ff46789e0f234115f9e08266b57f209e604ac180091572b779b22778980f55ba

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 1.6MB
Sample260809-3vckcs1vax
SHA256 ff46789e0f234115f9e08266b57f209e604ac180091572b779b22778980f55ba
MD5 9de5a975852c2c08a1ff65793b083df3
SHA1 435eddf067cfa7b19a069e4dec141805ccdd6acb
SHA512 20faa350419db9e2436eeaf87114198926a2209ece1116e5fca103849740f139b9d85f1049f81f02630fe92ac8ffeec35605e1f99b422582135d2c7bdd14b4f4
SSDEEP 24576:CsYmkmaM41Cb8NGqAfYLH8AcevDN0FImbwQuq3Wia7gD:JYdmaMsCAAQgAT76sQuE
TLSH
T13975E01277D0E076C2B231714A67E7B566AEBC705E2543873BC03B7DAE34191DA38B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5460	elevation_service.exe
3792	elevation_service.exe
4900	maintenanceservice.exe
1472	OSE.EXE
1568	PerceptionSimulationService.exe
5044	perfhost.exe
1288	ReFsDedupSvc.exe
1188	SensorDataService.exe
1052	ssh-agent.exe
3452	AgentService.exe
4476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6184a89d23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058b2fecc5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf8250d5a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004175210d5a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b201e4cb5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc29decb5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f26061cb5928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3452	AgentService.exe
Token: SeBackupPrivilege	1288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1288	ReFsDedupSvc.exe
Token: 33	4476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4476	SearchIndexer.exe
Token: SeDebugPrivilege	4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4932	2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4236	4476	SearchIndexer.exe	100
PID 4476 wrote to memory of 4492	4476	SearchIndexer.exe	101
PID 4476 wrote to memory of 3652	4476	SearchIndexer.exe	102
PID 4476 wrote to memory of 3348	4476	SearchIndexer.exe	103
PID 4476 wrote to memory of 488	4476	SearchIndexer.exe	105
PID 4476 wrote to memory of 3540	4476	SearchIndexer.exe	106
PID 4476 wrote to memory of 1164	4476	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9de5a975852c2c08a1ff65793b083df3_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c007a6cbe163d8adc7d1433cf02c613af035140d88348cf0491ea17055d05bd5
MD5 e388f2a281a0b10b16667cd9531aa91e
SHA1 c08f4b1d7f168a9928f479a3864e5b25ad8f0fde
SHA512 b9a4a7350774682146d3af7cd5efa93b53d592ad19a52a266d42216be848de79fd8bf235df2cb3ab6aa8ffd3696ab90f2fdae673a130170d00606c6e50c1f6eb
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMAQgAT76sQuE:G3q6sjB+qGsQr
TLSH
T18FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 43ab2613e2bb6cb1d6b6139688ee272f938d164b7860a39b7c76445f1e908e62
MD5 c9d92183d082c56f8d6df707da411ddf
SHA1 4c565f28a41ba882f44184f14e2f83c1e7ae772c
SHA512 fc8038030ecbced62cb3268cb7b3007b7779583f9733519136e3f4b5d4dcce6d1b2116324ab8511b0c271165513c53dc33c083e816ec0adbe10b65dd81245d2c
SSDEEP 24576:kXYfDtczApAfYLH8AcevDN0FImbwQuq3Wia7gD:DtcGAQgAT76sQuE
TLSH
T11875F12963D408F9EC67813DCCB28521E673B8A54360E7DB03A49A661F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 98e17d8b402d885b47c25e3e1534990b8461ff1ca48baea3534ef338f1a36fa2
MD5 d0e5f9558ba3609aad39bc887891b5fc
SHA1 cacc327683dbd795da36428e51d392bab3246464
SHA512 9dfa27cf1612baef2842b05774f2b81eff4f9aa7b46e10cacea7393ac63b1ac11b4f444421be9d4a766ac786991fdbb3b1ec416a7b2495b70b6d5e9cbc7cf29c
SSDEEP 24576:i0Le5ji0hmxxrMUAfYLH8AcevDN0FImbwQuq3Wia7gD:iPji0AjPAQgAT76sQuE
TLSH
T12185AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 63ab0f9e5026967316ae2741f425e6428a3423f90afac2bf42ed301fe232c95c
MD5 71b8f72435a374fba2c7a0060dcc55b9
SHA1 cc7cc07797f7a83b61e99eb7984d062eaa4a76d1
SHA512 bc37ab458716470215fc2e1d3efcf2bdd53d57551f1ecdd85aea8f3ce1bfafd407700e423e174d28ad86afc8c9380a30ed3922d371863b562e78ac5699a0749e
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyu2AfYLH8AcevDN0FImbwQuq3Wia7gD:M/ezSC6vUzPveHjyjAQgAT76sQuE
TLSH
T145755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 81945f98f9eee613d3806b5166a4676f921149770f77ede1bcf9acf3262ef4e8
