81cb51babd0c2d9824ef08d50fafb1c4267b6a136255a0dd013
MD5 6e8ac375eb19a625f0477b644cdbd55c
SHA1 0950b85ea15b7afb3b1f715bb043b9946023e43b
SHA512 46e1ae6c9959cca3728bb288da929abd304239b58775db95aa61df847257e627c5acee9e949fba6b2e93036b60c047ee2018ffadc6d46c3aa628de4f6c8d5181
SSDEEP 24576:D0Le5ji0hmxxrMnsqjnhMgeiCl7G0nehbGZpbD:DPji0AjWDmg27RnWGj
TLSH
T1B4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4758142427c6fae165103b51aeb1411d8916809518f9cf2596847a613c87e92d
MD5 c01534005a991d00ab26c961d907479c
SHA1 ad1d6644d5e355755e58fa8d11d29ee580658150
SHA512 1dd2c6130ed840357bc2a276c30f81f42aea966a2dd6c20d70152ab16bbb445ed42022fa3bb040e651298ba304536178cc2cbf7e2f82b7c1f144af3e24fe6172
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyudsqjnhMgeiCl7G0nehbGZpbD:N/ezSC6vUzPveHjyaDmg27RnWGj
TLSH
T1EB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e448426f778c98a25978b7109a83c3acea9f3c0ecde1b00c98db405988c24940
MD5 8c3bfd4e2421e18436e8841a7d5f75e6
SHA1 04f78b025e24c4f4e1dd442538d02917ba1ed329
SHA512 344e71a84021a76ce6f319bd2093f0e565ac9af11247878c916194076675cc8f19d8060232657f68e9812b11785e61aea82a848bc97fa2238d24e75becfd63c1
SSDEEP 24576:/VbqPb88hv/l+YksqjnhMgeiCl7G0nehbGZpbD:/VO88hXl+ZDmg27RnWGj
TLSH
T1D7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9af94733eded3de5e578da9e9a3934d06cc2e9f3a535c3ab88017f77423ea165
MD5 8a71ea7ca5084e531b95df504d8d4f0e
SHA1 aa84c814bd15055e29775630a3a29c75a366f8ac
SHA512 def42939f57c272adff90041facdb48bc4153c2dbca7f13909ae92dccd2152e4500b9bc5fa6c483cc35351e71f7aae0bfcdbd877916330407816d7e528eccd7f
SSDEEP 12288:7LjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7LjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a0eacde4ecbfbbd5ff2cac86a79b4c777bdf8f52a8bfd2746e4933f48923bc1d
MD5 d9765c5a682eddbb53ab400622ac3deb
SHA1 76916e744e50c5e3b07ac7c831b547303874e579
SHA512 8da573e0717db288954c6ea2a62e45902a8476c3e084bcd2b049a788ffb6eb8928783e4136302d175c4cc7bf91e0f5bd984fe381b0e6edd8e2f4ebb19c27f60a
SSDEEP 12288:WeBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WJIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18265CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 935823f6bef7c148060cc4d8f588de804c290bef803aacb364c1f0eca37e2122
MD5 5a9e23222a7c9747c345daa7a88bb823
SHA1 35bd5cd966935a977f4f8b76de6d0e0f255002e2
SHA512 798754b89624639b344ea0dd424f5472261eb423deac37cdc559771efb8a845db92041ca6a1e6354a709ef7259ae856b965d0f064d38879d96e1a7262b5e1b8e
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:1QvGAdlCEL8c/DRNw5CxD527BWG
TLSH
T112266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3f04f8d77212c093fc326c828abfece4681d88c0a4d6029cb018a39bed24bb86
MD5 3596277a828005514fd338415dd15eb8
SHA1 56955cbdd02fb5a7476ae4066952f200ca3841de
SHA512 c1b47a3d239b551301faa0068fd539720dd3afad8e3b3c4267fffaeb81067a7f591f3b082722f0165a4362ea2ffcdf8d2619010a1b3949e77ea8aea3a6f4f31f
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E575E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 89833389665359c92d5255f30a658aad57e9e53c07f280db805b2b1e9979d76a
MD5 91c95ee47a02793a5309b61a6dfadff6
SHA1 fe3f73ab52516bc9f3dfbe6c81ae3169f997c822
SHA512 78261f4f96dc6a067e788c7801c05c4c24f9cc5400935dcae71585cf2bb0bda12f3eb6b943a4c4f67e38b01d309d4314c855de8c77b72892f1fc0de5c77dad29
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH+VQBWG:NUEtQevvqc2W1cpV2tI32xB
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 89bba6000ba21bc123cbcd5920d286ad736419a13e699637faa9c6e2b97a1970
