b6e0c7f064a723be582efa1cdfbd6254a71f2d1988aaae14fa42fe4237311f96

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Size 3.0MB
Sample260813-2sclxadh43
SHA256 b6e0c7f064a723be582efa1cdfbd6254a71f2d1988aaae14fa42fe4237311f96
MD5 420703f0d97c5eead35dcb87ca0740fe
SHA1 b30bef01db9dcb56071d617de81ab6defcd60951
SHA512 3f52c188f271e3a69951b98a0e6f9d9ba70d21fbbba8f2c09109a209febab95c2ea02bd8fcfc0bd717f04e50d5774ea5be1fb78ab56f598b55878a04c30243d6
SSDEEP 98304:RRV2C39xKvM8u3XFkBv+TSoE/twrwlix/fxAcob4:RRTxKS9SoE/G
TLSH
T123E5BF22BCA085B7C52303319D6EFA3D31BDF670172685D733886B1C2974EA3562E667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5180	elevation_service.exe
4672	elevation_service.exe
936	maintenanceservice.exe
4696	OSE.EXE
2396	PerceptionSimulationService.exe
4512	perfhost.exe
1088	ReFsDedupSvc.exe
3936	SensorDataService.exe
2992	ssh-agent.exe
3084	AgentService.exe
3716	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3159ce428f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014c6a36a762bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5676829762bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007491042b762bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3084	AgentService.exe
Token: SeBackupPrivilege	1088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1088	ReFsDedupSvc.exe
Token: 33	3716	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3716	SearchIndexer.exe
Token: SeDebugPrivilege	1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5180	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
1324	2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3128	3716	SearchIndexer.exe	100
PID 3716 wrote to memory of 3480	3716	SearchIndexer.exe	101
PID 3716 wrote to memory of 2612	3716	SearchIndexer.exe	102
PID 3716 wrote to memory of 1992	3716	SearchIndexer.exe	103
PID 3716 wrote to memory of 1628	3716	SearchIndexer.exe	105
PID 3716 wrote to memory of 1072	3716	SearchIndexer.exe	106
PID 3716 wrote to memory of 3144	3716	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_420703f0d97c5eead35dcb87ca0740fe_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6d24c305c5c92db1daaed57299dd7d311e7daf931f72677ab5b64ee1af099855
MD5 6816dfc4f39ad80061a72e96ab783c2b
SHA1 550bac73450b14594ba005dfd493bd6bfde5c158
SHA512 080c9d07aa6474c62be3486637b8a271a7ef7d7c37e044aebdae84796abaf4f94f844b61dfb658953466ef24c86ae251c5124faa8ee66b9c2fc1f06a85b7205c
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8eN7xB4dcUDb4kw:63q6HjBWxAcob4
TLSH
T16FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e9683d073ce81fc3717c3decaed10d1f45523da16039c417b8e65f5255e16368
MD5 eb5d1e2ada9c4cdb814d67427fbc94fc
SHA1 c3ea29b92ba2a8437f94d6dbfc4d84f8119e4baa
SHA512 d4a0d7a8af3abc9ccb7cd3e7080be3f7020de2c64885b45a3692bb513f0a52ef22bc7e2ee39fbf3cb182224705e3b7ea6ddf226fdff9ec79b67000604535eea2
SSDEEP 24576:VXYfDtczA5e/fvF7asVSyRmdcG/DH+M54c2yw:AtcWeN7xB4dcUDb4kw
TLSH
T16D05F12977E405F9ED778238C8B28512E673BC910760F68B03E4AA661F736D81E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 19012881d1b12061222907ca05a88492670892ec4e0497f9473919d95d6eb738
