2325e19ca62ffeef93f41843a8b2d2db43e226fad2df68a20496fb72e9614632

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 4.1MB
Sample260809-3rzkqa1tex
SHA256 2325e19ca62ffeef93f41843a8b2d2db43e226fad2df68a20496fb72e9614632
MD5 c4b9ebfce9261fd8798cf9376f0346ec
SHA1 5aa7a7ad08262945a6136cd382f66d7ae33d4204
SHA512 a37185579c2d7661ad51c796bc1b0898eb60a826367d4e7f316c7404e20a763fc486e5dc1bb9535c66ea86859d493debf29625df2bd92ae63766239952e5f1d6
SSDEEP 98304:EOgZIlc77sGjljRXCkmWn6AZW6JGFLOAkGkzdnEVomFHKnPYSqGsQr:ElZIlcNwHO6AZW6JGFLOyomFHKnPYUj
TLSH
T1F716BF217FED046AC0A31332CEDAF5B8717FBC646B29219723953E2AB9303525B19537
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6080	elevation_service.exe
2288	elevation_service.exe
5604	maintenanceservice.exe
5512	OSE.EXE
4736	PerceptionSimulationService.exe
856	perfhost.exe
3012	ReFsDedupSvc.exe
2476	SensorDataService.exe
1456	ssh-agent.exe
3832	AgentService.exe
3736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\59c7440924febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2ea67355928dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aac088365928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b8588d365928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b805c355928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051e64d355928dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aabc21365928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c28d61355928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a717ab355928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9bcac345928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfefcd7a5928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
6080	elevation_service.exe
6080	elevation_service.exe
6080	elevation_service.exe
6080	elevation_service.exe
6080	elevation_service.exe
6080	elevation_service.exe
6080	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3832	AgentService.exe
Token: 33	3736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	6080	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
1924	2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4932	3736	SearchIndexer.exe	103
PID 3736 wrote to memory of 1776	3736	SearchIndexer.exe	104
PID 3736 wrote to memory of 2884	3736	SearchIndexer.exe	105
PID 3736 wrote to memory of 4900	3736	SearchIndexer.exe	106
PID 3736 wrote to memory of 4432	3736	SearchIndexer.exe	108
PID 3736 wrote to memory of 916	3736	SearchIndexer.exe	109
PID 3736 wrote to memory of 5592	3736	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c4b9ebfce9261fd8798cf9376f0346ec_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:856

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5566c8610261d77f6f11a9b494b8250834c0266e7265d1b3d56f1e14236d0683
MD5 2a8ad1dc4ed0dc093375cb4427ee26df
SHA1 d7d8be98884248bf8c90a1d0163866949c1366fc
SHA512 8d6896de608eca39229ee05e56067a0018c2f17cb49d03c8553aa3c4d316cf7ddc35078a5b6b9ac216bc5ad03c47a7c00256705a23e65348a33468c146392e92
SSDEEP 49152:bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqAQgAT76sQuE:p3q6sjB0qGsQr
TLSH
T171D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bdec024907ec2debe56bc294174fd24cfce08afd30856bb984f1a4d3ed7f0016
MD5 a0ce8ff94034addb45f69cc05216e3df
SHA1 8c3e8ca7ce86b4a68b41e2c5dcc746c9da755b85
SHA512 12ce7e000ad54a567b8e42f17b034788f7008c9eac7c3077f2ff2a1f7d45074100a883ca3e991d71eaa61db80d5cf6cd82892fe242b01de8fbc7b8475c75021b
SSDEEP 24576:mXYfDtczAbAfYLH8AcevDN0FImbwQuq3Wia7gD:Ftc4AQgAT76sQuE
TLSH
T14B75F12963D408F9EC67813DCCB28521E673B8A54360E7DB03A49A661F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9eed7087af5656f1ec4c114076020c5f311c1664610c6def74b1c2dc7a59b9fa
MD5 688673415ea0b920b9c7448f76111d50
SHA1 aadfa7d050fe08b361969d606519ac53492acb0d
SHA512 5eb16ee0c91d293c0d6f4172f1f374a9170f155e1cf4f884298ec48dc77fc7cbc939ccdfffbf8f4605e4d4ad70df6f3fe39abf500e5b7f1bffdd95b4b4a7788e
SSDEEP 24576:40Le5ji0hmxxrMiAfYLH8AcevDN0FImbwQuq3Wia7gD:4Pji0AjlAQgAT76sQuE
TLSH
T17A85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1d00d99a9a3ce06f131de7de3c96f3becc0e039f9697f67d203a50f9bd69b78
MD5 10961ec0d02d722e5fc0f0e3da78d261
SHA1 11f96f3adcf823651679a547cd201b99eaaa7a68