MD5 d97f11523347c99f1e1032d8be4dc00f
SHA1 cf15c2c5f03e8c1c57e5a4a8411687d81595f878
SHA512 8d4df0049c3b85742ffd90cb3672bf85672e368d767d4e2eb12408308f1257a4f7c2fdd8f6323c8133a1d1595bb3ea22af897a26c3a67c34c5a4d64ed573f151
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zmDmg27RnWGj:koquVjnmVD527BWG
TLSH
T150D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b926275f5512a9f503f0c71d303844cd2cca5667eaadd44a105a990b55bb382
MD5 9e7afc072527acea4d177af7cc3dd7f3
SHA1 cacd1754f2e3b5e9c4454e5386ade866b3f98346
SHA512 85037d4c8d3775c8a1e0fc77230942c37f3b6b093c1481b7649a894f9d01f5d33f03f2153606363297bd5c2578475377ca2a10e9912cafb2615a13378a6d1d70
SSDEEP 24576:BAhGL3IFoiwtA5l7S53hsqjnhMgeiCl7G0nehbGZpbD:BAMUFoiq5FDmg27RnWGj
TLSH
T179359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3eefec187b1ef908f61123423966d52a819a836559706afca8710ae689985e90
MD5 2bba2c28fdea60c945693f3490ac2890
SHA1 08b686544e61af6d8caf964c7dac1470ea591321
SHA512 ed41c8f1043d19a2909a8db7ed321cc957a7cc8fb672bd5a437bdd9dd165e2a2fb76051d687a0a69135a5b1f99244e577c749435bcaee861ea6c2952e8138859
SSDEEP 12288:meZ1IyyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7Zu/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D05512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7e967277e1c5a43a778978a9834471d337bb1295ba1e0688009ff66b2c2dac27
MD5 864e554cc91ebe6a6726788324351bf7
SHA1 58612d016e4680a83a5ca91163e1eb68a1698a8d
SHA512 e9cfc5403993785d3867f17176baed505d8503b2d90abbc24aa2d949845ff5b210ca378960a536b17ebdf8cd8d656d0ec0b64b1c82cd53832a2597ce8f0df4b0
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3cD527BWG:wQyiKa/X+PNsVQBWG
TLSH
T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2daac2d4a2785d22094dc9e221784f56bcbc3a4468e5952a5c508857b398e295
MD5 b8eb709dd90a9f3c76592aba4bf0daa4
SHA1 af590f18eabe4dd304cfa5d306289af670e042b5
SHA512 6d99853cd9001f58148819d7f4f07e21bc821ad33d031aaf032f3bb0f918b4b9eaf6d5c7e0816cfffe0f4bf0983cb5b5d2e211dff3a14ab99f3a5f4305a61f59
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3cD527BWG:zQyiKa/X+PNsVQBWG
TLSH
T1CF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5575297dfe7a99dcaf2e109055d4f15ad8292df1c333972a0bee800c2243a93d
MD5 5ad9761b436608a787a67ad1addb36c9
SHA1 ae99f50586d4b416a15b230ef23074feff689261
SHA512 33181f016869d477a7dc17e25c4cbad8f6e5c8b6df3ab0f12b727acef1748b9dfd93923853f1252995aec935406bd21cf8e4b8958c47f143d36018909f320274
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0PsqjnhMgeiCl7Ge:k68Qg55nhceWu7PNU3/WDmg27RnWGj
TLSH
T186B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aab9aabc3915f050e5f0ea1a33c2aa5172f16c96418a1cecee94c5b289b1b141
MD5 be9e97293d91ec824572705f86043fe1
SHA1 a02de49507cbe676fa5ff2590898a018931b9a53
SHA512 81877c536464ba17738a59991ced32dc53145aa0f121f2463edba3c085e79a3bf099195fc60a7fc1c7cfb40a04a0fb18cf73fbdbea3c7a4a1040c16962434b56
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZnD527BWG:YLIHEWhNVQBWG
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b2802171ea1f8606c2d536e1ff94c589ceff5425753e3b25b22547239e20c83d
MD5 992bbbd2dd5f16cd1ee19e176c4628f9
SHA1 a5a365fc18334beedc593f7b415bdb1274be60e0
SHA512 8ae89a3ccfca5ae212912c60560d2463a62511a06af8cf8f279895230ad5471424dd1660793e54056e1f123eb5c761eca3d2c3b09b1b5dff446d92ebf1fa00c8
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glVDmg27RnWGj:Su6Jmdxd2dVD527BWG
TLSH