MD5 26d5593737e5ef8745e55d24e3569877
SHA1 d90781c6c5f6ecd0a79484dfd5198ded71060c3b
SHA512 636d827e0f0403f4ecaad18b900facc93cb88353da3a50fb595479f73b81825f942cba351c7fc9569198bf74aa2ac20f8e313c1be770f1eace052b473d1a61d0
SSDEEP 24576:a0Le5ji0hmxirMEe/fvF7asVSyRmdcG/DH+M54c2yw:aPji0Ac3eN7xB4dcUDb4kw
TLSH
T19635AE56F6748331D073C0B9C5D2A68AE97234861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9424316955696cf11301494852db8313ddd2b2c448404664ba1605fc6b1522b0
MD5 5453eaf71ef5264f17e15d65a1c99946
SHA1 624cea52725a886e3511ae118f708d0475db3497
SHA512 e267c848eae44f4b31da9caa811b29b7765f329369e19e50dc5a5627c6d38a50609db39dc7a6f1fee1e0e991d62942a16e83c0542ba15402863077d850ed1940
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuGe/fvF7asVSyRmdcG/DH+M54c2yw:g/ezSC6vUzPvxHjy7eN7xB4dcUDb4kw
TLSH
T1E1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 071395359133b8fd60d9a751dcac0cff59aa0e5b3aa189fc99d5503b49577db2
MD5 efe5c5f4225e11b45b0ac8a5cb218c0f
SHA1 5d02ff4867956d83194020c1d1f7ef65884ecb5f
SHA512 a6e25726b485ef3db0b8b24bae731a597ecfa60c689693881d04ef765e78e52c13ccaf915374be5422371b31aba7a63ed02d3e86067042a37229948a353e5709
SSDEEP 24576:pVbqPb88hv/l+6Fe/fvF7asVSyRmdcG/DH+M54c2yw:pVO88hXl+oeN7xB4dcUDb4kw
TLSH
T1BB559E66F5748331D073C0BAC4D29A9AEA3234425B318ACB1246D76C3E77BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f8c932c3980dafba7668e2b3518e8ad30d13651366b5913d153f682ae0ec2530
MD5 9fee988b5b8a6f6172673d649b97abfa
SHA1 36c6ec5b50e5846cf0e617a9be1f838b46e994ad
SHA512 17381c939450575fe997de18ee6e0d814b6cdd46ba118a1bfe18d944312039005f8a0fdb58165cf4b02b436252636bf1b76e14c298f1735700c903970703ac80
SSDEEP 12288:hR/Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:hRAe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T102C423CFABFD12B3EFB7937134711A9211839CD52E60745A94907B866AF8CFD948021B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 15bd7af8036ea48dc22b718ec954dd1742f3c360cc495b7b3b219ac6f03fecba
MD5 f204ff52132d96e56ee197298d20c4b0
SHA1 047962d43f894abc525455970d0e1f2f6276c825
SHA512 7558f86d78c6d550eb5ff2d5d5e4162ce7c2848088837b8222e41a6f26cc43dfcaa8bb4427c0a52ac7191ba0c34b0c8f254e5612557ba7b7af9ecfb7e4920b6b
SSDEEP 24576:xJIUNe/fvF7asVSyRmdcG/DH+M54c2yw:xJIUNeN7xB4dcUDb4kw
TLSH
T12605DF7BEE38FCE2C67A8DB85A91874093A278704F61A3CBD164830EDE335E45D75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fcdecba78c542c95086a22966ba984586da435d7153fe9f08cdeba44905b8c7c
MD5 2a8e8a7f0c54aa9a89da10b508990b5a
SHA1 9c07a2660dc654ebbd8da6841edd587033d94301
SHA512 5fea3e907eefc046a926fb80433353c1d41d3b04ec25c4cb0ba2a1b1a4745dde887204a2caa57609e4b99c4f11a0f28e6e68f677c1a46ae3211c0c26498ee2e9
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:0QvGAdlCEL8c/yRNw5CBxAcob4
TLSH
T1FE266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0ac800de506318ba200c4fc8f2fc3ace891e703952741ebb3e6500590eb5b5d3
MD5 63facae656964be45ba765f74e57b2ef
SHA1 0d991df0e220d7bc2e381846a5d81bd8a57ebdae