SHA512 ac06833231fa2ca29f0a1df2ec787d272d1c17e52e41baad37b51277533e40f80be07292457808098c427911533ef9605794e886bcfd0b2cc2f5aa63a3152f6d
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuIAfYLH8AcevDN0FImbwQuq3Wia7gD:6/ezSC6vUzPveHjyBAQgAT76sQuE
TLSH
T164755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 65fb3f593759cadd3214f251236dbf404eaa672565ce405682c1d93f3157ac55
MD5 267f8d1ca3efad569c20cab5523fa5f5
SHA1 b98fbe86bd28cbf6e190f1195195c67053c6d24b
SHA512 c04a0d151ecf2473d257f6dde3f95d5d7469f5707853c0596c69ad39467e0251ea77048447f364ffa58f1083e41a77af432ba09f249c6194af8ef9e182ef0540
SSDEEP 24576:5VbqPb88hv/l+YfAfYLH8AcevDN0FImbwQuq3Wia7gD:5VO88hXl+wAQgAT76sQuE
TLSH
T11C559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 627994013a495739813f5fdd1e21815738ce6014f70007e2cd02126079fd8c2c
MD5 0f07af25cbf178f654e65fb470f4a4c7
SHA1 9209dd9da1fcc67d6dcb967ea279c1b126733ef5
SHA512 5dbd8d66fcbd9affd1e78cfd8cb37ccdc89b041ecd6779af0ecc47e6286dc665346a7b793d54ff5b66428bcde2f6008e02971664672b01cdfc36b00063a71cfc
SSDEEP 12288:5LmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5LmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CD552357464C70EAFEBFD1369CBBA5B963D1BCB88288979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 18d227d5f9bfe299c9c691cacb749709fd31fef641f44d1b63e5b43e63c6f0fc
MD5 7d8a223d54ebad21b39f9e102ea84f78
SHA1 5c48382e74675afda9f583909d7cc0eb155b748c
SHA512 64f5344f81fa88704c67fe479b9b3805e36bf3fa65b68a88ce2ca246a0b109db81995f941596d6eaa130a8fb1c00a7ecb3e413c588af4dc2195d05ee171a37db
SSDEEP 24576:WJIU3AfYLH8AcevDN0FImbwQuq3Wia7gD:WJIU3AQgAT76sQuE
TLSH
T11A75CF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 917ecb64b9416e80ff5c8e15cccc5c0ed8535ce0e9dc34384d041b816d030a7e
MD5 b8ff238bd34ee231093430d69ec190be
SHA1 15a928eeb042aa5531fbd210b8b30b2a6d69477e
SHA512 d16204be1013788b4f72882be79735f7cce851e5495a8b852248f4c6f83fc35fc7cdd5f08dfe458654b9055fb3f724e37bf8ff2162e30da49e6878b06a47cb93
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:2QvGAdlCEL8c/DRNw5CtqGsQr
TLSH
T19A266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ed6d43777a47b50089fdae83483ae431a60b65f67aa5e6896094ed28548291b0
MD5 1482d147464a5aa6f11c46421d3f9d24
SHA1 09e99471e86cfd8d3c8d77eb0b4d14a7f901d0c3
SHA512 d0446ac473cd518ea5773337e87e733030478bf9df185266fead2ff15add5348861a15918abd35b88e19dc9c62f9f20a9a0433cb5f6fe72ce0f8e4fd284cd265
SSDEEP 24576:10ewsAj1AfYLH8AcevDN0FImbwQuq3Wia7gD:Olj1AQgAT76sQuE
TLSH
T12075E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3ab926e0c30101e8144873988d1c98daa05271fdd3d7323c3aa49d5f5b68b242
MD5 02fa1f6ad24d18dd9e9dca1bc2612b41
SHA1 da02d566019ee5457f3d22ae5374e60b13eadaee
SHA512 399e0471307312cc6190205cf3f8450f1687a1708db81f3de6071d6654a51ac14844c5c9078e685a1e449e2874bd81713513f51ade1cac7158d6836dbd623110
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQj:rUEtQevvqc2W1cpV2tI32
TLSH
T101474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6264f9ef14a2935d37878495367e18d964fbbb0db14926dab0d8c81051dac27a
MD5 aaadb65f488b1362fa0b278d17b3c132
SHA1 19c10d6e8f09414eebb5b0c3dd41c1718d4dcd32
SHA512 68e771d7f1bf605ac2105253155ce9511bceb050922fea21d7c9b1b6459be3914a227ca8f295e5e7f06bc1ced880dfc5f2bcc0f75cf22d0814c425e31e80910c
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zVAQgAT76sQuE:HoquVjnmZqGsQr
TLSH
T12DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d068802735d7fa66325e97494237f0a7ed25fb5731daf14e999f37ba874aed46
MD5 451fa5a485a23d1680f97cc42f2250d9
SHA1 1a52cd2588c07bb3b6eef872fefbd40fb0eb9603
SHA512 908643f2f06da038d84d5c9ac4c52ed1c2f4e2c340a388a839de480f7930998781e33699c3eabc4cd1a23de110a7ff07512e8440fa83c44ae5bbbd5812d876c9
SSDEEP 24576:UAhGL3IFoiwtA5l7S53UAfYLH8AcevDN0FImbwQuq3Wia7gD:UAMUFoiq5EAQgAT76sQuE
TLSH
T126359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 82ee391f8362a69f6b0820a8610589e2ce413dce9b657dd6fea7141bd236135a
MD5 fce15328206f02ff40d72c7105e52776
SHA1 d5db94d98a6f31f94066b6ce55c838947c3dbf48
SHA512 00a3c3eeab3a7abf2e7c5142424c761fd9675c9330d312555e43b3d67d9799eff02f7ee7f9f97a978ffecfd8990b8aab039064d1671c5e04acc47ab919ac9562
SSDEEP 24576:Vwu4OWhAfYLH8AcevDN0FImbwQuq3Wia7gD:VwvOgAQgAT76sQuE
TLSH
T19B65F14A76A81CF9E9A781398597C136F7F2BC152621D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 eeb44373c3d7a4d7519da35ff18138c7572aad8f5df83d75bd6fb51d59d5dc3c