T17ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 747504b64b6f95005ded0dd73007d0a3638caa9b053bd33a657b9f2dd3ca0349
MD5 2c44720139060fcb603a60f7c07cdc00
SHA1 2a4727255d711df25084fcb87b836c50e6479b91
SHA512 edd5e85681d72cd5f94b1971e5c0b2ab474c0aba812c38e230b7737ecb626dc7a975c52f6882d9fb10c73606558ed29892e586598fd64181c76602a8237576f1
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xoDmg27RnWGj:2mifPWRVD527BWG
TLSH
T1CCB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74cbd6384ba5c60f1fe7111ffdfcd6655570ab07a95037535fc6f63f3623d2ff
MD5 15506ff9e114dcdb7d28730cc0bed47f
SHA1 d7afe2c4684aea083c6dd68cbff0b78718e6367c
SHA512 84da448efd07b082cb2555d83a5980594a78a7f0db409a2af1d56635b7d6646b331f365ee0179f60fdd8e45e565ffd580e763d3e88b927156dbee6eb414c102e
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHqjDmg27RnWGj:U5dKii61jD527BWG
TLSH
T126C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5ddadf4713341d9da367e7f5f218e5ca4a9ecb0df01356733bf65f26c5079c3
MD5 3f4c6c9f45b3c5cd8c0a855ffa2fdaa5
SHA1 058481c97abe8f7893e0670f3a3712d89925e83b
SHA512 bde5602d1df3967d876f80fae259cf1e90ad4fcd7d94c1c3304030506166dc99c647c177d12156d87d6a30cdcb7ed5c79eeab24d35ed5861da506ebc8eb1c171
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wUDmg27RnWGj:CX2imphJD527BWG
TLSH
T14495BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dcaf5d360119c115b58309f5e5dd3d8c6cddf51feed154a5507a113320e4c763
MD5 7eb23f2e550cf0cb80cff425b6d91171
SHA1 cdc2a91ff57405b6d2d87ee71775e962841174b5
SHA512 6239372badb2e607c064fecbf112de24cd8b13fb13cf4f61795f18e44240f2e66227d3dc88b1a05f203862e2ca2299e1b37b1c12d9ab4751c0d4ea711a9675ff
SSDEEP 12288:lbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE965C41CAE62648B5C3E5F10DAC073E57E92004937A5B7CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 17007c73666c91b5733f69597f42c95dda89993de843d2d03ec21c47d0ba1ac1
MD5 757f0e96fb343773c4f7c914d13dc093
SHA1 637b04aae2807ca2500b5ad1fd387b94630ea5b2
SHA512 741598a746f23f6dec11c63c936750d34bc2d45b2d287520a2ed85531532f8f4bf0b9408761f631abc497038de8d3a9aa12f467b34710c36a60d6b5b48f933e4
SSDEEP 12288:P+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 be8a86ca894e02b00287dec8a889e1c84a120a08d8fd846e57b58ee6c304c373
MD5 ba4f8ca160e4eb449b0e8dc42e024592
SHA1 408e9c5ecea99f478ed0ef854b665abe7a0b7734
SHA512 c3ae8c26080adaa4be0a8213493cb74ede2304c4f15386928a29f2df18118cdc8d8efb4de74b0a92d3825cca4315a828b2056b4eb2de0181a4915a2a87ad95e8
SSDEEP 12288:q0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 104bc61cf2ebd81249bf212961cae4d7b1d67cbb3d18fa27161de36e55bad797
MD5 d62f844b25580a90bac5f5ce4282ebcf
SHA1 ab5b3f3b37c7e9f2243b46e7605a0491cfda7e07
SHA512 213840d9f82e75773f796fb787c0ea63b684420473b479726d0da57b100a6fefb3d9da6f50f8728f62ceeffca9a0b55c252c3968a9bd5b735e2e1999793a1cf7
SSDEEP 12288:gVBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T15445236F675C00C6D83285B4C2F5E11DE8277D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8634b39d2fda48daaea4fffacb73ce526f4cfc34ef431af6790f888fe2d309d5
MD5 5d7990ac7266b3727302573c26e7e40f
SHA1 efc1320c9f2cb69444e6c3d8ab0d473eb476c7b2
SHA512 8a260aa726e1455d95baf65536bb047c7ffb7f982daf045cc9ca9d4b51c32960611d607a28c956c0bdae111b4f73490bf45dc5cc71382387274320cde6abbbd7
SSDEEP 12288:ApXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ApsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ffada292b12d51994a585e948f7d266af6dea4a8d9bc9b43845610b35c46e5f3
MD5 21ee69a2a94a820f3703d8fbf1aff892
SHA1 074ddaef053bd0742a10b9814c86b520ea7dac23