SHA512 3f7e749d5d4ed53c1f72343cc5bdbfd1333951231ec82f9edaca41355930b3db18052d81f98469d218de06b630046fffa1a61b2cef18f5375c1f198275b9ac88
SSDEEP 24576:TdewsAjne/fvF7asVSyRmdcG/DH+M54c2yw:xljneN7xB4dcUDb4kw
TLSH
T17215E031FE75E032C7BB0DB22B36C716146DAD600F6129C3E3A85E8E59706D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4a772a9a76c1364a0580b79b83fdb9e3e206ebfa549028035b32eb70b514d8dd
MD5 9143c58f36080688387282a938137d08
SHA1 627fd077f9f60ef4826eaad8a31037935fc3ec4f
SHA512 3e07f6f6a57ebe5d5cfff9c12135627e4abab652ee8346a22eff3f61761138a7972a981c5a98403f8322fab3b0a1d1432d2d3eb129b42d429a21a774f562d420
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:PUEtQevvqc2W1cpV2EI32w
TLSH
T165474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ffea2ec66d17c7fbaae4243ce621044b5712e2230fe60b24f9ee4124a804326f
MD5 06b0d6b111e004341e62b2d93b49215d
SHA1 51a6f21e4c9e9d69ebfb4c0e65775bbb6f2ff90c
SHA512 ebe9b15f52e7d23a72ae13d21f190615f7859168c21334a5e9475970b58bc907ddc3577de001387b9aa2f3345bd22860c6d3201d5a324d91853c0c8713bb5bd9
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zHeN7xB4dcUDb4kw:9oqtVjnmVxAcob4
TLSH
T147D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 05126155e140589a80639847fd7af8f45aea59176d242132309eaf1424d1aab7
MD5 005668d8372fd651acfa5f563dbbc1b8
SHA1 224b1710a768979bff6f92324981e7e97058063d
SHA512 5c1cc675823ae0b8cdbda12345bea85c109edd1d76b55de97aacd6763d0ff8c047666c38bdd453afa8d7a3aa2f61779f3df5bd81486be81bef522ad4d4925e6c
SSDEEP 24576:GAhGLJIFoiwtA5l7S53ae/fvF7asVSyRmdcG/DH+M54c2yw:GAMyFoiq5qeN7xB4dcUDb4kw
TLSH
T19E359D81EBF951D4F5B3AA78A9B68571EA76BCA61E30D20F2150D10F1E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4182e08da1b808904a682bbdfbd4063467f2ac63d9cf3061af540e9ab00d92d8
MD5 f5a426f00255011261e0f58223719c5b
SHA1 6997edea0eb1b4e0c05abf56fc765dce5d69cdc4
SHA512 241180867a9dc19a9e4cf573920c5d2b87ec814e5e1c441e8bd410100616bb890763113ccf5d1e784ef536bef3551a3609033c0981ca7a2cea70fbda55dd3c6d
SSDEEP 24576:mwuoOWbe/fvF7asVSyRmdcG/DH+M54c2yw:mwDOueN7xB4dcUDb4kw
TLSH
T1FF05F14A77E908F9EAB7823985578532F3F3BC012A20E71F1760C65B6F772616D29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cf0cbaacb1170f5558432be53d4d630c24bee9f0d3fa0823ed74ed49e5697f1c
MD5 d5446db37b12e9feddace5b9b73820f1
SHA1 f5f268cd75a0d6b2b2972cdd48203e98245eabb2
SHA512 58d18c270051cbeb02c1ae6f5af5b3bd5f7583df1daa56d78c8dc3e6578f0f8a27df8e183481df520988cffff6917ae94fbcf376bdef6e6f21da4be5879841b3
SSDEEP 12288:gBZ1IyaYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:eZuse/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1C0E4128E37F821F6E6B35379A8F14A4193A37C92277063CF1464668A2FB1ED51D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0d8187998b236fd448d6d1547687c2988069dae478e26ce6a1c01d1b775950f9
MD5 68c3b7c3f45531d506d50ca0387823f4
SHA1 4a20513a676121cd9a3d454bb9d0566ba8417555
SHA512 78b7bebf12388f23199a69d0e05e616dc679bbfdb0fcde57b663fe81d185b29b857ca9d20ab11e4d405d889e654f31fdfb68a7b08897c3ce31d510f072b4f7d9
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:eQRQyi36YOcPQLvw2gAf+PN3ixAcob4
TLSH
