603d91a2c8395ff45cfbbe09155c5c1013fd5d5b3e27938e9cc3b4168d385a1b

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260809-xd4dvstenh
SHA256 603d91a2c8395ff45cfbbe09155c5c1013fd5d5b3e27938e9cc3b4168d385a1b
MD5 2334acdab0ada8744f330dfa33614488
SHA1 ba88c39b551ada6a1b615c82e14cad8d6684e316
SHA512 9cc3fa7266fa7cd69d66ab713b738ee82af76613723e049172071a9d024176409e1f4e19467d66cab58046a8a62ce4e65e8a7e4c19cd8b7ac7bc332fc124890b
SSDEEP 49152:j0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3XQ/lFTjN4:j0pxfbf+/4h9hNhBX38Lm
TLSH
T126A5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5064	elevation_service.exe
3800	elevation_service.exe
6100	maintenanceservice.exe
5152	OSE.EXE
5468	PerceptionSimulationService.exe
3436	perfhost.exe
5796	ReFsDedupSvc.exe
3720	SensorDataService.exe
5776	ssh-agent.exe
1076	AgentService.exe
1060	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b108d88b763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c051f7812f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000253107402f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000936f58402f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000773125402f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4eb53402f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d27c7402f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd54db402f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ad4ef3f2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082a88e3f2f28dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1076	AgentService.exe
Token: 33	1060	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1060	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1060	SearchIndexer.exe
Token: SeDebugPrivilege	4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4664	2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5064	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 5280	1060	SearchIndexer.exe	100
PID 1060 wrote to memory of 4564	1060	SearchIndexer.exe	101
PID 1060 wrote to memory of 3108	1060	SearchIndexer.exe	102
PID 1060 wrote to memory of 3844	1060	SearchIndexer.exe	103
PID 1060 wrote to memory of 1148	1060	SearchIndexer.exe	107
PID 1060 wrote to memory of 4024	1060	SearchIndexer.exe	108
PID 1060 wrote to memory of 5080	1060	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_2334acdab0ada8744f330dfa33614488_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2592 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2592 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cf022450f9e011a6c69c5fbdbf7065ceb9c4e4caaf6ffd34e87c2802f51898cb
MD5 2f46ef69ee5990d0c1a8e265b96040ad
SHA1 bdcc4c20917975168ab523bff7aa1557bae0326c
SHA512 1380900a8cbee78533a63afd7842ca5e0241499d96f625f0b3ff025d5b7c237b8291fce344839ab0705b4bd87503e675fb7b23b3464e1c80c36c7265732c0281
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:d3q6HjBSLm
TLSH
T14FD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bca9b6e50af95957a4cad3533927a84920192bb352403b44a98ae61d7852e9f1
MD5 aa4b21eda0f068ff59d64bb29d772deb
SHA1 33f8db123d8bb23ee55bc45e7b0525ab61bbe2f6
SHA512 e20a68eb7db0eb1b8fe9d694a207c31834bd825a8cd0c519899b752a6e3d375c0e4ee3be146fda8fc31f8b47bcfe23673f5516a75011f81341fb3a31b1f75e1b
SSDEEP 12288:71XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:BXYfDtczABnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T19965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dd541ee25eff3d295cdb656bde21fefa10177d140b37a6532d2cf24d8b65a625
MD5 a8f6965366fd8510a7ce8334ba250806
SHA1 7ae302a269989ff28041c7b8375e517bb344474b
SHA512 681a0e3f788eac157824fadababd8070114d4b8cee1f3e9bceeab6b8edba469a241b94a3434db2fec70a971e846f2983f589500455bb7c6c1e0d267bcb26831c
SSDEEP 24576:D0Le5ji0hmxLrMenQ/tbw/2Mkjy6Fr7g0oy:DPji0AlLQ/lFTjN4
TLSH
T13B859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f81c47c65f3270cebabed9fd04146303763de9a69ac4f2f6c5fdefdcaa23ea83
MD5 7559dc58114eceb3eb6d27b77ccec633
SHA1 94db625f7a5a2869839166de9f99b4f4ee813056
SHA512 99e9415c167f9af44464a45515319ae0c9a367d3604ffcdc52614177f75622a09df41feac2fd4b38711d3c2bc4cd2066777f66735e0ff7ca3613cdd0cc4909aa