SHA512 046bd309aa07ed48116de8ef04c56ff5ef82e1b3aeab38be730abe888a58bf06763615b407b5e3e21ae894454ac7734d0c572fef63c2816ed279d719326e830c
SSDEEP 12288:KaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C4523BE965C41CBE62648B5C3E5F10DAC073E5BE92004937A577CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1273c684829eebb9b673d51e49c656301d13b39b6d7348e5c38033c7af124239
MD5 9813746f06608a0fedc6a53a062ad3b7
SHA1 593bca2a04380fcb65a42e738901bd34763c9205
SHA512 6672f041ad91d5552382edf4538c69edcf9a56b566dcd68fde101177429f9c4f359d073fa6a617c67927e7f02cf7a72a0890c1c3ba7687a20d2869999079063f
SSDEEP 12288:+GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE965C41CBE62644B5C3E5F11DAC073E5BE9200483BA5BBCBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ae09245742406203a3d7fcd3706e8a4f0b9bcc6b42e778249814d0c1f93fbcda
MD5 8966d2f93d685598bb90391cae2848b1
SHA1 978e78453ba9cfdf864b2df28c0308308bb93d22
SHA512 7d5f8275b25d75b67b72784b7564febeacba608cba4c6d6d335bd3f5b1d365d0eeb094b2caef94a50f22ba46c5d4f44c1de35cb2379eeb1515da8473171ced24
SSDEEP 24576:BZMRzFVSOesqjnhMgeiCl7G0nehbGZpbD:BZMRzfeDmg27RnWGj
TLSH
T1876501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f8f1e94f3e20f14023c2b6db6371d1a54b06a8994a62e9a45a44a13197698590
MD5 633870915637b1bbedea0ca364ed3b2e
SHA1 6965f6ff42b257b92f338efd9152d2bdc1aeecbb
SHA512 bedc9173c3ba4180dbfb3dcf5450da1559863c434c7383980a20e75e5df8201c957eef2fbe5979f7d853317eec511082cfe70f2608d4a5813e63f58a526512aa
SSDEEP 12288:9vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6f4b5fbe4a0e6500245ab920a50bc26fb6da8a2290c02d768fb0cd4233228f07
MD5 78bea7893fa6c3cf9140d9bdcc3613d2
SHA1 75e5a939612b57cd20a0d97ec9f08c65cf0051cb
SHA512 4a572a95a524be68880ffadc9d44b1265ba0d57f46fdc6073dbdf1faadd9d66c10f0326d2d818a92fe77620eddaee44f080a997dafaeddfdab986f988d5978b9
SSDEEP 12288:LTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 73984d6cf0d0f13fefc818d789ddc51a9bfc9b31601435be7e35159a9d7d1b5d
MD5 78f6e567eff20d5a72cf047f82fa0067
SHA1 5194cd1f8d66625de5a2558e499ba8162713a191
SHA512 578bc107937b78c735ff8197a07432191902d03d78ea6e029da23cae4d13d077dc762f95204958d1816024e3754b526ed8e962ac0f19d6aaafc6f1af78127458
SSDEEP 12288:ZyPz5L8yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEx:YzyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F55125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b2f31abe403606f22234c3f08d2aab1445328570170e77f73bfe575f7b93d65f
MD5 fac1a5533ca753282e362834314e2279
SHA1 6643cdb6e4d297587c44f4731af082758aec4d24
SHA512 8cd78b31fc476de8c16f8ed8e549e31bffe3ff22bc983017679250395386c328a132dd70ec8beda4aec189b65bfc7c313a9beca5bc9d44deccac904c608b0442
SSDEEP 12288:pvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E4523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9c9a0dcb016e9fb44622f8bceddc769701b39041d8ad76133c0a75f7435350f0
MD5 5189f879cd6c03089dff5d629f77fc88
SHA1 f9b43c96eb990b26e7296a4ddf60e37984690454
SHA512 b673dec1252f46eae822e611b9fa037cfdb0c737e9e24427fc6a53852df1c7e491de88580c313ff5ec1ef9dc4d7d44f97779f29af4b5ed4426531f91fcf6edbe
SSDEEP 12288:wvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c958f126c9c960e2e2c969c8b5cb56b0a33bb12750d3f99caaa27aac3288dffe
MD5 f1a0701edbe67bea023b78200fd35704
SHA1 5af349202a860eacd1c009d6b00d5116e31f82c8
SHA512 f5ba2483f0dfd65419ff0224988456d814ad085004015cb32362deef28d9abf132fc0f00a8bca620ab885d6ed23e0f7c1e8a33cf3ad95a4ffac7af371b3fd9df