T105667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57c840daa000269f669b135b62c7aee034f5af2313eb0612d8a42945dcb336e4
MD5 a54417c59d5fbf11ae337bb0e439f870
SHA1 a4524309da6034a98c0b84c3d7d2cd1ce9f4615e
SHA512 4e682f0c8c3938439446b7b15ddcbf293cd7544573f9078b998d752a11bcacc09d22e39fd2ee16a962c051188eb59dbca45f9831cf8894a3f07c173bf19532a5
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:MQRQyi36YOcPQLvw2gAf+PN3ixAcob4
TLSH
T1BD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f46f00bcec59f70c6a79ec6b3a32a856296419458f2ab6490d27b5fa21d19739
MD5 4fe6fe4e123d6a64029b42462add6d5f
SHA1 5d4ec4f076753d97f378878cb172f28b9d2a51b8
SHA512 cfe0c23bfbaa19785b1d74f8dc19ca8ea42e9edc41891b129bf62a714181e6b9ea39ce00cf1be60f0d2b2de829117698d646f138f5a5740cdd835fdcdd75fc50
SSDEEP 49152:Z68Qg55nhheWu7PNU3/3eN7xB4dcUDb4kw:nthWRc/cxAcob4
TLSH
T1CBB55933B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4c02d01dfd0e12220d2024c00cded78874d93471ab3cb777085cb4f0647a7bf
MD5 69732294bcff08d5c7f6503947e2cbcd
SHA1 a79df978d5ab608441089e03d0de93d01f7ec838
SHA512 6a4346402fc9c6bb771b65196b9eb4f86b8ef2521aa4512d574b8de88a4373cb5c16e8fbcb4ed128221e8ea7f9239a1df72419069af9c8c03898030935a79f12
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Hy5112gYy5azzVvL69nLKnhZnxAcob4
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA62BC474B35B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfc986e2465ae980559f640b15b996b2dd57f33b8dc3c469dbc10d8a3daf25e1
MD5 c3d6fefcae437d3bca2c77075ef140b1
SHA1 e8ea1aded64385fee3c73bbd8e2f8515684cc450
SHA512 9a7f6f959d41beea11970c98deea2148fa2bcf9176e429381d9ad31183bee1ad43c5c4a25f989bc26e6e93ad226e9c2735f5150269d1dad4902c79a18ecb3f1a
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJeN7xB4dcUDb4kw:Mu6JmVxd2d6xAcob4
TLSH
T10ED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0eed39118e5c5f518828cb00a79d51b9d3fe4197b16251bf1fb0dd37a342cc99
MD5 ee11a5203cbf1dcef79695b3747530b8
SHA1 01e99c6fc953fd0da1d1dd691cf535c21f743629
SHA512 44486af6deb37ada24b70c5cf97c72a1d4a765363096a72d63392149329f761ba25301d74bbe024bc01889f108a0990ea7bb67f7a10a39044e470bf3269e871a
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xteN7xB4dcUDb4kw:jmifPbRVxAcob4
TLSH
T140B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a81e19bc41cf24fe22952b10509176746f44c2169f676f7254ee753b725df2a9
MD5 eefc2a964869573abbecf6f42e3b4a7a
SHA1 8012a0b71f8a6b11c10aea6c85abcfe4a275a2b7
SHA512 a0b5ad9bcc118c04a2230f78287ad9c4db14363b2d190a0685443f7000ecbd394db3a4a3685324be6b5cc4a1d36fc2c6b76223aa2dcbef077b54b3ddd26be8fe
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqseN7xB4dcUDb4kw:N5dKTi61jxAcob4
TLSH
T159C5BE03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7792d9db3ca2e023f213e7556d150372c3f49ca99423ee158c873e8bf8f8877f
MD5 a05a7330fbc17af66f86de6ae631c0de
SHA1 8ff22484bd651a1e6f437248dba1650dffec9f37
SHA512 d6a32a9f3c4c328e9cbf31e67c0654db0d0b80c4a0a269596be683dc44bb59cb68035a0074efd6302e0019b7f46bdca3db908878059d82b5d220ff4693077c17
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5w5eN7xB4dcUDb4kw:kX2iyphpxAcob4