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuUnQ/tbw/2Mkjy6Fr7g0oB:c/ezSC6vUzPvxHjyvQ/lFTjN4
TLSH
T127755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 769aeb14115abd549366b3a63c4b1d3c7df81733b2fc693490b1577a8b633e57
MD5 08f13c777a5b4de9a4dc907a014ebc3d
SHA1 046ea70e65c9616f622ed8cbb29a0ab235a16c6f
SHA512 70f3eacbf0107971be366b3adf5ec75bc30e99c635bf85f7f37e94e38a1711ad694a9a043c91476070eb3384f6efad817afc3b9355de460006ade113c18e161c
SSDEEP 24576:cVbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0o0:cVO88hXl+CQ/lFTjN4
TLSH
T166559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 afbe11820d7a162be7fc1ae6eb92091c218294fd295a7a8fa3a42f3dc0f5c208
MD5 afb47b7cc77038047454b0c41c227455
SHA1 19737bfc10fa5ba28588fb7ff8ba0fba67a30812
SHA512 94b92e0fbd64b57007f4fa477085c6361934f56b5513a5c50255369e2be13b92cdea7ae7542d90b89d60fe93a12044101f1a4365597fa19f426c054355ea1a64
SSDEEP 12288:qzaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:qzanQ/tbw/2Mkjy6Fr7g0o9
TLSH
T12A5523796A24F897FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a1cec1824754966d747725a8c43419223b6c93da4ebac1043f6bebaed79652f8
MD5 f5f19a58c32ee1a977d1df3145ea3b0d
SHA1 b9ef4e56ee270a23e732f19db918d312ad96880a
SHA512 c6c1ec3ba6b56ef2ca7ad8015fec802f945c6e665e0fe7102f1c265a3133089f5abd10396613c72cdd85cccf18380144470e3f18e65e611a768d8c6148b5bd95
SSDEEP 12288:ceBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:cJIU1nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1F175CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d88b9b3fec2eb8e776c0ce123216a7fcc845d730a8a5370fd78d79014bf4e6b
MD5 b7d33873235c4cfa4ce1e67c5c28bf13
SHA1 5ca9988dd6f5e5de8faca4cc41b231b36a886996
SHA512 91356c9a4e6d32deb13ca61e949b0d2fd42d8c1bf5620b31600914edc53af532f8ffe4e668b6b84851c9dffcfdf7115768507b40fbadb32c1bdb650840f51974
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:oQvGAdlCEL8c/yRNw5C3Lm
TLSH
T11C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f91133b78bdfd444ad541cc74b026e3c7a19efa25ed73575e5b05d7b3a79efb0
MD5 1173df6cf501b9f11c03d1cb91bc9353
SHA1 343f8ea7a0db876fd5bbdfaaf38af814e925f127
SHA512 d066bdf6e7e10c413bf11c879dd339946c57a475b7c726a9b631ef1a5dbd78581e39bcfc52c7b694e55e1993547b3812846430655f265d9540e4043a3596500c
SSDEEP 12288:dAwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgy:OQewsAj7nQ/tbw/2Mkjy6Fr7g0og
TLSH
T14F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b3bd4a5125994da904b38f21801d2b47c5c671dd5ef4808ff85ddcc6d1795cb
MD5 ff34ca8dd58afc212602699cb85d7075
SHA1 eb8583068a7fe45d43a513ce5892a611823efac1
SHA512 638cc6d8332ae234e1849b281cbb38f8ba89d7d573c4c46c829cee0a1b060ece47a8a8bffa1b1458e80e07ad48b71584db13deb2b989ca98f9e116ca1757ebc8
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYL:OUEtQevvqc2W1cpV2EI32
TLSH
T124474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0bf76dd7f1c216e10ceaeb2f27203f04280e5e4e7006528b283e34944aa01b99
MD5 af45095c806bebf3e78358261cdece42
SHA1 b23b8b55b1c0204578060e8b3b9d1b41c20bd8a3
SHA512 886d0405e93c59cd9cc951970d8dcd66274d43cfa09987d48c2a7a8b908125aca72eb40e281da7baecc373eb86e5f39c76523cc3282ba3389258e97672e0bd4b
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:AoqtVjnmrLm
TLSH
T1B6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 caa6579337ca54a33bfbaa97a1406d9d1b2199339dde3424dd70d155c8ceceb6
MD5 4333e2ca6ccc77a16d83a5990547b678
SHA1 6df5a93cea7c32a5bf899fee2285fa758ac120d5
SHA512 52929401ad92399224c654ad6629058d95178c699e59c2116e0ec17274005632e19a37f7f35b0e8bfda1e20a813c783354189c9aaa8d63e29b2f41bc884c23af
SSDEEP 24576:VAhGLJIFoiwtA5l7S53onQ/tbw/2Mkjy6Fr7g0oF:VAMyFoiq54Q/lFTjN4
TLSH
T17D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 aea66b7bf9deb9be66babe504199b375aaa7c7e0fbdb97965f90bad5d66f8e87
MD5 d898e6e8b3fff2b227ff0096eae2b113
SHA1 91540e5b2dc214da8a2daafcc7cd2e9931bb7416
SHA512 de8289f1e84a489ab669c2ba72f23bc336a53ebc63c6b95f4fc1ad008de8a1108b5a7e570c84d08ef13de18a60d1fcf70e9b76f04cb80a71e624df81780f514b
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMw:bwuHOWPnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1B065F14A36A45CFAE96742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 67f11686f1d6a7ad1038c7dccf6aeddc1c7f884fea22a58e12d39410fdecbd13