SSDEEP 12288:myPz5L8yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T15955125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a8a378c71b8986a008dcddde2d2844d0d68f6b491fdd3073c92409c45110157a
MD5 19e469044e77b0d2abc7e2b4f7d2e5f8
SHA1 fb9f150f15892637a44a53d9364b516b79df7119
SHA512 a30ba5b07635f0f85d37962476b88c1a91a87d66d6483aa17034894e02bb4cc5be59a3ebea113ab4c88d47f85b85c0265c2bbc31a172e6c11ae21b626e7cffc1
SSDEEP 24576:oTDaLl3z0zDEsqjnhMgeiCl7G0nehbGZpbD:oTuLljBDmg27RnWGj
TLSH
T1056501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4b16d24830276ee136d0aeafe7f6c5f5daba3788afdff3304d6651e960028a71
MD5 dae3f39202ebe29336bd5061c7b4d9f3
SHA1 f596d184dfac47fe41328fe84993149daa304c93
SHA512 b03a199593df66cf6638d24555640fe9dc2c39c0e91b45b05f7de957b6b0025a7ba249946d09cc7a609e53a25eaf8420e1c7439754016e367b661179cb014912
SSDEEP 24576:13vd9CHKy7GZAsqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyaeDmg27RnWGj
TLSH
T14E75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 009c59a8d18bf7b2d602653a18635970e992d6900e95bfde95775d4ae0eb0651
MD5 596b9f3d624bfab2a2faed2162a1188a
SHA1 69afc8b3134e392729b2d3fb847c48f32926f76d
SHA512 d5c1c9e96dd99c329be0719cc00041a6573ba0094f602ea8749b73944259c5c86949efa0f7ffed0cd42f5bae18c0bef5003ddf174da252b272e5c59e6abffb55
SSDEEP 12288:fUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE965C41CBE52608B5C3E5F14DAC073E57E9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 93524079879a1c998e52e468ffd9e9e911e57dfca8c331c651924075104f8404
MD5 259776a57880c81e6133d96a1d325f57
SHA1 6423c4d61d46cb951330851f871cc6f95c3b4357
SHA512 efcb1eb5c43ec80dc22518d4a69abf02b841567cd04ad0332b5ec9a2a07d03fd722c7a188bfb45af84180631a48acd754927b706ed5be7c66536dd04f5e1c9cd
SSDEEP 12288:DSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41DBE52648F5C3E9E10DAC073E57E9200483BA977CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d473ae69559d86d6ad65e40adf282864e1e11dfcb53aa9eb472ed1af8635dd79
MD5 dc650c75a8aa3c7359b5beef7c1528cd
SHA1 da05c8db6f744d444a95a43ef814a4ecca1e65bd
SHA512 d7595b915c5c88992328a60b8a213a9bdfabc54ea8f7d261f35dee8ff36ff35586f6d21d5cdae5bbd2435ae3cb61ab7b2bee36282602a1f8b4b039bc35206f45
SSDEEP 12288:UFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b00c106b1f1b33ce5aba7bd35f491302e4598451e0f6f7ebb95fd7b88515eb8f
MD5 2644c29acaa36be82c2afc7ee17e3b86
SHA1 e419ca331ffd7ca1f84803a06e7a15ae42abe83d
SHA512 14734ffc7a35a21ef5d8269ee6870e174505cc16d5cde18cf97e09c4eab83166dc5400ebc93d61cbb30f2b1770979d503adeee686c10d95087a7c2fa51520ab1
SSDEEP 12288:QvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bebb6230012ff623de8e176d9cde9e8a0face6c2c6599560b0930447bdc6273a
MD5 c4bcb372b1ff6ed8e6fef4edbe1f6040
SHA1 42a38119d0be893c432f463a09f321e9656c6b85
SHA512 a67396b5e4d7c816d7a826d1f2e6bbf0b2eda30ba97481b2e0103d11e4f62e3c4cbb5ae08d850f94653ba05ce729c5d60f8b2d5c6f3868c49f5be5791a26d8af
SSDEEP 12288:DUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 172a6ec720518d41bb6ca33b2dc6df3f7cb5185eab5bb78d8ace4e721cea5184
MD5 5c7dce2213bbc4211dc97fd6d9021f8d
SHA1 f67e606eb774e4af90220be7cbe7b78b0655eb37
SHA512 f5e0e120c3261234f213b633c13b2f22eadb25c7b12ff199d7beaa81fa092947f63bd4f416efe378ee23f08aafc6a9adf1b27a97a7f70040492be5632a12fb80
SSDEEP 12288:43Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:43sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ff3741d6d01a57cf5d8aae085363a64184164a22331acd172787c912ad607aa3
MD5 0c54f318e0aad32b4444f92d0701a7d5