TLSH
T16695AE13F2D901E8D06ED174C7568632E962BC160B34BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 bea99de884828ad65dc12b96e40733a847ac58fedc4a99687cb56f48fc31dac4
MD5 2cbc3389d9d25373d8adcab5d60f8e97
SHA1 985d43c085e52ebc7b8c7f8301824415ee729245
SHA512 9a0e204148079910f210944e3a30b2fa4af397241199971816c958442df66d221ad579713d046c8ce60e985cbea4626f0c2f3afb2a231f1d171651b981ed7a76
SSDEEP 12288:lXYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:loe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T141C423CFAAFE03B3EB7693B174710BD211879CD63E6030AAA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ec40a1c1b290e5822cc2872c1e60915e9f017e0ba0e61c549a70dca6049e594e
MD5 110d19f46185388ddcfe6feafb685ee2
SHA1 2fa5803171e97f33a9b73b2e60a6e410e1508bf8
SHA512 f97a4378fc484654d02002e537c1fab5ba2ef238203051493ee6be492279fac330705ad180ceccba3035a549a4b86bfa8ba8bd068325ad5d655979fd63c1bde2
SSDEEP 12288:rOYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:rze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1EEC423CFBAFE03B3EB7693B174710AD211879CD63E60309AA498764667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 317e3e85ce297143d51ebc49f4d2e03088600dc6df4deae8200f78a4ebf88c8d
MD5 4421f54f4210ce26c8176597c271745d
SHA1 b16a87707dd24c33176c4e015be850044e888d32
SHA512 b119b0713d2523f6f19fe38980dfb890a21a9ce4c09a0009086b56ddc7967ca3f1417041152347fa397fe49b1855eb400a2309d1be908789d72a2e7305bde980
SSDEEP 12288:jgYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:jVe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T150C423CFAAFE03A3EB7693B174710BD211C79CD63E6030AAA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d4629af3bc33c8dc2990314af351c04575bf97273f908c42cc9d3be00c1869af
MD5 05f6b77ca5aea07f007f73ec096640d5
SHA1 08151b16e1275bc155f2f55c5818092bce14d6fd
SHA512 fc7a34bcd6ef2e5ba196fa1f1e9162c1020bb92454f61dac85d9fe2330ffeb263ec1f3d2eb30b5546da815058a258ea42dde936e847fbc538f67110e4d84dd0b
SSDEEP 12288:3VhYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:oe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T122D4238B6BFE02E3EE76D375A4714692A2D7BCD52B30729F94403A461FF0EE81860355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 300bea9edf64c430a8739815d6afbb9aff0ad78c0fba44a356001e1f1450c82b
MD5 04af2d453dea75b3b3f4f93448b017c0
SHA1 888999ff9b1e21c9328e0fd3def64f2261a877ae
SHA512 75ea4b071209b8f18aa5ecb97fdce33b69e5982e6ac0a808706016e48a5663f940a0ad74a3a05dd1c9728f31739fdab63f1611a95f79d4387d6d1a4bc2c9c5fe
SSDEEP 12288:UJYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:USe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T11CC423CFAAFE03A3EB7693B174710BD211C75CD63E60309AA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2ffee4ea7b6c6e644c967bc540c269e2289a1efffde07fd49c852e432f20a687
MD5 c3268b2644c9d953d8f08b10ec4a548f
SHA1 3089135467ddbe7b01895caa693047a63252060e
SHA512 e017b403ec42474a2d2a196c685c230692d957e763c0b14a8bd804d82a08dba689e5647eabac57a77981bfd8a9b475a348a9a960f65866a593afc0fc53612dde