MD5 b1075e99d636da789e4d5ef69e50a483
SHA1 e5ac36c385ce7702b9b32bf5cd95caa55be8ccc9
SHA512 7d9a50ec73710d785245295441d2c0c295c77e53beebe212194646c3a9d25a1776097bedbe8f7f34bbef3d45fc8925f4d1959b289706cdca233e581414954978
SSDEEP 24576:+VbqPb88hv/l+YFAfYLH8AcevDN0FImbwQuq3Wia7gD:+VO88hXl+OAQgAT76sQuE
TLSH
T168559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 af5197a86562e1673a87103e28a1161f42c9c17a557c7e015ace157b6ead400a
MD5 7d0ceaf0c96c7160ca4a821e997afa64
SHA1 3cfe9b4f8aee842c558a6d03f759b2ce114b81f5
SHA512 ea8bf38e6443ce049354c3039a543049f6df9fd22cfb695655b6c53e37f62a20b0e23a824f21f9f5451753860bb944c8587549c5a0fcf97f8e7c690d66cc1506
SSDEEP 12288:YLwAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YLwAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T168552357864C30EAFEFBD1369CBBA5B963D1BCB88284979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1e579fd36dcdf001e7d4c2e00e3d5fe889417c3edefc22034c5c93fbc4eb20df
MD5 494636dc989366c968dc8fd756946171
SHA1 9a7771cf8486faf841c00488c0442ccefa75f27d
SHA512 256ee1d2b1e26ee84170603165311050de84003836bb0fb6f1ec80c1eec8c0a2e90af97673e53a14051468110bae4106c6b2d9a92df88cbd9638ac746102b91a
SSDEEP 24576:/JIUNAfYLH8AcevDN0FImbwQuq3Wia7gD:/JIUNAQgAT76sQuE
TLSH
T1BF75CF3BEE28FCE2C67E8D795A918600E7B278704B51A3CBD165830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82e5eb4f26a02043223782830fcb5fa42d418d44403e75a8d54815137c52db4c
MD5 14523ea3e739879fc83e4b20502f15b3
SHA1 cc9b507ca70cef69b23509649de9c935da622dce
SHA512 f119af2ec92ae51ab7ca85fc53abd89e4df665bfc638b8acbefd3eecacdcfc768e1b0caf813375d72c26fe0107cdf7675d8cd3ec40cd30a8879ab2869ea6294e
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THu:hQvGAdlCEL8c/DRNw5C/qGsQr
TLSH
T1AA266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 16563a33b907f8ffe0db9bcc4ce6893d25fe2203be3b8f2c9b2aea323a44ded8
MD5 eac1cff15c13972deaaaec0dce0db300
SHA1 cc95aee7fea6d848837c41c2957ded684392a09a
SHA512 1a60e2a3317b8d9a79620a4559ecb2ded2a287d53e280b92d8be21d66d8cb1992e4d90cf140d0d5818810c79cec5d246b192efdcfe8ca24c4ae99884f62f2cfc
SSDEEP 24576:b0ewsAj/AfYLH8AcevDN0FImbwQuq3Wia7gD:4lj/AQgAT76sQuE
TLSH
T1C575E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 04b69863f9253fa620902983b4edf461dc034a842edb4cc71c8661d1914d7878
MD5 83ccb88733fe92400d909fc9e0bf9fa7
SHA1 74ed396d127b684f1ec65bb671783019455a26cc
SHA512 bb069d9735257add769eb4c7f4a36d8a2e24199fc68485c5be7b5b42064a69ba092fc6cba1f4a5b8bd04058a0516f55adccf58046db294785f75e29a24fb9702
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH2j:EUEtQevvqc2W1cpV2tI32
TLSH
T1C6474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3ad79c62e57c8f81d3bd38609e0fd6a2f4380f05a9a392a3a34281329e1b56e3
MD5 f4562d98d698f513c51e225bfa7181b3
SHA1 632986b6dcc3f2d0fcbb6416a1a0d4635fcc2ef6
SHA512 48f4fb997255de16acdbbf8c2c3d034e92e7958e25342dcdb537e6044fb27ad3b208c277559b846b96a480ffb656099067c9f6055a02c3b89227f776c4cdbac7
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/zfAQgAT76sQuE:OoquVjnmzqGsQr
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 29a923ee645f266389b2856f7a7795858033baaa0b39bc4a6c47cf58a4a5ba09
MD5 f5658a67d9cc27c038f4bbde59b989bb
SHA1 8261b9b2becb8b282546c4f2b91223b4ffb97213
SHA512 7c3e8e1ac6e5ae1f88912848b5a86b6943adcc401c9f1105a53edafb5b069f8fef454aa90b13c0a58642344f38b9da722081c415ee2ff65ad9fd9c2daaac824a
SSDEEP 24576:xAhGL3IFoiwtA5l7S53aAfYLH8AcevDN0FImbwQuq3Wia7gD:xAMUFoiq5qAQgAT76sQuE
TLSH
T159359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5307fd1ddc9193d81037c35ecf2cf3e9a6e30016876e0eb1eaeb76b9112e67ba
MD5 dfa3352cdf9e7310b7abe1b18409a894
SHA1 ce5561040724bd43237c873ae7809381efa6f786
SHA512 644dacd30638122ee1f8ef585c831e24855ac6e4189cbe52b7eb2635f554e5fb75155c50940549b06db795c06fde7d6faf5b83c533450fcc7a35a8cf6c6d2a6f
SSDEEP 24576:Wwu4OWDAfYLH8AcevDN0FImbwQuq3Wia7gD:WwvOeAQgAT76sQuE
TLSH
T1ED65F14676A81CF9E9A781398997C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 feb7d7f778a3c89d10d56a48330b9d3957a6d8eeaf4a49b31b5447f0fd06e22e
MD5 dcea0f0428ae2f988fee694de2807fc0
SHA1 c0e9c5b995e4e137ca2716f305715cec85e280f8