SHA1 a71da51d36aba87746bd2b2116a4e0d982cfc5c6
SHA512 e5bc4be09e5c8e2ffb0652c8ee011e9d96e08341e91f1a1db0871377de213aa062583e4e8fbaaad2d3a4d86cbe334c5d5478b62ae3d4686b9ecb21ba5bf489ac
SSDEEP 24576:AfwvUk9RX6wkyAIDsqjnhMgeiCl7G0nehbGZpbD:0MnYIHDmg27RnWGj
TLSH
T17B85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 11d73769bda08551680b4694b20678d2902ca8d38f3db744c98fe8d5cdf70e41
MD5 5b676dde157a3ae7e2bf24190123612f
SHA1 d3c49097b3bafcc7d9c40f721c53a21d970a62e4
SHA512 ebb78a23c31aa7e944fb309631153cdf59736eb7dc334b105291378f703a51a5359ece2aebe8d17d1b91472c180c47fdbe2f5750ed88bb395f906f672ac5070d
SSDEEP 49152:WYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Dmg27RnWGj:1ySzP8D527BWG
TLSH
T196066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 19711c63b9fedfdf88aa35baeb18748110c038125b7c7a8db70a6d341d4bbbfd
MD5 fc612f617e77aa28465b9562d2a1ddfd
SHA1 12eb98459457d4e1d5b7747930b8018a68883521
SHA512 ceba004258f68b1a201465585fab265e8f15150f2e6be8e9c0e30029180640ea1727d25dc1e71f9e6035f1801bee148d1443d9fc085437c04e9315efc1546777
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYOsqjnhMgeiCl7G0nehbGZpbD:t47JUQjTirIhCnDHUPfF/kDmg27RnWGj
TLSH
T17965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 622f527ae05490239fcb8488aaa21271385f501f4e008ac62bec5d969151e0ac
MD5 407b4bb45cb60937ab914d4abe2eea92
SHA1 eb6df5e2f7d963eab8652e99500ca5c3758f8690
SHA512 59ec270cf9203f4aeca69f28ca11af8503efac9d2ef0c4b64b91188930bf5a6475c9371df84fba10a681abcfb851c6533321cb7a86299723c4da1163eb2b7d70
SSDEEP 12288:zbsf/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C755015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 862084ae5f5942548405e0fa9311d93bcb24cd6da1bda4fcfec898f4001397c9
MD5 473b39d0e8a31ea468dccd06c61f5877
SHA1 81cf82dd599461161f1bde85f7410a9b1c6457bf
SHA512 ef1626c4d3380401a4abd234f151bf982e8c6e3fcb4d80597918f0feca3f2c96432ffd8ef0f7aa941b7b23bd1a8097cef3515cc09e96a8c3bc6e103740c4a38e
SSDEEP 12288:thtBYWU3flfl9F+xgEryDohvgjdJsYOW0xpJARMWn9lWB+e:HtuWUPNPF+xgz8jYNqpJARMW9l
TLSH
T18A351850B62AC75FC6A940321E36D1CCA7707D41EE449B0373C99B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 eee8deeddaae7c3f01795267a622254ef1b4c0bfbcda44d644f940a03f468527
MD5 f3af5db30ba61603f450951fe0770e3b
SHA1 fbcf7fbf77c012810bab12253c721572b9f5ad8a
SHA512 d91c0e3695188cfc6edc8734b1e7fbbb7c040e9ec4d3ac7d7ad3f27c0bc1a811e756c5f917ea21d8faceac5f768a4aa1e1304319a22f1a9163696841963ca421
SSDEEP 12288:ahxbOHErhE9ZzKXGweBuvP7f3g/aU6j308FFcKH/:OYE9wkGo308FFcKH/
TLSH
T1EE65E9816437A38FD1FB603207295B4CA7A4EC5677095F27B3C8453AD82AB25B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df4da40cf13e767679cf4993bb2590d504f82f6eadcf6354fbdeb33e4f8a48c7
MD5 fbbbe0d65370f4a464a53b655d407314
SHA1 1bbe929917f4291b35746040dbbfbab420a18e22
SHA512 d893a70a6fb12e0ff0fe630e344bd1ec8f46af8331350af73c5c2b71389bb2e041153f1d9ef028c6b077d7d8d3e4c2a86d56c8a8ffe7ccf09498f59ab638ba5b
SSDEEP 12288:s07HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D45237BD34C518AE93609B482EAE12D681B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aef141bf18ded99d93569dd65bc0b999034adb3971770fd522d4ff2e4c7f028a
MD5 76ad3e9da0ba86a92abb250e2a99c82b
SHA1 55cc76a9fd49dfce694bfde4ac144aab936feef9
SHA512 ca4e8a42e40c5faeb3fb439fde8bac789f7e122849ded4398a93bb720eb84b03d254afef8496d92536b9a77e760d5d9bc276b38565aedb210c2e4cbc79fe3d61
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGFiDmg27RnWGj
TLSH