MD5 df45695250eaa8f3794319c329b38ee6
SHA1 f0a0a046ed26ce2610c6415b5ac650d3f1ec9b6b
SHA512 f4b3253f014bff1320d9a862c2ed03a7ea74129627a82cdca06a8abe11cbe2b792a1d36a526e2a736cce9bc1b54e96b0d66f2b62c63714ad6b0e38ab57b8106d
SSDEEP 24576:SZu6AfYLH8AcevDN0FImbwQuq3Wia7gD:6AQgAT76sQuE
TLSH
T15C55125B239830FAE5A7C239CCF25659E3B278A6532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4d62ee2d78fff846e57d7895a051b9db404fa689f4195f727e0972aec55570be
MD5 46dc34113603fe86e25a4752fa9977a1
SHA1 aa0026b97ceaf8402d6278d09c032e4ef5347892
SHA512 29d20b9d19696a1a27c07de339fc65ade44de259a28519f782d0f3e48c8b820131c5ca517d9866e0801c1b47baed3d3cac718892ff23ac1411ac3aba742d3536
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U:0QRQyi36YOcPbLvw2gAf+PN34qGsQr
TLSH
T168667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 807760a2ff8e77ad2e18651bde6a8d6f12d4c574cdeb6bb7e5d300fb4384bb03
MD5 1ec78849a70f636b63a3ac0579ad7670
SHA1 5ee7d22b990e1de0cfe0c880b59f78b44154c688
SHA512 051e7448f7f2b1ebbf74e4fca23439972a580761fe8f93232980d3ee1f8b4db85154a2496f67578992b516a3807871d12e85b0628ff9e3eb07aa967f0eeb8b25
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U:SQRQyi36YOcPbLvw2gAf+PN34qGsQr
TLSH
T15E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 539e686e5a341316235cefbb2d87b9fd965980c2db0db4845b38c3eb8c6edbab
MD5 da8db7e2b6ba406f6b8791ea388bb916
SHA1 8eb12076cb38d91d456619c4141f1bf158ee9c03
SHA512 8293d5777710e69902ee6c06df65813675b4261f0a230f7b4777cc9ce561c217265e0463140a0912014c1e4413ff647a7186898c1da3f9d4f373e958e5535676
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0qAfYLH8AcevDN0Z:d68Qg55nhceWu7PNU3/lAQgAT76sQuE
TLSH
T117B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4250addec8c082937ad58dc123a748628115e9bb446f4f651420288135163d9e
MD5 a3302292c788606c2da318888f96d255
SHA1 a26ce7da527abaf49e2708a617d6b0bbcfe13070
SHA512 d749526feff81f25ebf4748021dd8e005c8319e83ec4fea52d7383ccf79d37421fdc99dba1044c4d6f61fc73148d32f990c4713e4e3d2274fd26f1e60ce755ee
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:sy5112gYy5azzVvt69nLKnhZ/qGsQr
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6d4535f990b0ab939f5f8bdebdc9b37086ea069c2893e3dccda04c3c102e9663
MD5 87534fb49e81136d5a41078ba6cb89fc
SHA1 67d346041dce727ca3e2636529c61ad6df273980
SHA512 906d9c14e99f1e593c8ccc5977bc857bb2f7dd94e3526b50aea432f3ae4b272c9984d2745875c645379e69dc03843af9fa2fec9c96ba10a7baefb8ad6fa64254
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLAQgAT76sQuE:Ou6Jmdxd2dQqGsQr
TLSH
T194D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f366b205753f00d7c173d68d85ecb849a459b4006d1f1b482196cc325f460e30
MD5 5ecaa954ff2880fa6830bc7ffdc71b18
SHA1 8bc94c0305593c7ee46c89f4f2ffd9f4ec1af9ce
SHA512 9acace11fc11461fafc7f7dfa06142deb92f298cbee42cc755e0d3ee2b0601e0a3310c089a6f83e49b54ef2871fd3dbb16bceeee5fe0c61c00c386970a206f6d
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xXAQgAT76sQuE:AmifPWRZqGsQr
TLSH
T102B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7a8d12209aa59e9298b787a686bdebe156f34646ccfde386f0470f03650364b1
MD5 f498c423141f83bcc9dd908d7530680f
SHA1 bbdaec066f31d7beb023ee1f3d9e92127d98bda2
SHA512 3bda1ff42d82f78e87425fc14af6ac23f84647518632dac1a2cea2b11efa3062b6b6621d2fef5b8896e644dc3867ecd7dc34463b8b49522887ce242d76b57113
SSDEEP 49152:9SuZQIY0Be2KcRVtOnks6NMHq6AQgAT76sQuE:T5dKii61zqGsQr
TLSH
T191C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0250827e91bb2b18b3d52c60b069f27e5985928e09e442037feb511c406934f4
MD5 22e5cd4ce06fa8bdcb2841636ff2420a
SHA1 971cd14eaec0c20a65c046891ddca437fc58a732
SHA512 ee45e00dc6afe2a0bcf2529068810b60af11f9dd54b0812efffd0640c6bd37a8cd29e6e35f2a1b9aa52d0b835a6b5f931ba47f4d7975c2700d4ae5483fc7c87c
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5wbAQgAT76sQuE:dX2imphVqGsQr
TLSH
T19E95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b75ec300789db165ee8fd74d7c080e8a0fc633092a35ff5589afd81aa1feeda
MD5 da1a877135be1bcdfbddb6900bd9a689
SHA1 bb447583b2f23a7e019348b93a38180ad891ddb8
SHA512 1cd46d25d96f7d79319672ec7fec169ff7e2a583ea72e256d314d15b6d48492ad1e88e056b28bf9578596e9a12a3db11a448c06c3db4dba7e503180235f3c301