SHA512 1bfe677afdc10dfa8f2c36c29121b4656b1951a3b36f6bcca6544c30cf87abc242e3395755f7ead562c8428241fad6a3de226bde12fab8e7570913968641516f
SSDEEP 24576:OZu8AfYLH8AcevDN0FImbwQuq3Wia7gD:IAQgAT76sQuE
TLSH
T14B55129B239830FAE5A7C239CCF25665E3B27866532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 922abcff4406a0c001a9b40213dee6cb4692e600e1dc9ade1928217cc2848b5b
MD5 e70343ef42fc075bb9b7411a07a5d7d4
SHA1 a1f0ba6d88d73299aca53a2f2325a694cf7c09e0
SHA512 a3595564517b4f0ac05e40875062d0dea53c49ee5c21a6c478266a36eb4fd9bb437a67379823bc3d6e7b64cc66c4323edd8ef44387cc1128db5f5ed1fc8d5895
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:9QRQyi36YOcPbLvw2gAf+PN36qGsQr
TLSH
T1FE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f9bd86d759189cb8dea9b9a999e031b449a61b52b69c525b4476d8cd3702878d
MD5 85b397bfd720f3172a8c936fd442de61
SHA1 78e4256c1f62c81360336647973c2c6a169fbd1a
SHA512 0e1e6f838d8ef1ebda77fddcc931e22a66370404666d5dd38b4981bcddbc108f5b72a1f683db7b8812ed551d7cd28445a418133c5af98149f3bf7b60e2a7f3c1
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:cQRQyi36YOcPbLvw2gAf+PN36qGsQr
TLSH
T19E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3117fd7c30d58927a756c7f33739f93681d7b9e4bf495dd3518018a20b0fd9b0
MD5 7e74e44bbfa4fb096fb11e210ba71bc7
SHA1 60c87af74d80804ca766f6027ade3cb919c703b7
SHA512 eb4c24bea45347b46bc323dafded968114838e40743760897a7ad0671eff30a9c70cb2d49d7eb160d54b0ab8344d60e0d8ef1f3c47b349c2c9aa6478af1238de
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0MAfYLH8AcevDN0Z:168Qg55nhceWu7PNU3/PAQgAT76sQuE
TLSH
T18EB54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b745e1ab7d9fad93664867f2e27e770b8b30ba6518c95e139d8467a2e592e985
MD5 92ece3d211f0447341f28625a0a06fc3
SHA1 446bb4841eec901b01dc9ba9607c415231c5e1c1
SHA512 47e4d179e8f56ec345d728ef67298146041ac235e7867845922dc19fb4b3b59950cd1a8d036c34845c04407a14cd136143afba5d2b77e88ec6aa4ab651e04a29
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:Ny5112gYy5azzVvt69nLKnhZlqGsQr
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a89b51d80b173e657ce5867265dba6f6f8dda0f7c3abbb197bcc053cf3ac6dab
MD5 01830a6243c944696f68f66fa448af55
SHA1 bd79942277c1ecb0f635bc329383c612a913823b
SHA512 cd0a05feac354d37ca3aa3b53fe1924d5a82b66673bf5a13cfe4cd94c409489e9b6604a2be71486d47d79efe87a862690a426bd15f1ea6b861f4294e2644d009
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5AQgAT76sQuE:Mu6Jmdxd2diqGsQr
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 787e15f9db3c4d6f892d846210cf7484bf2fc205802ab66c0865c006862c974e
MD5 a1e2002202f0684708c382dd73a911c3
SHA1 fa9dd94a2d08df51689b9e186da196ab03f83957
SHA512 07c9719da85a2a9b4ee689cf10c742076cb190c8d4f6af6d842201e7468d96e7352f86d536b3b1f133f3ac63ce1bd74dfa59ab3c785c83fc7c4cd6fdb59819e5
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xtAQgAT76sQuE:umifPWRzqGsQr
TLSH
T1DDB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d0b97b504b56d6600326bab620e7cc1573d394efeb5e2f2341d24ecb8db2f3c0
MD5 c8ff2cdc40dd390e9d034b368f9452a0
SHA1 06732518a4c8354e2711f623abc873117c9f9add
SHA512 e75589bdcead3fb42ad14143f0757f499f208687942243778081fc5e997a74b9870ff6faccb3bbd2435944118449dbd85dec5227566310e2ce0f24c933bdb1ac
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHq8AQgAT76sQuE:+5dKii61BqGsQr
TLSH
T1B1C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dedee2a22cc1bbcdc6b127b1b7a8611a77c2c812aa6c2c16fc39bcba3be877c4
MD5 becb57bd76bc530b0a1eae4163a7b3a3
SHA1 88f5a7f7ebb3b234c5b125c02759313787941e94
SHA512 79785608ca0463cbd0af1d9785b246ac27a8cf1475cf11cdc8f1d42e2d9fe38143e3bb833313d64a9e243371ee3c7ff22f16c4ce2dd063186b49961591de2c94
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wpAQgAT76sQuE:0X2imph3qGsQr
TLSH
T14A95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4efd45df55d0f3aecc182a371f7118ed44432b3c9fb95d2cd23c94b5e997c95c
MD5 63412fb52be4d7bfa150ffe5276959c5
SHA1 c90bcf201efb6ad9fbb7488efc3e1bd8e9e9cefb
SHA512 042a099cb1c2455da1163cc5f44aa031702848eb80c1296064f3fa5f9a02814a73869c2aa606dac8c56473d14f2e78d1ac25fb71d60e2c937ee71763d8449891