T186659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cce0e63a53c31d330dd8447b0d49e2bbd39d2ba456591a422b6286478b91a211
MD5 43281ac879126da138c10e44bda542ef
SHA1 e1a8758ba8b49bacc7b10886050345d3cc807934
SHA512 6fee3eefd9c869687d934a0c53dc2e3ee51360f746fbd0ad59c38f2ab028daebd95e5fc918f1f0a7954f5f87db263645dc6758a819f2cc6a4018b5100d09d907
SSDEEP 24576:yG88u8FpJqH1bzria7/mesqjnhMgeiCl7G0nehbGZpbD:p7ZFPqVea7/ZDmg27RnWGj
TLSH
T13785016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 423611ae0298cc68c0c73c634470a98a269cbfbd65cd73548e024f81d87fc74e
MD5 b0eb059caab0bcfdd0a31298f8bd7f77
SHA1 0338fe6260b267327f5a13c6a713290394afd54a
SHA512 595a542cb2a2547572646282ecd4d2656232135b72ed896ef769469a742bf2af3d078e11366d830a40ce68f3790a0c4b45ad707358c5c7a02498fb8d6fead1cc
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuDmg27RnWGj:QG05lO43b/D527BWG
TLSH
T10FD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 72f3926cddffa34383c7966a94c4c525736cc9df73b2bcd56c4df7f952256bbf
MD5 ed0674e6c545878651ae0ffe642b3239
SHA1 e7cb921b4b26ab36e80789320db69b256e43f5f3
SHA512 9b689c6b34154c71ed6bba49b559a50f7ee06e333ee6c16950c6c8bdc2d15785ab9ecbb2478c9aa1f7a20c2624d81a9792f05f7d8046c77c3b52a0422873a7bc
SSDEEP 24576:/fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnIsqjnhMgeiCl7G0nehbGZpbD:Ha5POZ3BJt2pasx2+mWDmg27RnWGj
TLSH
T13865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f2b9eed4179134e240ddfa64318dd8a9292caef9c82b1569c8628187dfeea644
MD5 22bfee55946586769a126908ec8aa1a2
SHA1 51046f799d317841200321378b12194e68865aeb
SHA512 9ef78605e2f45ea73bd2f025e44b8ba411024237d756f2f04c904b8a681afe2171ae3a1edf9e4262d52c9216081fac36af2fcf7fe79012eb90420b34f9f255d7
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkWsqjnhMgeiCl7G0nehbGZpbD:YNc/zEOVHF5Dmg27RnWGj
TLSH
T1D9857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef6f3601041e2589dc56b29c72c8f9048268987e4914291ec0fcec7952560d3c
MD5 ee0bb9a6cf24f422a7f4fabbe31880b5
SHA1 d1cebf6519fb7193a2ef078f196a75e3892e9998
SHA512 29ecc710b9677e80efae089764042178468d41e53afe49cd1bad3a702a85bd6c3c671969f41c833501fee3d78c492c465194fd10ed2c6f1b51542c62dd47732c
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmtsqjnhMgeiCl7G0nehbGZpbD:aTMwBtOmRDmg27RnWGj
TLSH
T1DB55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1f82af6701420dd8b7068f1c960ea5dcab0c9a171f0940114d4acb7dd08e2eab
MD5 f08c8b918b6fc4691f5ce3e13f06b3f2
SHA1 09b0b20dd13b2a4a4f4e2660c7eab922ae242af7
SHA512 dca2057a2f2e1705a112b677e3ec6a3d4ae6f00823671bf63e3c9f79a316bf7e7b3c46936fb6a0f62043ec8c6b35f8701f86ac3c4ce695a03c87c0d9140a4851
SSDEEP 12288:5HvUrBFrEjwaQKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5PUr+NQKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16065F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fe89452ffb837404da0982b0f79c18e54abd52d78a4c33644e5ca842cb05d71f
MD5 33bfd54223dc52efc9991f6a86a9313d
SHA1 1971db9da1a804f335a5119496a0186348935cc6
SHA512 44f75010fa6d60cfa54bd9fbedcbc43f8c3c02e1f7aa83e9d8418f739335c62d69dc6fb8971f3441bd06fcd365d8e8f1604d573da09af24916172778921ed912
SSDEEP 24576:zD3FHshBIYQgA7sqjnhMgeiCl7G0nehbGZpbD:zDVHeBIAAvDmg27RnWGj
TLSH
T1D675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 e5e589996dacc678d7b3c55c4c338b7012c507c83849274fa179dcf0e529511e
MD5 cd67bb6e5260899b4bb7985d1497329f
SHA1 a07e2dad4b6b1aa21eb77f2d63f9c73b773951d8
SHA512 d10e0c4797a379270ba9467993194f5e56cabb98bed289aef2603d0f14a62a18df6ca43117db774ec728e8ed73a16c0b9d20edbaf72f5ee905be278302e4d7f1