MD5 1e225f4191b906f925babfd72bcc9a0c
SHA1 dddc88fe1e8de0aa30bc921495f93d6411d54a9a
SHA512 fc1a4c3b608f73c2b4cc7a928f4ca286e5d4ce7b97b096b7f26baf0282b4d91f62540b9ab4a8c62ee219d598b7543326d88e8772649e38109ef9b43cd2dfc2c9
SSDEEP 12288:9XZ1Iy7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:tZumnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T10755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fda8a654e84971be2bccb8c6ebab0f2112c42b1df07c8c12f3f8ae366af0ce20
MD5 b9c43ba37f29f7dd5c33a29417d69a43
SHA1 2318fa744b277a3d46ce0ed22019f31c9bc64087
SHA512 45369245557c0a46394002bc52624be223915047948714dab07ca7fa7e749b82506f67481b1b7e5c19ecbf836eb9679669d6795a39bfbad0679e24592a30bca0
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:UQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T159667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8cd72dc123ca2b9e709566e6ed403876cff2022c0957ec9e609b55c653cede54
MD5 5e01eab3680b304973737a833988ed1c
SHA1 b9c7980411e7b0a9a4068bfc2d2db99e5a8d85cb
SHA512 ea1a3572ad1a9458827cc35e001acc03b43c1bc0abd99bd3d52d3e033e2d1c45c9cd08c7a3c41da87fa199c24848cf8ea9e8685dee16c18e05346af39bd6130c
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:LQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3ca8efc6daca935e82c588b2ba2b029b2ca043fcabb64b16548cca74994dbe14
MD5 b6d705fd5bbabc113b28bc51da9dd588
SHA1 200744041ff9465f9f021b0dc10424ec2d2e4fea
SHA512 88f6cbfd00bf1b65f0aaec6d9458b1021cf371453838dd13cf1bad9f5ff7ad537afee079761817ab0d7ff1037e697506c71e405e9ce8192c1b339c783eac8e1a
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy6k:Y68Qg55nhheWu7PNU3/LQ/lFTjN4
TLSH
T191B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c3a5b5334bed3ac932ec5c78147800c0699add9c6f8c6ec5885827367856f5df
MD5 17d95cf9bd39ba731306fd273d887eba
SHA1 c7b2dfbf3be72b48d096270cb69f2e3bb8dd5a13
SHA512 50ef84e15ce9b7c6c8e8e7b50780df5f02c8af6070dcfe307f7ea519a18b61c9bb9111975f58f6fea367f35581d62d0ee71804b63f1c84c0f545d49dcc1ef7b9
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:Xy5112gYy5azzVvL69nLKnhZVLm
TLSH
T18E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e7a7423243da10c4cd65ad6aa5765cc5ebceae51c9bbdda4e0c298e00a298b3
MD5 f1ab0a6e3a9e39ebb8e9005100ab1842
SHA1 9e20ac2b733b9e467be37c9ffd8fb492aaf3b735
SHA512 8232d80c9f751797f9d02ac0d83aa6a35aaded2dfe3d6fa4566d1c628f2c1e138cdb7544445e66d0c5c78b946bbc31e6fa281befc2b8d956095a840ed12df4b6
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:vu6JmVxd2d2Lm
TLSH
T129D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f6f290eb1eb93df8e07892bb18f3268caf4629da7af742fd124685e6cfd8ccf4
MD5 ff0f882d9b9dd378dd25a493254dd1ab
SHA1 58686e6dfc3ebff34ee1907ff9d735d205b2fefc
SHA512 a121f1008ddb252cf5ec8c0738655733c0860e5b0494d3ebc399744349a8113b27c89dd56672280acb524791b7f1b017ee96eecf2227cab31babca291f88186a
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:2mifPbRrLm
TLSH
T18DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 184f7270276908383bf400ad23d3db1df9e50a7f22ec4b0eb3f4b98934a0340f
MD5 e3eedb5a12cca53c61ec8a7ae5ea30f3
SHA1 2a439097f65de7e9312648743f798f9c4ba641a6
SHA512 694734f7bba76406d68fc96008131b23caffe7baa84c0455c77e9b77950a78239dd7b812a6974fa01e50684b5381aa2c295b50fd9995ef5ed03eb8525c53b793
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:25dKTi61xLm
TLSH
T10CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 240aecd8c7b53a07ecccd6c0d000c754b00272839570f3d4136de751438036f4
MD5 2591ebd911baf4e4c13d3c830bd9748b
SHA1 1da77d1857231df2dd9fe60e790bf5cda3eda606
SHA512 436abd2c236afcc198c46fa8304b2259bbbdb875d5b8d45ecf6f50ffc08c3600e802c8aba7e139869c6a53373918cf21e413d3ed09d9a38f6318301cc6a3d2df
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wBQ/lFTjN4:MX2iyphfLm
TLSH
T12395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f5298dfaa9e0b3408d52b3fe89f477b090347a1729e3fe444e29cdcf4b6f8ed9
MD5 8f26e65923eb07784d27008ebf2f6be0
SHA1 e230b02fab057990e7074591a569c46f656039ef
SHA512 4bc47cea9c63a3a5b65a0927be1887546a78c4b4b602aa6f155e08257ce682fde731496a3c84b8b193002c2cd4111bc13cdf00d79ed375a91bfe8365fc92fe59