SSDEEP 12288:PYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16255235B594C30EFFCBAD1368CB7A1B9A3D07CBED345939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5077955d75982968755497a18bf624eb0dc2270d7f9c50f0496f8d550530691a
MD5 199a2370b6ba2ab26c7f53099ac0c5a3
SHA1 d2ff4f98887da858f2162a451c39754c9a6767e6
SHA512 ec60768a71e51605a59a70aefba5376ecc7833facddc8c47a4c483ac2adf40b051680b523f33bef98bc2d48b0c1304de84b3d12392c72b6ad8b0cd73d533da1c
SSDEEP 12288:NbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14855335B594C30EFFCBAD1368CB791B8A3D07CBED345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e5b93b412f2983c791ea17a651022856ea99a29ba30fa2da161ec03fac096328
MD5 e11f489e3581a95d0d8465a577a10e35
SHA1 3d997f4768b1da4cad7ffaae793ade2e0b3e452f
SHA512 3e638a64d7315f69f28a29f4303436431bc37e76277144a915f1a8b1f5884ebd7a86184cb23938279fcd655ae6d032b63116118a9af9735ffd45248bb2f557ce
SSDEEP 12288:hVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hVAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12A55235B994C30EFFCBAD1368CB791B8A3D07CBED345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8f54f01f2d9011259ecc4e66532dece1ae5102048ea84438866142922a5ec22d
MD5 95f056c5926639712a0c8ac09bf43d65
SHA1 b88d540f6061d9b470ef14fe1ac8dfaf2f4eb3aa
SHA512 259f340a2d3ef8828bfba6844bc294044a9fe254850b482f29531feebb601de079e2b8e66b1849660ab7e16c821dc879ab31e1b047cf80af0fc0d7dedf41a07d
SSDEEP 12288:QV6AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T102552357179C20DAECBBD135CCB79179E3E1BCB9931293DF16011A8A2E3A24891F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1a1ef9bd11d4e2d382c7d136c701976582c738a870be6a51aa1532197ac2529c
MD5 e95143d5914eaba82dd860b4af1eed7a
SHA1 9440f735f168927a1ead49665857c84a5e33b072
SHA512 9929c7e04b5d1d107a0855cf312e04ef27c6e7bba6ff9bb5c8567b4a4aa3814666d191cd8adc38d5d1fe4cc86c111fa045b2cc2de5995b554f95fb4a56b3ea4a
SSDEEP 12288:iyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19655235B994C30EFFCBAD1368CB791B8A3D07CBE9345939A150A368A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 72a13120ea0aec94683f6f5a0f6f207a11138c973a28e2ee9a15860b036362e0
MD5 85eb9b95dad2bdbe7a1e66c7e7c0d8d4
SHA1 dc90da7b66a003704995fc179882cba40037fbb2
SHA512 458fe63215d2d59dd4de81a137449a45a474c0953db18e0711e3e97313bfa06ab186366aed703f33c08283fe118c99880244781a8260213f6752d18523306743
SSDEEP 12288:jHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D555235B594C30EFFCBAD1368CB791B8A3D07CBED345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2353f94124ccff52b337d838e6f0865a732d260ab40a15b7310ac178d96af45d
MD5 99dc8d626e3802497604392a8b5239c9
SHA1 5211e51833232d71e34b73c93d51e21b65134541
SHA512 d6ebc166e4627e7f17b4fb424e7016b7f901684bc8d0dd3005c82b027d522017d1856e57d4371bf811552673e655edecf3c27d6e789a68d066c364ac31d194a9
SSDEEP 12288:iTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15855235B994C30EFFCBAC1368CB791B8A3D07CBED345939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ca55e44d53715f13f4641ab95939e711d68661bf42486fc3808e976e67403132
MD5 6856322aa2f421f893b2d8140b6532f7
SHA1 865902e32d818ed0c984c445137157c2c9f0d6e8
SHA512 f00f1768b505e9d6fff00f3f861c012165ac140c1e9cd9b98ebcf4a66f2af6a2501fe35e6e99479d323702f12d323f094a13dae9a14dd03d515c3a190322e86c
SSDEEP 24576:WZMRzFVSO7AfYLH8AcevDN0FImbwQuq3Wia7gD:WZMRzf3AQgAT76sQuE
TLSH
T1B0750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8c77c27e0c718f48928e4cf224b57716d174436bece60d913255f40fbd478fb3
MD5 6e86c21684c8fc8a0d13e5a6b92387ce
SHA1 d75800f6847df22b7d8143f78dd9b151d4619561
SHA512 41cc80503b1438bd05a213b5136a32efbb8b6ee397ad77eea9a8f7a9739c002d83ca834b6c62d927fcedf1e0e0428b40ae06fd2d9fbe6ffd8afe40c02f5ddbba
SSDEEP 12288:HsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:HsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E455235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ed6fe33d9dc79a0efa081d8cf05f2fa55c44732f98f245b5dda2aae26aefd81b
MD5 273e2eca5c68db6a65dab930ff172371
SHA1 5c969a8ed21d900838fe7b68028a2b3eedd57008
SHA512 c040aee8f49088e81cc995f0e01ccb417c663a97166a142ede4f85e10762a8802c233c05db36200ec791013a877d2f4c2eb6d7afef2c70a071395b23ef3c362c