SSDEEP 24576:OwuDOW/sqjnhMgeiCl7G0nehbGZpbD5sqjnhMgeiCl7G0nehbGZpbD:Ow8O8Dmg27RnWGjVDmg27RnWGj
TLSH
T19455125A739808F9E9774538C297D13AF6B37C122A308A1B1761C66FAF732505E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-0-0x0000000000400000-0x0000000000839000-memory.dmp

Download

memory/244-8-0x0000000000F70000-0x0000000000FD7000-memory.dmp

Download

memory/244-1-0x0000000000F70000-0x0000000000FD7000-memory.dmp

Download

memory/244-55-0x0000000000400000-0x0000000000839000-memory.dmp

Download

memory/1208-323-0x000001E288350000-0x000001E2885DB000-memory.dmp

Download

memory/1800-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1800-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1800-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1800-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1800-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1960-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1960-112-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1960-119-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1960-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2676-73-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2676-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2676-79-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2676-277-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4216-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4216-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4216-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4216-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4800-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-86-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4800-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4800-324-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5296-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5296-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5296-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5296-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5296-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6152-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6152-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6152-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6152-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6152-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6316-68-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6316-66-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/6316-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6316-262-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/6456-292-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6456-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6640-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6640-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6640-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6640-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6640-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6732-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6732-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6732-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6732-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6732-309-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6732-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download