SSDEEP 12288:deAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:deAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10855235B598C30EFFCBAD1368CB791B8A3D07CBD9345939A110A3A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d556d8eb937339be6678ba33f1900c0cb5bf3549450eb483a80878a4e628fa64
MD5 25f9649b9a10ec3b1ac131f65a862c42
SHA1 2ac91a27a2d8eea2fbd4964ac03911f2922b7a36
SHA512 2e4c49f7fe8cd17ee2aef27f584498e67d54e24c59a314d42f642974f60a3142de25720655d5ddb24b426b8dedf8ba6928c5f9f1b9d7af7f55288bc68af4e5a9
SSDEEP 12288:VJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VJAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E255235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A110A3A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d390f99197f6caa09be3b93dad0c81881c534ab28c7e87066c3240c747dddab5
MD5 b33f8725731af4833e01d7abd8192843
SHA1 44a57d9142e7c6301a68b3cbafa8c20c42d79143
SHA512 eefc003ab8e9dc629823e19791b30fcb86e03928a2d3006c715a01abba81a511b83a078a4c94f45fae0be63e8d77de3935456b95a3ec2b73e27c482eb489c1f4
SSDEEP 12288:zPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15A55235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A3A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f9ef5002e7ee4e57cae7e12551559c5c1db33aa6dda0090cb8a86524d4da7c54
MD5 6051b122ffa1553f6ac7474458bfb13c
SHA1 ae87a1c261baf2b7e80007dc8aa1dbae4315a359
SHA512 17ff58c5670948c4701a0de28d3b139e47429f5addf3c3ecacfb99464159e6c5f27a35880f19b2ec581c9a4fab8ebae0b42ea1170abbd31e0770c62144c7cdc1
SSDEEP 12288:ZV0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T123552357169C20DAECBBD135CCB79179E3E1BCB9931293DF06011A8A2E3A648D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1f208de1e7e94b5b0e8196153fef1c9de4f91af65265369658b981ba403a08f7
MD5 7a7c50a9fa19ae67f63b13377deeb104
SHA1 34f6308d97373a0ae2979514643a4655ad0e0cfa
SHA512 564844f302912bf0dbb1f90f02d7d5492d68142800316ce1bb5f1c816360b48b9d81b225df0530d1bed8fd81b10b957de6b2f17f5e6d15601e5ac9da9d49ecec
SSDEEP 12288:pcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pcAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F155235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 86d7f955820c6b3a4b78bd4d5fd226ce82415922da35bbdd1b59ce8433b7898c
MD5 ffa55c0883318b499d37cadb068d48a4
SHA1 3e8460d95f50668d3034148d50574b4caff4cae8
SHA512 8ef0ea564c6de3c746385cffd7d8e532a766cb129cd722661663497510c62dd9c11071b450c7c7cf9404b43709567056a1b36687da166dbf68c656af8c2a03b9
SSDEEP 12288:ENAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ENAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D955235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A110A3A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b933e73c0afe4398a681753f2b0bb0568de8b8ccf8ac5c9ba94aea7b9e531db3
MD5 49a23084412632975e2ec79bcee23a81
SHA1 b66944681f7ed026abab4841c159a76e86a901ec
SHA512 b8670e1b0b98df3fef2f1820cc325c222479508df963848d9df70d9edb1c03a89d386878e77c013060c04ff52bd38f07540a1224c4e3eb0558e946136a52ba4f
SSDEEP 12288:cRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:cRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15655235B594C20EFFCBAC1368C7791B8A3D07CBDD345939A150E2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b65e2100210b9a0bf705320430256b289d71fff6c2fc256c465811e794b9ba08
MD5 83afb1dc72bbcb2280796d6b7623aa49
SHA1 a34906b2ddde527eb3d91f84f4f00feca9fc2dc4
SHA512 443c59c88c8a0a2baced23c5fdff543a6d295817e1c715cb22d3560d15ccfe2c6c22c24418440164165f541db22800eea98afb941e982358857f58927e87a174
SSDEEP 24576:2ZMRzFVSOpAfYLH8AcevDN0FImbwQuq3Wia7gD:2ZMRzfdAQgAT76sQuE
TLSH
T1E5750195B39418F8EC67813ECC668916D2B27C6A0760C61F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1ed95ac89e9bdf0dc4bf31e2a0a86fb5194c89ed8eb0bbcebe6599ed58fcccc4
MD5 126a9b063917dbd16d9836adc797a67b
SHA1 3eee1ff61d0c52a547bd3e1d2da35c91ec37a80f
SHA512 ad1b573540da48ce8cf5df851bdfa4bacce3d320ea8e1bac9354ae59887615b20aa68e9c740fe9a2abb346ee997bd63c90be939b9e3ea633ee6d6ed22da679ec
SSDEEP 12288:8KAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8KAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C555235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0e46dfe0c8679b7f1bb4e45edce24939de2980a2f14d218e1e2626d22a9e65a8
MD5 ef337f6703b04bdfd6b453051a929d6a