SSDEEP 12288:dgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:dgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F655235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f6734174f4f491c78dcba4d751150925c5ca15c0de84e28fc4cbd5c8dc42fb20
MD5 5625bd4a86c46a6fee377d95162861fe
SHA1 92971c40ce70c49910c36ea254b6b73d4c9790ae
SHA512 0c03aaf0a62cd58e355285a8a8f73bd66d245c7dac70e5c35425f972111d1e8b9fcfa0ed1da22ed473e6d2c9b77925e54f492e9e30bc98f8920742280d89088f
SSDEEP 24576:dzyvAfYLH8AcevDN0FImbwQuq3Wia7gD:d+AQgAT76sQuE
TLSH
T13E65020763A530F9E577D239C8A21A15F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 09021d784c0e7196eb84c045aabf2fa68bc81673ec5a7ba0e8925e071d289c00
MD5 fc60331f0ee612e9e30fdf6eb013193a
SHA1 7d38fd02783e62758ac5b4f78e74935463a6e7ea
SHA512 d910f574d684b15dfdb9dfee9ab1f61418a1aa24f6aba3fc7f19ec6ee2f5a7489b94bd02b7d23c9f165d97935587af1051a517010713e3157f488651a4a1fc88
SSDEEP 12288:msAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:msAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EB55235B954C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 93e639eb2408ee65c36e13ff78ef3f225914d28e494973c4b7983c8e0fe02ce4
MD5 948b3931e6b06f5ce5e4504f4fc043bd
SHA1 8fdeb098b88a5e8eb1c08537dde25370c8085c4d
SHA512 a58afc668f2020bc169de5cd9531f2f960a8c26aa95a1f7b2677e9aadb8cbb1b88465ad0c9fc048b507eaad1fe3d37145875da16899f7f7123cb4f57d0ea1dfd
SSDEEP 12288:VsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AE55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 222f4025713082d7869149b08f322826b141a02b764949f36520c385d2f93db7
MD5 3eeaeb5e86a8c279f704416156d8f926
SHA1 b0a9a1bdec60ef90ca4109285f16192fffc4d5b6
SHA512 a7ca7da124c79f49d62827304d13deb6dcbcc12b1dd782b7ea43fede09d5cbe3843f5e8023a0d3f0f71a8a1d301a4e4f93f131855743cf1b956e4062315861ef
SSDEEP 24576:yzyvAfYLH8AcevDN0FImbwQuq3Wia7gD:y+AQgAT76sQuE
TLSH
T1DB65024763A530F9E577D239C8A21A15F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1e4b4d1a94471b4b693a9aad8a5a6f64fff60ea656bc9708c75ba7d1fbb80759
MD5 2e8ef7e306a56970c6bdc9d264f91381
SHA1 b4989bbe085fba7f1132504ff2ab6ede576f3e6f
SHA512 f002cbaf5ba6015698f46241e61fd6022e4eb75f123cc2c79c9bec27def196aa7abc9af7a0dbe2fb11168eaddd4bd9121c88cb120b63951477025721c40f892d
SSDEEP 24576:ZTDaLl3z0zDlAfYLH8AcevDN0FImbwQuq3Wia7gD:ZTuLlj2AQgAT76sQuE
TLSH
T1507501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373605C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 580cb47b1ad1fc5b21ea53cd1875d38703987dd6fa9f91138558ab741b3ac551
MD5 e2c8c2ffa89d93f953043b992e658d4b
SHA1 b19f8651b8e788ff3bc249ae41ee5248747707e1
SHA512 378ad8483065d9ee12fcb445974347c5a6b99ac6bec740097a03f8833004393f0377a5b8ddc57360df60a003df55c1b0e5c5704d4b740b89c43bff1149d94f78
SSDEEP 24576:F3vd9CHKy7GZRAfYLH8AcevDN0FImbwQuq3Wia7gD:lvd9CHKya3AQgAT76sQuE
TLSH
T10A85CF91F3E810E8F0B7DA358D765511DAB67C6A1B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 596d80b75494cc22aaefa39e2cba9d0cdbd9f865ded8bfa6ee904b62d094b99d
MD5 abc05d6a53fe9c1906bd0d87241d6e07
SHA1 83b3cfa681c02513039f886855bfe1600b641b99
SHA512 8b506cd1c34f6c5a814ac7992822f432a116495d3bfb76189b6d5fc28ed289c4250fdfbb3694b2916bb64e3789c1868ce704765648c9905cd94a38568eaedbb5
SSDEEP 12288:j1AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:j1AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15E55335B994C30EFFCBAD1368CB791B8A3D07CBE9345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e0e3d064d80aeb0cec124d56b4f089c8c0c65847bfac019bbb601cfb8b9b942
MD5 dead60ad5d16786ac0b030de242ad79f
SHA1 e52c166c5877cfa85334358fed652b5bc111f27f
SHA512 cd163594758c5e316be4808885b74f96aa4160ae0498d8ff8262fa78ae6b4f4f3103b00ae5c0d1d6d7a601ed33f81409c3f7609af0565c79ff4c997a130c213d
SSDEEP 12288:ePAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ePAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11055235B594C30EFFCBEC1368CB791B8A3D07CBD9346939A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f47c50131fea78621a14d27998d8f41535c3b6b103e94ea678fc892a2d34c409
MD5 267f1bc349af95be8364442b70aba4e0
SHA1 e144f88f264acd7d0c43a23adc05ad2b9a9df860
SHA512 dc35d13b58db1f11f7a0126a0f2fe40e9aa834100248fb2e863f45b989ce412eeb278192f73a91a3c46adb1e90d783661247cdf54a2e157b3a6d3c402c5f7e2c