SSDEEP 12288:+CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:+CnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T17F5523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e8b8d06b5f337a41483dc24e32b13d3f07176d9a5ac6ca72e7d0575da659f4eb
MD5 673e0b4192fcc5e7a714e63b3aedd0c8
SHA1 4c060c7a9416049a35d4d58095d5627a832d0d31
SHA512 01f3d7c99d9a331b6cd9695c4a5f9bf1abda04e445e0853c351be6ad967bef6e135d1008e5969c314a3316de8b4390310269fd0ee1d53393fa62752a2bc47a4e
SSDEEP 12288:8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:8nnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D35523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5c8a3375ee05fab7526b8309ac24032edba3b23aba561312c4befde335c50ee9
MD5 4674328de1fcc86d7e44e36f2cb362b5
SHA1 eb69948b9e907bda5f9010806c806b065b8d4bba
SHA512 6b2aa2f8993b6b3416eb76bb79815dfed4a678c798515941f32af35633776c11dfe2c5f7062db4a7d4bb7681cb876fbd7ce638a9a45cf826614b9827b36e3c5a
SSDEEP 12288:O9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:OdnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1D25523697965F98BFA1706F1488381829B3F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b764d3662dadac77d9badc2a15cac7381634622692adeca2aeea145b1f9b9ad6
MD5 de28d0553ab6273a7b8f48e7df2519d9
SHA1 da466112fb14321031dcc7eb4dd45f214facaacd
SHA512 cd25e45c2b2a39dbcd3a7b035950eea7461991b0f85dbafc341d7c23c5a3bec315221f713c21ad8028ed828bb8d16aa67825b524c0436dfdbc141897b21bf689
SSDEEP 12288:dVIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:wnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1D25523693A69F4C7F92742B4CC938142E77B3DC6BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fa88fadd6b41b5d4d3b0126eac71e0d90320069964b2d430fa7a406673111469
MD5 1747aa490d537bbd9b71154985f0c880
SHA1 b01d4be7e842b5de2b33600b95d1acda44a4190b
SHA512 693760ddb1b7f5d7cb047452edff921c025fea1a286cd327299526a4e49554013156f6bf2206c6395f897611297de2204bbe83b44c2f42c889aed32df3683e80
SSDEEP 12288:WgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:WAnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1DF5523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7ebd7902133dff968f0bbb524c464c65cb66489da2c8b48725758ffe63e16212
MD5 5bc4bd2490fa617204abae50f38289ed
SHA1 df5c5f69388864a4a741b505510109fcb5625887
SHA512 81c8df892041918aeac1c9c57ff1cabd9da3c0578e7906512d636cb4b5bed345e6b03adc1028c8f1abe6e8d9579ae187a047b4c49a1561dcdc2efbd4f760683a
SSDEEP 12288:JzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:JjnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T10A5523697965F98BFB1706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3afd517d7b06d95ae892d1671365785fc71217988eaac88ba65c0f8c00e00a1b
MD5 c77531edbaa1056ac99b7ce568a48b47
SHA1 0c94994842bbcf76cc2ca633dfdc3002b3b61958
SHA512 d1b4cbf119fe82dd7cdb0dde48341ae2cec00273d404312258fe96715ea3b747a029aa4299ad1265c53715cf9637575c178cf667de7dad31319dfb2c2d2e5c6e
SSDEEP 12288:A/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:AfnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1FC5523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c7807b265bcd0cb4d764ed15533203c5c7785485ad85833ac46554d3a2adf6de
MD5 c353d76cea1e3498430b2fde8b8905fe
SHA1 faa0de1f130970621121b59b8318ff49c99661b9
SHA512 4f5e2f77bf30080900f80f856576cfcaf1abcbb4678b7c275c0f09eae66c9dbb6f02a561ebfd515814a3bd49e6abec7489591a0fffaf41a6cd608455f79a7b00
SSDEEP 12288:XiZwbDzzFEoS2cPvynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:SZM3zFVSOHnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1EF7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2e8dc0ba025f0ad02c03794404cd69d588ade9ed616bfc21d5ce6b2c04693316
MD5 58f5cd4ec029664b483079fa61156962
SHA1 4d940aefb2a1aafd793985c297b6078cf17898f0
SHA512 e5d1e7f8e6c23b0524eb1212fe2e7c57fc01abc6e21e48d9411c4e9503c80cbdd5b3cbef301d676e3f7270b2d59fae7fb099e91784096a706e3c04bfb0bed6a1
SSDEEP 12288:O2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:OWnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1AE5523697965F88BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d685f59969ad3d8e45eba83a8f5c6eee6093c1274d4b7ac26f9087b613d48bd1