SHA1 5f086272b97d5f8d21763faca526c8ee9bf06e76
SHA512 7a4a4a20ccbf54cb50653b0bcdba9abf11b2f34c380aa907e63ed09339da99c0ad566dcd3d5d5aa58dc49fe2cbe1056f769e7b8fd364886261d7a2dd589f8e78
SSDEEP 12288:G2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:G2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15655235B554C20EFFCBAC1368CB791B8A3D07CBE9346939A150E2B8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 94e2d3735e375fb8d6573c9dafce0aae55c80bdafa16ce689fd17062af29f7b6
MD5 e6f04737e2a37ea81e49ae15e0a7abb9
SHA1 0b6c20124b4da0a65797dfd52f204fadff67aca6
SHA512 ab52a78ad6f46b4beef804d67f094e595391dbb29d9381454155ee800e37ae4a9d0635da4fc1bb1c7261965fc5a45f2dc0917980971b4d68aad3953b48596fc6
SSDEEP 24576:2zyFAfYLH8AcevDN0FImbwQuq3Wia7gD:2AAQgAT76sQuE
TLSH
T10E65010763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 32fabc9f3303cd5446f855a6869e770f97cad67bd6130caab2d17522e1408561
MD5 764331ce2d13445da245c2950289e4e5
SHA1 a8620bcd82a3620631139e220612654e99b86d7c
SHA512 ea8bae3f6a45df9604fa57fe0eb71df848fc7853b7c4be89528d22eb91161b79f510bc3fabdf41288bedb819ba4316f7be2fe40aed1b1ec8ef972dad275efb56
SSDEEP 12288:UKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DB55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 43b508bf82f2c9f49872d2272b1603024b93a402812245f1a824f6a1c27800ef
MD5 6cea914f82830436614ef67a6011eeab
SHA1 ff8103bd9e9661eda9882aece663dd2478f59f9a
SHA512 5b40197c441d1b8dc7c941f06ce5536384a287f6dd643160fe4970e02776fe37a6e96a0fa178fe7d30e0627bb21aa287b3f6fb369816e67d0b4f8060593f6466
SSDEEP 12288:UKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DE55235B554C30EFFCBAC1368C7791B8A3D47CBE9345939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4a3b43bbb29fe4793f0476171c6ef89e0023c609fac20f59ab7791975952cc1a
MD5 71ca1f9b240985d6646749382a2c9ffd
SHA1 e74697e277ad04cbba754e914c01947b231cf1ae
SHA512 3cbdd1cb844e09b20b92c3461783eacdb9cd54d091c9f9aab5cbd9669b20ee5d0485676f0cb1d6e8ac05cc4c4d1e987ad95e098e7996661984af17e24ec3ac14
SSDEEP 24576:EzyFAfYLH8AcevDN0FImbwQuq3Wia7gD:EAAQgAT76sQuE
TLSH
T13265020773A530F9E576D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b4d6748882d3889238343af0f7d688031fbdc883501b0765b3ec3b0535f1e9a5
MD5 e894e9ad63bf1ee300692c278e454cd9
SHA1 59ea4042b9bb475f555c6da811fc5af682ee8ea5
SHA512 dc93d9c9fa806d9cfb70b846c21f75d0d756a5e4cb10f55f77f9f52afa0b10ad089c8a5a22ec10262898e27374cad64668794c94d6ac6480c06c46794ad0ae83
SSDEEP 24576:ATDaLl3z0zD/AfYLH8AcevDN0FImbwQuq3Wia7gD:ATuLljIAQgAT76sQuE
TLSH
T126750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 cd4929d7776982c2c9b50b7a7e30b747585f74a6b587263ade4d04ae34b2523d
MD5 e25ae9aa4b35ca76aa1d15ce161b2ffc
SHA1 f25488fe1f1a20a6f0cdceef61092a1b7787b853
SHA512 49717a4b0a027e1ffd75899e96d21618bde80e86194341ca5cdddc0adb0ce1a900b6831de78bdfad79bc02bb7629b68143d28030576b4d01007a8a1772157aad
SSDEEP 24576:c3vd9CHKy7GZzAfYLH8AcevDN0FImbwQuq3Wia7gD:Gvd9CHKyadAQgAT76sQuE
TLSH
T14085CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 59939587ae99886d028638fcba525614242ad73a981e79e8206a96c804288d85
MD5 a0a695af6e1b7611b6629fe5c21bd868
SHA1 fa4aebda758acc41eebde84a17088a2966919e7c
SHA512 6a59baec490d6c69af2763a3822483c4a1be1cc29011c22a947e777da2b624d353affea15f6b56c18d9105ea3155a219f0ee66782eb7ee7e1f38ebd314f21af5
SSDEEP 12288:evAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:evAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CB55235B994C30EFFCBAD1368C7791B8A3D07CBE9345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 06ffd3a93c183f7f5b45098fe8050f2c1822fd5bcd35b76816c0a31e27f27468
MD5 58af5a99417d042036fe680e0436c884
SHA1 456492566a154587c417071210f2bad6099ecff1
SHA512 8a8afa70f8146703360add2eaa5acd510e8211c0f7c10f9e348e08c2655529bdfed5a99c72c3c71fc95699c0dd7fcae2854beec842a01d18d7e54fe847518cd2
SSDEEP 12288:QlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17355235B594C30EFFCBAC1368CB791B8A3D07CBD9346939A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e8ea8ddf61316afdb5f98c05dd052e3496c456c82d0cb46ce2337fd7ecaaceb2
MD5 523274bcb4c25321c014af8080ecd719
SHA1 015022f7724351cf9c2cf9ae2bd362972a44bd67
SHA512 daf80fc5c80586de3df1f351e2a15b746dc3bf7bd85ba5eff40663df1ea276fdcaecb61063b6cdd084682bf8b3ce603b9f265671394ac618c58aec41ba76baf8