SSDEEP 12288:5uAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5uAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D755235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A154B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2e3dfd383eacbbd3b730e00c95134dc184a9b3166c6de3560afd659a204dfbc2
MD5 333ac90b0a5e5cc72deca7579b22e5a2
SHA1 54b9e52e8aeefed8c913ab17ff80cf5bbf8c80a9
SHA512 ceda65b052a4d307b7c926f9905cf7d7a533a74817992a1898cdf713423147bdedf77eca6920fba5186f6cd6c9c6be07432397ec937e3dda06405d57c2c530f7
SSDEEP 12288:KsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15E55235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A154E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3a1bf8f03c485181e97e9eb0cc5bf2331f9a5bf1d36c3591fbb53ed7c9d7ab46
MD5 c5a6b57e6f34574457e816a75445806d
SHA1 5ac9c17d42cdae5d0d4a87a26bc5b8ae2d6fb2b6
SHA512 fb3da604cae6d291fd3ff5736996cea44c31cfd0d174697ede255e7f0196f513a6b58aec7c44b6ba4003db1d0fab961b9f1e391f4a854b6512f99d57e0b6a948
SSDEEP 12288:W1AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:W1AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12D55235B994C30EFFCBAD1368CB791B8A3D07CBE9345939A150A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1a8e15f116786f23212651c607b8ff14751478816e4ef20ca70e7c67e392c968
MD5 88311d85358f0501e7378f0f6b425a44
SHA1 4ddac49ce4ba117893ed080d5c499d737f8feccb
SHA512 dde0b2a75e692db00455661edd90e86020b2e47056443cf6299afdffab0a4cb14ddd306f00add7a2c0182478ebb868d0b98c3a0740bfbb98273e217bbb3d834e
SSDEEP 12288:pkAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pkAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16855235B594C30EFFCBAC1368CB791B9A3D47CBD9346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b52fbe2a9c7ef5eef366125297b86758cccbe795b2381a9a07fe270d97e4a3e8
MD5 4bd0cfe0ddcf992de08d6ab8af56c3f9
SHA1 bbbeebb7585ea405fb0fa7ba135908ae78cfa500
SHA512 59bb47c222cbb7a795e235e9f3c8275cdc074fafb1bc2a4bdee69026d120d2da0d33e8e6a9f1d482b4568e40fd82afd956d3dba5190f6b7d287e914c271fdfb1
SSDEEP 12288:/yAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/yAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16055335B994C30EFFCBAC1368CB791B8A3D07CBE9345939A154A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 508f04ba8c74e58255614f81f580fdb06f1e5d87060c4cc3aa1e640af4ddcd87
MD5 56d8ffdf2f793b609b49678ee90d4681
SHA1 bd48cecb752fee861c5866b2f6f31103a654f960
SHA512 d92b4ecc2d32928840623aa38924bfa3aeb7172273dc10abb237be4eb76608d42074b34ebecba3ff546b5489564a8ffec063422a302d32fd9acc71d128c093ce
SSDEEP 24576:AfwvUk9RX6wkyAIQAfYLH8AcevDN0FImbwQuq3Wia7gD:0MnYIQAQgAT76sQuE
TLSH
T11685CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 269fd1eb090c39d9483ed5bbfa04e7a04a87ab39282030e9bc38f4617dea885d
MD5 1d779bde0f13a43617836081a2fcf895
SHA1 fdead77ea5fbba3ea39c6aeab800fa7cc9a226f4
SHA512 e32a9fb556c25371756fd8824b7e150fedc567ade848aeeb113709d5de73524a932c4d72924a9c8492f7f58ea3e8a026a34ce0dafbdbcf14a435e2fcf3fac147
SSDEEP 49152:8YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JAQgAT76sQuE:7ySzPaqGsQr
TLSH
T19D066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c9d1d3cd68daba483defd66067ec28a35b86b473087b9d4bb4d3d2da6579b2b0
MD5 9d671373fcc8d0f06652989d658fadce
SHA1 4f5d45ab22b723ba9eb4b349a4471adb350f8cd8
SHA512 80889c72a39d601ab7daf435c91c5168a8cd73c8f33caff4427d4d1693ec2b45714f482d761e752e88003ec8be7a065d93f4daccbc2cb2c770970df89c79d6eb
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrAfYLH8AcevDN0FImbwQuq3Wia7gD:y47JUQjTirIhCnDHUPfF/5AQgAT76sQr
TLSH
T144659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b6c363e9584235ef364c1a1001b2a2014652a18f65ee36b394b1088e6fc91679
MD5 0a60b6d23f87b7810d14aa75d16dfc68
SHA1 ef4ea088bbdfbc1593bbd17619306d2b73922133
SHA512 22d1bafff6abd0cacd465ee8129fe6b7ad3981bfe123711d5644272010d99f0658236afd50963ecf4c572f302e2ce14667376bc174c00938616a023618397400
SSDEEP 12288:mbsf8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:N8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B865011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e18e5da11996b3aac85c9130b08ca190332aababd86e494e5129f6461778d8de