MD5 79f9572af4d61c4a022250a3e8c6b9fa
SHA1 2d4e377221723bd06f1371a55033689fb9e5ff73
SHA512 e6d7769bc3ab43211213df8623f877953d41626238537ad0de23dba2ac7a4265bb91838077e9e0cc74e64f3af26adf952fba6f555d3c934b8457cf3edc7c70ae
SSDEEP 12288:iKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:iKnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1BD5523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3f61d7b7ee2425fcef4f3b3ed121f2ddf249f752b05591650926b6405475a4e4
MD5 c54cf8e51a9a73c5d50cd3194e07cdf6
SHA1 26110e99dec27fbcc7c0b0d23aae1c8af8416595
SHA512 09fa570dfd51507b5afae0220470943c7d9d559e8ddd06946bff7859dd8d50de0c02e8f85f782c11302253d25f89a7222b625eb24fd0f5e7deee89e4a13056a6
SSDEEP 12288:8yPz5L87GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:lzyrnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T16365021777A170FAE537427888920A02F77678725B608B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 43d63f32943aef946d16cb2d0eda5d4be8b9f220a05aba2d39bb9ca84da819d4
MD5 912f4ee28443c9c707ee224f1578a566
SHA1 15390550ac12dfade74d947c10ecbc51b3e8992b
SHA512 71dd99c35ec01fbe06c77cce38c705327f35d239a062f8100d75772cd1345a3907f19dff21badc29b12eb7ecb52852450c1171edeb6f4670dac5cec6f63f33a4
SSDEEP 12288:u2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:uWnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1C45523697965F88BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c29224ae58b67d4346c7927e3527a509a1f838da18ab9e0c2fc78c80fb7e796a
MD5 48ef08b31d240d3d6be443211504de3d
SHA1 cb02b6e87919756bd87b5808dda6d71e45a465af
SHA512 dee234a5f5bf2626af3953c102f46b6ab393770c179a47f8a6819b2d1898a1812d8c23b067030cdc993fdfa9495b2607a77d1fc93010aeded7e9446d50151ad6
SSDEEP 12288:/2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:/WnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1A15523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c8d29b2e717f60c2c5ef095a0be54f563ccd1db8ddb06a370c7ff4536739bc1f
MD5 54fd3031b19e63b0e2f80f9e2c8726cc
SHA1 840b9da8744ae020a4ada2b7588fe6501ddbaf15
SHA512 52b3ddc8482057a97ab2ca8904275522c52d0438a0dad703aa610095478fd2d3748ac8197c3880ed71e29b4b24ccbed25eda3d91d2b3efdc6260cd6590d30419
SSDEEP 12288:QyPz5L87GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:hzyrnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T17765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bbb59ed4162bfd36beb61885cb7e28cec9727ccc55d815d9c87973b8e37458d4
MD5 4b78a1398acc409202e1c480048952fc
SHA1 bb749bd1d9cd1a71dafa7f82d7f078b6313a836e
SHA512 c0934bcf5e8af521eed459aa0a2c939028a9b2ff665faca500fcc45169b954d251dc0a9b8f45d7c96762d4d14b7ccf4506bf2d7d652bf06e9d3e2ddf33f432cd
SSDEEP 24576:yT0aLl3z0zDtnQ/tbw/2Mkjy6Fr7g0of:yTDLljUQ/lFTjN4
TLSH
T16A7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9f00a66ee7a37bdfc940479b55028529f516c7b5b89df82da448ca7d900d275e
MD5 3d1e298a285695ca46e598bc3915b841
SHA1 fb311686bf14b82f338df045b3f5361f4183c662
SHA512 efaca80c78c225789810ccd6fa9b36c7c4da3e65ee7a2224960414fd39bca821abdeeb1baa896fbfbf8e7721c844fae5f5e13173d4d8be97007db103297b8b18
SSDEEP 24576:v31d9CHKy7GZJnQ/tbw/2Mkjy6Fr7g0ob:/1d9CHKyaTQ/lFTjN4
TLSH
T15E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 588f40c56181aa9be7ea961afca4aebfc1583636bff059c2e3676dc5829cf952
MD5 d81c2afa69d9b6fa15bc20a351d9b523
SHA1 0fd31fdc1721cd479cd3eb1ecf750bf82b0f4580
SHA512 2dd234b8dfd87caeab86949fc9bf2b67b69be88f93c5bf57dda93d726af8357a63319730b1688de5a0d2040d5a97f275bce3f34362e75fcff06157590c28fe79
SSDEEP 12288:JdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:J9nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1BB5523697965F98BFA1706F1488381829B3F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 771f1b36e0a19a7687c1aea51cda29580b26f972eca5c74cd64a4a3641219a64
MD5 a028802d9fc952406defbb19a42c17e6
SHA1 fb34b3ff134575b9a789f9bc64384437c7400698
SHA512 02135d94ecb086a0577029f04254578c2a2c5d4175d9308f2ce65ffe4c1deb170e59d4b67c9ab87305dd462dcbe25f9c208efbea8b70958f4a73c1f014504a82
SSDEEP 12288:fbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:fLnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1425523787964F99BFA1B06F1488381829B3F0EC6BFD1938E77481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f11d493aa3364cddd38f8fff2d935d0fba3499b912990ca1696326a9fee7614f