SSDEEP 12288:JQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B155235B554C30EFFCBAC1368DB791B8A3D07CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8cb7fa17b4ae35e6c83031101f25f64b5e527894e6139c293f2bbbbf878e21ba
MD5 54ac961cf6123d3527b72b6a84e13bfb
SHA1 130bef7a3f383a72d394c048a46783dbf5df25c9
SHA512 ae886180429d311e339ebdf43d01b82621ebcd0598101c3882162eee3ed4442f6bbc083d71f21c9b67d0d5bce66a1ab6ce66e88fff57095da869f771fb595791
SSDEEP 12288:EKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17F55235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A150E2A897A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 13c620c009006a14ba50ed359a371c6ab61f62a94cec22bfa8f077c3298d6059
MD5 5c318f8db5cd0df7ccce2ce246ab7eae
SHA1 486d9a0f13a8f3e41e5454d2377bb1cb9fbf743b
SHA512 06bc4c2482c37984ae2ea37a0076a64074f6c624164a437efde962fe683ec93666e849db6d65bfd860a4ab25888917b885ef6404d67b303db635646ab0d9c739
SSDEEP 12288:9vAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9vAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18555235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0f2d9ffa1ffca4ca0bfc61348f95f2fbc8ebe2015c0abc3b6438e9e2258cab9d
MD5 63f68b9edd4a0b5e1c9a6b6264bc29db
SHA1 fa9c1a843d7042f15619bd6707e5e0e1d2187fe9
SHA512 e9b45931321c61114ec157d58fcccc1130ebc3e2740a9b351fd13d13cf5b2b2c98c3839a838a8331e9ca143448ad599306fb21461eabfa37218d5f26d16ae627
SSDEEP 12288:dSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:dSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D855235B594C20EFFCBAC1368CB791B9A3D47CBD9346939A150B2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 77810d1101a6ba4b7e1048f14c762848082fb30aee5d707c4e04ef993b47ffec
MD5 0e4ed8745afb635b7afbdc94f29c8971
SHA1 9a8fda4790984a8842201e5547f99964d1e10871
SHA512 ebfbeeed95a3750bf466ec1c8b34fbdc7bf0da4ab98f83b0140204a81127d03eb6e824dd3deb2816d8ed93c79f41f309cd38362104a8cc0898ff26e2b796581a
SSDEEP 12288:HcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:HcAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D855235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150A3A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c18bfe2918604f513ac9123a9981622a4d8a71594ed2539581987a760e4184e5
MD5 f3eca209373f60ca5ee8f6e8065dc641
SHA1 dca6949761760aeacc507d699599248e36a2bf47
SHA512 b1a5262466babea049941016bbd01e8b688b74b96c14bc5b292f61bfe181d828ef8a60d6ff2880b46a517b46429d1168a01c2b4285e6e4073a8cbc04d823c29d
SSDEEP 24576:kfwvUk9RX6wkyAIGAfYLH8AcevDN0FImbwQuq3Wia7gD:gMnYIGAQgAT76sQuE
TLSH
T18685CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1e39f4df24dcbb80d2ee2af1330283d72a05ec3c5773ff0f0f6f12f9c98e9ce2
MD5 0f099388ae50220c42c70cbd14d76a64
SHA1 44cd9d5fdea744f3380d503a4a8958c86ae415d8
SHA512 a7c0735940997b3be92b5ac8bcc8a97e70c91b4bc11bcdc0467013e8b4d494851067a8bf02b6995be85fab196057868b75cfa7782594548d2f312ec3aaa12039
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07AQgAT76sQuE:hySzPYqGsQr
TLSH
T1DD066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5eaf7d89c710c58036e2d08e3fdf2e9c51a92dc15f917ebe20867d0ee90bddbd
MD5 a51d8e964a95e3f01012041080a41af0
SHA1 c55d8eeb020c2fafb726018f67ddf6b9b7a41286
SHA512 a4a56e642a6e5e1406ba12c731cd967488b97546af886b539dc848b58b6294985a1fc47ad6d093491002a896190ab541ed0e5178e01738acc23002ba9e883274
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY5AfYLH8AcevDN0FImbwQuq3Wia7gD:/47JUQjTirIhCnDHUPfF/LAQgAT76sQr
TLSH
T131659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 160e39193cb5e5cd45fa9d19ffc55aefbc067f21ee41800a82c2fda2a23377ea
MD5 7730384c1a0c513f8d2e76445241f7d7
SHA1 966f6e47a8ff10b96b37d4909b9ef58bafe93dce
SHA512 0c237940819a6d246519150a83721f0d97f0b94720a9c019a50630179aee48eb3c0f421488dc0f19c503d90dde1964f13e4cc036e37b520e77f1c2db00671909
SSDEEP 12288:5bsf6AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:U6AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14965010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 9ca7520583dffa9fa2aaeb2d1df4054c6e69a59ea54d5f790cc326a993277d9d
MD5 4a499e3db24e9023a1d3df99e8d1bc3a
SHA1 e6b8baf7fe1f88410fd0dc38e9cfde7882b454d7
SHA512 91693fdf27fe729165ec9723dc27b16658d327e7f69ad5b83f466e340791b98192b96ac9876b104204c0478d736bf37248559e6b13c3ad067be15d3b7866fc6a