MD5 5768c55a0f4fbb2aa598be480981eaac
SHA1 e3f12f74a8e58f7e70b7c83ad21062dd64e8b5d0
SHA512 109576dc42b5682e0a3d675adac21ff392d29fb5e432565a6a2aab1ddb9459ee1f15f36e4f9431de7da63460faaf5bfb3735ee7978ceb6a0a4f0b7f428f4fbfd
SSDEEP 12288:DXkmU3fLn2BIg+FVKpBb3z1bfJcfsqcXFaT4gJif:DXXUPLhgGalzlfJc0quaT4Z
TLSH
T17C3518517666D75FC66D40321E33D2CCABB07D01EE04AB0372C9972FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 cce5f710fc0393ca59dd403c8a712f202428342e8bb4b382e32307eff1c99fea
MD5 db781e495d07e7c2bed7ce38f381897b
SHA1 99af0a70f96f0484a99314a257c0df9ff80cfe45
SHA512 4359fb477648f1de308c90cbf7a094b46e9af7f6b33f4dfb84e447cdc6d79ed635f23c073126cccdd7ab53a88e8d61a5f2309be7e5437c54df6db11906a39dae
SSDEEP 12288:FW5M1tw9h1DIZMB+iJIB0UgNYiyWWaNHa2VPtEgkDYfB:FW5MUB+iJIBGYiyWWaN6SPt6DG
TLSH
T1F865F9406536E3CFC1BB6072072A6B4CBBB4EC06B7095F2673C8553AD86A705A1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 560fb614da0ee0e4eba4143c8a2eae3723e280cfb176c71b4e195c961b577516
MD5 68bf7981a76aec214f636dca9194e99b
SHA1 d6ae5f106652ee703f344cd5e1239bd6903d78e0
SHA512 71b80430c662ee6cac455a5b3fe2ea34f655c2837a0e6ecd0346be8a9bebd65bec5db44c208005355f7df7f82b1e8a3ebcdcca1c36439ca3a18b256dcaaa2a1b
SSDEEP 12288:S070AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:D0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11A552357874C68DBFCBAD13548BB91386399BCBC874092D7640627CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 98bc0bcd90108f58124bb93ad085f3f56a929a80ba54c01af81db46789775078
MD5 9db4a22b004ca6a600da3a681629ebfb
SHA1 d6112256f77393e9f71bb9bbb3f195840aed7d2f
SHA512 0174acb72f80b4d9687704ae13b667176cd7eaf00d49a8dff23fbb12cf7343ca7acf523d550fed5cc670f5f7a7df083a5de34303bb56dede73639a577638acfc
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bY2AfYLH8AcevDN0FImbwQuq3Wia7gD:Fgb4mBIBhGFrAQgAT76sQuE
TLSH
T18E65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e26011add15b40188359ac3820caf938393bf00ba61eea558af08dbbbdf491f2
MD5 ea53c18c0d686cb5fddc3380ab8e6660
SHA1 42ef8c26d0ddacc047540b6ac38c9f8880599099
SHA512 4c0d616739d722e1f44f2783fab9099324bc32bdda8f9e4837a6d6be1d5bc0d98ea72ab507c4c204799ee73fec18764c6421fe5687205922c0cdd1aedb404f52
SSDEEP 24576:iG88u8FpJqH1bzria7/m7AfYLH8AcevDN0FImbwQuq3Wia7gD:57ZFPqVea7/OAQgAT76sQuE
TLSH
T1D485F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 63ecfe12a63d712b386f395585f459508d6840dbd5d13b0940512362ebc3f20c
MD5 cefae99ccf8c74470f412926bb67ec9b
SHA1 a01514e77c666c8028f63972d6683a340fee6635
SHA512 e7fb5741ebc68b063f2e6be745ae6d6a0b524e289cece5bf43c3058275aa9c7e4ddaceccb412fb735b7f1aebb8a67f475449678a01c99c42b297671646e597c6
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHAQgAT76sQuE:wG05lO43b9qGsQr
TLSH
T120D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 202678d2ccd748cb8469da0744c49ff081b8e27b66b8301f4c6255d487d6f17b
MD5 07331afb88a814981fe5244b7628dabb
SHA1 b643b501bda266784dd4f42f457d64ea397e3c6a
SHA512 20310c31c3e279c0e1de6ec26d653251b803e04f74fd72d13a2cfc8d2c278677d39d36ef39f90b8231b8d4d995252994cff1b2e5e2bfd12fa5f1cc687f919be5
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJAfYLH8AcevDN0FImbwQuq3Wia7E:Va5POZ3BJt2pasx2+mPAQgAT76sQuE
TLSH
T12465AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 00da3c13fd76685a0a197d3192e4f84d42af8655cf00034555f959cc2fb274e8
MD5 9f7ff9fa45a5540d87b305123faab98b
SHA1 48da9bc26334b3fbcf6d677c25f5eae36bf83b8a
SHA512 ef58c2797a007ba4f99012f2d932882a8612249237bf5a76e704edcc4ae2add851b5dfe8481da827b7dc5e32fb395b19ae7577c5ebeedb832744ddb27aa8be35
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkjAfYLH8AcevDN0FImbwQuq3Wia7gD:VNc/zEOVHFuAQgAT76sQuE
TLSH
T133857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b4c3d1de02c0431df06495465f20dbf1197d0ce2d5f0b609640df2fb86396480
MD5 0c09ceb4d38a8017472a0e972509fbfc
SHA1 113767f54b4079a6d895f599ce21dc1a2750cb0c
SHA512 a71f79b1deb958dcca912ac5d81654c3b7d08b2079105c3e77331e43432449c454e39b101d0a71d791d9b54cabaa200beb2c5105f299d3bcb8894cb1aa2ed61c