MD5 c49177429318bd6561a5be4fdb3fb6dd
SHA1 10c66b76626dc64d1ff34bcc5beb8e9aa326cc25
SHA512 b48258583ccd1fc8fbf3f783c27833d029bfcb37f4c775a5dc0c3844abb459333f405d0c4cdfbc241e1649f6ce9e02d6b476fa2635e37100641d645dc6b21da8
SSDEEP 12288:XsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:XsnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1FC5523697925F88BFA1706F1488281829B3F0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 520b988cdb0a4def54950baed4cd2abc2b6ae66db68bda32c309978b1fa86cd7
MD5 8b92073ea6222340b498678633e52411
SHA1 b1b837396eae4686d7041ee6298ca1522d97b9ca
SHA512 cd34c919e5a1b8fa51ccdf0747d20de121bb52345af2c5a68df6bae990dd8659dce7fef99842e12926a8bbe20b2d869fea8da5ca03f055eeb244fe0f24014cc6
SSDEEP 12288:42GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:4WnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1555523697965F88BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 86498c3cb212aec34e0d10e9c30cc2c9ff8ad5b868f0f04a0a952a2ff0c9586f
MD5 81c26a5eef138f969524d591f789e6b8
SHA1 eb6336d665838513e1b2fb1a99dc98400f659acf
SHA512 561ec3574326f533919693f4dc83c7ee5ba3f43737348c49b7e8ddcbe374361728f5c1316b0fe9825c01f17caf1b09d88fb1b854eec8d264b6a82f05c7ab8799
SSDEEP 12288:8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:89nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1615523697925F98BFA1706F1488281829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5fdaf4b6e8a8ff7a488cabe47bf59685ce803a448ce4f9bd47554a5980cabcbe
MD5 6129c154bbdf42bfd1333b78fb7d5fb5
SHA1 38401fbabfc8ac695ae17b2188fb57faba5055cf
SHA512 f1a17961ce761d74515b383b5a477f9cf52605cfbad9bf8f5ac07a38ad9a64da04a77151e46d7b06be0c89809486047d4cbcaa4a9721393ec2806e7e18e66f44
SSDEEP 12288:ZuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:ZunQ/tbw/2Mkjy6Fr7g0of
TLSH
T1CA5523697965F98BFA1706F14C8281829B7F0EC6BFD2938F7B481128967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 533446b423a1e1c5897154f3be2d1e77b2beb003577b5230ec55bb518df5e9b5
MD5 d17e770c191b6060c22b7e7b89da146f
SHA1 ab0f7f0f31ef781ea6632f09b2ea2dc8c63a0709
SHA512 3f16cc82514e4db00bb4af08162f3f721eab008d0a47ac456ea84a8e5b11ebb61370cc163f04bbd64a16e027cc98a644d18383a32c5bcb1437509f9b869bcf37
SSDEEP 12288:YgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:YAnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1BB5523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 eb5695f3420f3fb83b2089730f2a4f306d5d72a6479ed2686300ef1c4e5c07fa
MD5 759077dd48a52eeed95a8abdd39f2b3f
SHA1 ee100dcbc67e00bc3925775d95521a18004cd625
SHA512 d6b2a9ddec55a4fbb11d2acf1f60d4335a338ee5a23d56d3e763d4df776e1aca67c33edf63c0a962f121a6929570be095661274bbed528c098118e238d5a8a1f
SSDEEP 24576:qfwv/k9RX6wkyAI6nQ/tbw/2Mkjy6Fr7g0os:BMnYI6Q/lFTjN4
TLSH
T1C485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 98d4c4b10fa0e3c9f42b2a5465e628d356d50a350a3ba99f06642810cd91c968
MD5 2ac42d4b6fcc2a21154c2c824f43eb4f
SHA1 d8d7dde00aa90defa684e36313fb7cae8e2935d6
SHA512 db5502f391c0ae2ce00a6cadbea2263df8736162711fc01f07961e1a45e5b85f522d4332b40a611d457e8dfd44feb57020a16bfd34823a52d75b83613e4b5107
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:hySzP+Lm
TLSH
T169066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fe37d4960fe132cf62abc198ed2ad8916c24c601c7552146c94be9f9be02a8fb
MD5 db335049bcc3442aa0f99c6be6d02813
SHA1 433fc73fd7f4accc226eae62f5c296eedb0bc6fc
SHA512 f13f25fb7a2017e717ba7e4427e6133935a2f626cb486248da2c854fd25e3e629e7517481e4bd3e1c82e493f5c2abfd5bccf77ab764bd569e4af7d4dddec3754
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3nQ/tbw/2Mkjy6Fr7g0oN:B47JUQj1irIhCnDHUPfF/RQ/lFTjN4
TLSH
T1BE65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5e4a1e3ee36f2905f6daac2d4449960bc053d9289b25d793af076240190aabf1
MD5 d3ec980ad2f6e12f1c5c8c9c80e5f0b8
SHA1 5902be265e719dcbf2c28e6e9f335ace246adc00
SHA512 f3a3e57f2987b6cd17c0fd280cf834082a6414e2074db2286033f55b562e8a612dbe16b444f6dd1a8eb4eadf0a1a5deb7e75be09d828e9456843b4f9f66546d7