SSDEEP 24576:ca5DAEUPRbxMkx5pnpzgvD2hLwWX0Bj47hR:vAEU8kxHnVqDoLwWEBj473
TLSH
T164552741762AC65FC6A950325E36D6CCAB707C51EE046F0373C8873F9576628BAF6382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 256bd1620c2512fef6f8cac6b7b04ea80a200d349be648017599ddecea0693fe
MD5 5948b0216b654dae94ef87176a075e3d
SHA1 87f83d931a249ddb000c191b0ab02bc590d024b4
SHA512 5100ec23c1a87864a1c74d07800d2d8e349692959c8f5d15823bb54de7142cc5b3e2d80d1b8a82003ecb72fb15263abb0a047c2dc09d15de09074a1bfc079dd1
SSDEEP 24576:77GsgxmkX67gBgLyayZsdrcgz/qdDz54lN7d:7PgxmkX4gBgLXcgz/qdf54D
TLSH
T17A553A4165B7E31FC9BA90375232868DBB746C16BB452F0073848D3C986797EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TWAIN.LOG

Path C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG
Size 417B
SHA256 c6e87110dbc22d6a43ba6b92d0bf6ac32f362286c48c7281d9cd0def66d6379b
MD5 87bf8a5bb922099bf29642b6c3a4704d
SHA1 8fcd2ec7082c5c53df4ba96e9cfd1b6b4d3d44a2
SHA512 1178ba77ca3a6174eee544b413503247e47f0b6ab449d6b3b7ebd4e68f9acd8df75bab44ba545b6712706133df4b16b3db8bee13ec5a02cb0de0a975eadacd8b
TLSH
T127E0ECA7E41C207FF03BC41CD30E47B390518773D1424134F641767A752E15957268C3
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 971c4cf3418f03dd3edce5a043bd5554bef37990aaa76bb01a599bb889ae60e2
MD5 eca004e0627d2f9e5f7eeb3f155f294f
SHA1 6563c7554cde1c6859bb78f4bb954090f7550ffe
SHA512 a0241b068cdb88bb21a38798626ed126ab50dabcceb676b770e59ddc47b84c4bc258d52c6b95535ceb15823981776a4da39c0b9b381f0ab7987462da99708007
SSDEEP 12288:J07CAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:aCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T124552357878C64DAFCBAD135487B91386399BCBC874092D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e61a64e769c06aef84622a78d2ffad2f5456841008ab8b52ad4899115b92c6ad
MD5 8a320666c946517ab2cf256afd1671b7
SHA1 42809271298d3d0b0c3542f84ea863cff6e6d30b
SHA512 2a6a9a0bf55d9690f3ad38837d6e9aa2409a12c3e51b329e6f2edde8b613b490cacb03fb73ada89c02eb381faf54a7dda9a6e20f64500e1f927de7253f409cd6
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYIAfYLH8AcevDN0FImbwQuq3Wia7gD:Igb4mBIBhGF5AQgAT76sQuE
TLSH
T1A565AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1cafd39ffc8c7df18b2961aa55daaa2434ef0f65d120c377915d22745a6bb34d
MD5 fc1545436dbbc895a4bae5a999e0c321
SHA1 f8adc4820854dc2e3dbf4b0f5ccc556524a9f633
SHA512 2b092ca2db71dad29ed8f6cac4ed0f7eefaaa66d7a083feec430a4d4e9fffb9ee31d08d1625ce4ad9fd53b9197792d9f64e3d4b32b2395d9352d8ac9e38b3876
SSDEEP 24576:+G88u8FpJqH1bzria7/mpAfYLH8AcevDN0FImbwQuq3Wia7gD:V7ZFPqVea7/wAQgAT76sQuE
TLSH
T19885F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2b9486546129da2dbb48c19871f6e3270583b51f062e211af7f566a469c5ec7c
MD5 d77ce0807f58b353d9741c8069be6a8e
SHA1 cce117f284f41c7bcf4a5faf6cef66020a838bd1
SHA512 65117fa52b7d1cd4605eb547a545e42cab9f0b8d514dd30517f4d9697c284d573e28e61abdbf75c0838cb87fc25f1013715ece3f2782bd556f51b0ede4efe88f
SSDEEP 24576:1PUr+NQdAfYLH8AcevDN0FImbwQuq3Wia7gD:1JQdAQgAT76sQuE
TLSH
T13865E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 21518a380b3f43d73ff1e48f4a3b79e20dfa6dcd408f85bba9fdab20ef7784f0
MD5 4dff16e00bd633b95ea8237b0663aa42
SHA1 8d9e702b3d27d453bb7520f69323fad8017fb5d2
SHA512 8fe0c56aa95676973fad780cb0de43272e75a21ef581e5628d5fbfebc6dd2a41eedd3498ee27e9de5b722af7661a3d2a1b68b6c10709e4ebf7312b892f4f82c9
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNAQgAT76sQuE:cG05lO43bHqGsQr
TLSH
T1D3D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 efef3cb2887050a8d2d2a9725a256e15cbfc3e185dc1e6e9a6ad59a9879eed51
MD5 89c3ec0c47cad9459170f43f383ac502
SHA1 1a951c016c7190b6143543789fbcccf2b5038ce3
SHA512 2145bf0fcb6a53fc64df9c5976280da56ac2485747551d7ca931732a5c99256ce5354bd72aec57402f6bbd3c710c08c573698ebb2e6cf38abac83bf480e568b1
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7AfYLH8AcevDN0FImbwQuq3Wia7E:Ua5POZ3BJt2pasx2+mlAQgAT76sQuE
TLSH
T1B965AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 89e967c8907212d8ef27c464784b03848c8f1efa9b3250b74a69afeced628ab5
MD5 57ba1252bbb5ae346a26ec9f8c0418f4
SHA1 1aa7ed2e58ae2d6f3658fdea96dd84c9bf20a091
SHA512 04ede8305e2c631edeed3c1a94625a98a3a38ba120dac795f273346fba71c0780fb367b443fa2a4133a6c8de16c5afee49ddd7513415389b36800446d51bc4a1