SSDEEP 12288:XCYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:Xve/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T135C423CFAAFE03B3EB7693B174710BD211879CD63E60309AA498764667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a7187f1fbff65c70ce8666c3bb4cd594b69277c9eb3c96c01def1cbc7722bc53
MD5 52e8b0ca47dff7d9e91b97a4a70fc2a7
SHA1 5944b3e5c287419ab44ac675e4ad91fada2688fb
SHA512 7b06a95e76f6934c16074ab1e934e9a6bb0fd9a63a52b1528deaa2c460986fbec2c758b6ea54ce9f959dda379fc2a065e4126d5423b423f899a3c122b9e37ea1
SSDEEP 12288:BWYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:Bre/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T198C423CFAAFE03B3EB7693B174310AD211C79CD63E60309AA498764667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8d9ae42fc86b05fe1be6431d9d7a9f087674f401caf761f40e593796596035aa
MD5 c2d5676896d01caeac09d065b26dbe8b
SHA1 1a3bc52044b04d92fe2805057d9793b07ed34bef
SHA512 dfc9d0058a06478a56176ea02d94f3f6a5cb9fca812384085d86fbe9112af4703527ffa82235df3ffe1612cdda8542264ca1df1df802270bc29946331acc5258
SSDEEP 24576:vZMSzFVSOTe/fvF7asVSyRmdcG/DH+M54c2yw:vZMSzffeN7xB4dcUDb4kw
TLSH
T1C3050199B3A018F5ED77823EC8218906D2B27C5A0B70D61F13E436575F737A11C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 058cbae323de85fa18f254d1be12cf552cc8fc783b65e03c47a7d42638ecfc6b
MD5 81e258393e2f03ea4f53e2e17ac1e8c3
SHA1 d9e26dddbce2ecdd1af0cc19462746f22ace8a54
SHA512 e1dc09b8fa221ce9fef4b266dfe8df3eb4363f70de9cecd79a5a2fd3af3b51c05de9b0e1092e80a921ba52598e4a96de93d0251e1c9b55ce07cf70d66e86919c
SSDEEP 12288:AzYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:Ace/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1E7C423CFAAFE03B3EB7693B174710BD211879CD63E60309AA498764667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9d2b9e698f6e7250a973b534986a7cea9f37f136561180e5c7d85fed64fd0918
MD5 3b48b2b31edbfa0641e9ea288b053461
SHA1 b49e169e96d03d37c3d6a3dff0aafbdf81f7249c
SHA512 f40f12f58c23d709ca570c701925ce54a803aa48a18aaa54bd69c30b7d1df59542ad32cc5905b880c628fe648fc4fc014c1066fc7e296d548d6fceca3d980d83
SSDEEP 12288:qPYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:qwe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T183C423CFAAFE03B3EF7693B174310AD211879DD63E60309AA498764667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 917b469c7a0471a6ee49f73fb1f5b7a03b54811a020c2d8647a270cab45dac6b
MD5 aea66e884e0015c694ba1d7b68e62092
SHA1 abeb634389385a600028ebec8f63413455897ee2
SHA512 9d5e41c28694f05fc6e0572ebcde152486eda24c5f266ed587849d4b8cb49e91e125a32e7f094b2f15384cd11a8cca6a0c6c7a685c14dd1da648c6c40fcef9c0
SSDEEP 12288:fyPz5L8aYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:SzyXe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T102F4124B77F531F5D577833498620A42F3B2BC721B209AAF52A427762F766E05D3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7ae39c87bac5a6c5408928d2d925fd265266d9631e7efdd28267e40fd8768550
MD5 85dffb31aba4986a7987e424c71be0fe
SHA1 db55ab0c2c3b47acd616e6230a1efd1932996f5f
SHA512 64ea2e3891977daa54b441f3c1ad3190dd6a34e7bf5928f7de9b1b0b2a6eb6dbaadd30fc81bd542712671df3b234c442902793d67f87e03782ca299c6f8419c5