SSDEEP 12288:vssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:DmnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1E965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 482913eee8d73e886f913a5361b9f217905f746dcd46b3d58b918d2695b0a009
MD5 ea3437e95eff9461b2ab696c54583d1f
SHA1 865c900c6395bfbb8dd97853b0559e05b1909206
SHA512 73919bba3b88304c16ddefa3547537f95a7e9bbe1d3ce5f266d59e72325037e9190168105e7b4a2a4c4e27ce2e20684b94cd0c831cb1fb327ab317381159494b
SSDEEP 12288:f7VRvU3fKQg7lyUq+qJXGLgHHHPI01lZDG0rQqefO/MHW:fxlUPKxvcGLknPI0/ZDBrQvfOgW
TLSH
T1B2352851766AC75FC6A940325E33C2CCAB707D01FE45AB0372C8873FD576669BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 44e43906bcc8600206a5db5bcd5a9f141259bbb6ba59a282d969d7e343a796bc
MD5 5d52dffcff13e306d9982e10939520a5
SHA1 44fcc746ef645f82d8ec8bb6d1bd6cf502cc6b56
SHA512 2eae23da46ddf3436722083ec639c820e8be751b94affc4260d818982e762791f905577cd5975d8538e1c04935cdfd1efe58e457a0d80d943650be2057a80e68
SSDEEP 6144:te877G3dDMe29MHzvfokYmqQGRKA6KTftbm774qbqcfMytMxmgiNk0qWJ8i9q/q7:o7TAnRKA6KTfZmvJeRWui4yM7qsKWy
TLSH
T1B855E7815537A2CFD1FB6071032A5F4CA7A8EC07B7056F26B7C8453AD82AB6570B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e3eba0a24e69a8841ae959b48069b18b9c8a5fdd9d39655d65dcc2d3cadb25ce
MD5 70a1e275154f84ce5a6cfdb8fa042a8f
SHA1 908a0b5c2f86951371f9c3bf7729aa24dd32cde9
SHA512 f4fa65c3460f8b42cfbe8afd6ca574f5dea494ece9168e473eaa8bdb617368f7b00b201734ec62248591d6d6a1392f7d8613b7f5d948e8e7af29ad85cd2aa770
SSDEEP 12288:f67+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:2+nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1E75523696668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 25baab93fd0e1d17799294fa0011379a818c0c2a70f7d4a62a2d951157d7ffa3
MD5 20565b805fd677677f180d55baf3def6
SHA1 9ef5b89d30a7ded2f5cedb626ec250cd5448625a
SHA512 c07ac4cb28c0ad65892e17bef05f5f716cc11ef68c54a116ac20f1dff58fcddf8f6457cad324ce5445f43f955ca526b639c1621620f8217907b2a489a51db276
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYUnQ/tbw/2Mkjy6Fr7g0oJ:/gb4mBIBhGF3Q/lFTjN4
TLSH
T17565AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6f32774a1a1f4423fe0b15f727b159d02bbb2d6db30608791d31cf2509adbcbc
MD5 4cc0b031f2269bfa7c991492adb70991
SHA1 b087a5a3d04f2a2bceb34a5a5f1485ebe9aa1c3d
SHA512 f32f0266e7ab2ee349808ced8d42d533578d097be2d3294083f6fab87b638d4c98e39f549165be41e17cdb47e6939792cdc2ebaddfed33970204348d3772a7f4
SSDEEP 24576:tG88u8FpJqH1Qzria7/mHnQ/tbw/2Mkjy6Fr7g0ot:g7ZFPqVva7/MQ/lFTjN4
TLSH
T1CC85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ef5a6eb10f36c4efb651ac6dd82b1c9a470ab09fb290dc2e6b7f2fbb9f726dae
MD5 d2702adc70eb08ab0c28406700659b78
SHA1 a717657ae8b8c745d6ce2464bf56b523428b50a8
SHA512 8fae03e327c6bba897c5efc5f3f7d48f5aa4506946edd19133969267d4043beccb2122f8e81ff518b23d79d53c552f712025b6b788b42c9d29e34b0f25a9ea27
SSDEEP 12288:iHvUrBFrEjwaQjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:iPUr+NQTnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1B165E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 97f67d4150a7d2ce245cd1ba1e079154f5a07898e85d3a30c210e3ac06f7a22f
MD5 c4f688c3041ec06d7ecb30fca5f5afab
SHA1 874ba6e4d3851bd6c87b22f7adeeba6ef10de103
SHA512 b14834a0622f46bcdb59e0a3514b6e03a96f79c58336578a5ee4e12f9ee351fcd19ef196320bee7d685110b133204d2aa154029f501101e4a92f57c2d4ba5ac7
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjQ/lFTjN4:eG05lO43b9Lm
TLSH
T197D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3028498978740a4e42b919c386994c8740e38b7974dee70151a2e0c05011126f
MD5 0de3992f80ac349bc53bcf804c1501b6
SHA1 b0b6cdfb140ea29121ddd57d1abbd1a75d4f7916
SHA512 ad839f98a42033554444a61fa3af6dc600de07378dceac79a9b7052246c70e85cb50045572489776f2002894b2ddc64c2a56432645b7e4c6dbe27617c5bf601d
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0ob:la5POZ3+Jt2pasx2+mLQ/lFTjN4
TLSH
T1AB65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9c97fb522730b85760917eae763e488e34eccced4d3a3710390aa4ecb74e007c
MD5 99f007e1e19f8939b89fec1f69f3cf25
SHA1 3b36f81f1107d7e2ae13964041fe43026840f34c
SHA512 f54bc0919bc762b2bb1eb643fff8986136bcbca07ad9993e8eb701f24b43fa7c9a84b3b9fdeaf869339820710e742eb5e732c312abaffb76b18e633029aae06f