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkBAfYLH8AcevDN0FImbwQuq3Wia7gD:RNc/zEOVHFQAQgAT76sQuE
TLSH
T101857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b369c803ed0c64b1e7bd343ba639a3716b00cb9a5049aca4a2b4fd7c84b2db2a
MD5 10826ad2306662490c59185ddc8549b3
SHA1 a4a4d2d991a2bee83ad4b03dc773906b941b5ec7
SHA512 7403ec512a735f3f4bc8daa7ee015dd10c2ea01bee34b8c3ec8e6792e928d33a541b12429d3dc2befe1fd0f1efeddca4bd8ed0c052a68fa31105578f194cae89
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmHAfYLH8AcevDN0FImbwQuq3Wia7gD:nTMwBtOmHAQgAT76sQuE
TLSH
T10155AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cf075b2b2f9b3f71efbda37142428a034a04c309a535e67887ab71d4f673cc94
MD5 d96944e1a03d7841c4e58e9781769dc7
SHA1 55fbddbb12249649b218658579faad952829b882
SHA512 3a630bec5cc6b44cf682984c73b3117efe83f966c13fb103ce4af0d10b527f0376922e56f38e4f9f9811c0c21a5fdbf2eec16b0d8d9ff303d9310cde7f53043e
SSDEEP 24576:vD3FHshBIYQgA+AfYLH8AcevDN0FImbwQuq3Wia7gD:vDVHeBIAA+AQgAT76sQuE
TLSH
T14B75E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-90-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/856-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1456-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1456-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1456-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1456-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1924-93-0x0000000000400000-0x0000000000825000-memory.dmp

Download

memory/1924-0-0x0000000000400000-0x0000000000825000-memory.dmp

Download

memory/1924-7-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/1924-6-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/1924-1-0x0000000002830000-0x0000000002896000-memory.dmp

Download

memory/2288-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2288-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2288-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2288-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2476-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2476-315-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2476-113-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2476-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2476-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3012-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3012-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-101-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3012-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-329-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3012-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3736-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3736-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3736-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3736-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3832-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3832-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3832-143-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3832-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3832-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4736-78-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4736-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4736-80-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4736-86-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5512-68-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5512-289-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5512-67-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5512-74-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5604-63-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5604-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5604-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5604-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5604-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6080-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6080-34-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6080-26-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6080-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download