SSDEEP 24576:LTkNvNnaFeYhJNtmZBm9AfYLH8AcevDN0FImbwQuq3Wia7gD:LTMwBtOm9AQgAT76sQuE
TLSH
T11055AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c5f2bded3ae70e6f12dd1d3be75273675c471bc9097c4d63aed2acdc9d25adb0
MD5 b62db7d99c430157bbbaa86760e62df0
SHA1 dcb0ca161b5cf679774566251ca0d79c1639f819
SHA512 b5961f409bfb6d8d300618b88678decef91bc5d531dee642e36bceaac75274a40016828e8a822770578fe85fb7c3211d6c463c1a05fbfda48994fb8aaddd9ae6
SSDEEP 24576:BPUr+NQ3AfYLH8AcevDN0FImbwQuq3Wia7gD:BJQ3AQgAT76sQuE
TLSH
T18965E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c3a3e7e5d05b90c0431a5988dab705f7f3f6c5e37bddc2ec85cd35312b1008c4
MD5 623b0f4536e07bf475e93190b97935ac
SHA1 bc6053d8c88998ac5c0b8be624cb373bab4ded44
SHA512 bfeb79122e05ac5c2bd6a07d673206f3be9bd94d95b02cc237323641d0744c5a897b9091db0045fd6aa152e3a89779dc7756bd45f6ac5293bc55fa27897f934b
SSDEEP 24576:ND3FHshBIYQgA4AfYLH8AcevDN0FImbwQuq3Wia7gD:NDVHeBIAA4AQgAT76sQuE
TLSH
T15375E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F3BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-305-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1052-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1052-106-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1188-306-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1188-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1188-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1188-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1188-101-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1188-95-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1288-83-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1288-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1288-320-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1288-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1288-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1288-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1472-270-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1472-61-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1472-55-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1472-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1568-290-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1568-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1568-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1568-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3452-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3452-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3452-120-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3452-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3452-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3792-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3792-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3792-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3792-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4476-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4476-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4476-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4476-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4900-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4900-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4900-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4900-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4900-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4900-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x0000000000645000-memory.dmp

Download

memory/4932-77-0x0000000000400000-0x0000000000645000-memory.dmp

Download

memory/4932-8-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/4932-1-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/5044-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5044-302-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5460-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5460-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5460-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5460-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download