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkvnQ/tbw/2Mkjy6Fr7g0oq:VNc/zEOVHFsQ/lFTjN4
TLSH
T18A858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb2e073d4b8a54bfa7014897ca446784fb8272f1c3309430d3728f4199772143
MD5 62c077a3633e92f941ac134719bc446a
SHA1 ac7332d030ad2adf7919cc4d12e0cd7ce1b6c84f
SHA512 2aeffb089233c137da84269af5edfa586430cafa295d1ba5059cc768b6aec93f9a6176070a9ee79c19d602d9643e7eb18d5bb152c4fdd65a25ae25d5ac5e746b
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmlnQ/tbw/2Mkjy6Fr7g0or:B8MwBtOmlQ/lFTjN4
TLSH
T14955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 bee5a5b92d0578ae9b65c2215224a4e2b2321fa6e93bcf386f2dea0e35ca14d3
MD5 082d69fdb611c07d9d534eb87570b9a7
SHA1 9a3f1ec5fb56c94020e77736429e394e06285bfe
SHA512 7f938953b44fa50bd75afe17730e84f71efa7a703e81259564b3948190ace70a83fb7afbf9611fce88759d8aaf924f9cb119e6faa57e64d4263ada99695e2ba5
SSDEEP 24576:ID3FHshBIYQgAinQ/tbw/2Mkjy6Fr7g0oT:IDVHeBIAAiQ/lFTjN4
TLSH
T1E875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1060-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1060-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1060-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1076-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1076-127-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1076-136-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1076-133-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1076-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3436-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3436-84-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3436-301-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3436-79-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3720-102-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3720-313-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3720-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3800-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3800-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3800-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3800-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3800-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4664-77-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4664-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4664-7-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4664-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4664-1-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/5064-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-13-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5064-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-20-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5064-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5152-274-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5152-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5152-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5152-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5468-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5468-73-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5468-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5468-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5776-122-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5776-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5776-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5776-116-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5796-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-327-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5796-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5796-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5796-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6100-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6100-39-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6100-46-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6100-45-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6100-50-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/6100-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download