SSDEEP 12288:HzYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:Hce/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D3C423CFAAFE03A3EB7693B174310BD211879CD63E60319AA498364667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 53289ff211c4b2af2c286aabf2c601dc67bbdbe75f257a22e0a08655866c9375
MD5 c59742ee04089379282e89df6d6303d1
SHA1 12241f087f82520b4b42672f75fd586ed5b8f8ce
SHA512 827e03d3c5528235bdebe52db0de9d33d1837672981043d665cfcca845e04041c501451900cd0e4bafff96c4688de7ee801c17aaa80b5126221221b013e0ff03
SSDEEP 12288:nzYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:nce/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T13BC423CFAAFE03B3EB7693B174710BD211879CD63E60309AA498364667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 eaa54575bdccddcc878c8b30e34e49d83469d8fac3587972a965fe613881fbe3
MD5 8fc9008e5beb08a0fd608a302f42d99c
SHA1 612fb67445ef18b567d4f34a5525529d15daf132
SHA512 25f620f587b60454a06fecd36b14907403fac91fb95f246f4d31059fde768f0d370b5d3310aa72c17e78fc8d5195304964ff22c944f702ccef6771751d3758e8
SSDEEP 12288:hyPz5L8aYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:wzyXe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T169F4124B77F531F5D577833498610A42F3B2BC721B209AAF52A417762F76AE05D3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 724bfc759300e5895e7e422ad0f16ea6c961995bfd5447ef818dd92702c61feb
MD5 7ed23d22c566db496df766e39d3b09d9
SHA1 3bf26806873b6e955a508037c4b46e7526ab6cbf
SHA512 67d0e47fd4b4918df8b677083707daa95d562910aff5d182bb3ac37cea6f01995a3e8d94f9584cedbbe01704535878fe94906d48d518142f788ceeeb36e300b7
SSDEEP 24576:3THaLl3z0zDle/fvF7asVSyRmdcG/DH+M54c2yw:3T6LljGeN7xB4dcUDb4kw
TLSH
T158050199B3A018F5ED77823EC8214906D2F37C5A0B70D61F03A836575F737A11C29BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 783bca8358d2c4ceb7020a18db01edc94819664125a348a8545a91055aefb900
MD5 0354e4c37bde31062d4b486f5cd3e0bf
SHA1 5055a751266cc2f556b355a943bc134a81087966
SHA512 f488d51975afac7e36394e48515a4f65b038a61842da35046937621df7735e501f850e51b236d035bfc7c28530a0e388019adca2acdd47b4eb88dedeca4de657
SSDEEP 24576:c37d9CHKy7GZhe/fvF7asVSyRmdcG/DH+M54c2yw:G7d9CHKyafeN7xB4dcUDb4kw
TLSH
T14425CF91F3E810E5F1B7DA3599724511DAB67C9A1B30DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 322a6d04201f14d55116e10247598cace9295762ced2bdf652161c603212ee92
MD5 09cdb50d7b39013d10bb5a7824b1782a
SHA1 c6713057c20e7d2cd15add2a5b77f2d731f69a92
SHA512 9490fec59c6f13b16cddf64789d954b8002da928ef1a1afe8b5cbcbf8e11ce6aba407b0ceb2e42da2d62d8f68b322f5e05232fd8132f158912e725538fa980ba
SSDEEP 12288:MAYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:M1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T115C423CFAAFE03A3EB7693B174710BD211C79CD63E6030AAA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 c6a7e74af6dd07bf926c53ce59d4fe71d6b44fbe027cc5367fd4044e300d8886
MD5 dfcc27a1dceff67c16a9f4367ccbd8e4
SHA1 10fb4fb862909be484cc2af6b3017c8ded9511ef
SHA512 26c2a7c667ccecd9d36ca7212ccfd627395ce9c109d6bca2c3c4d88b6e556a186c4ee3806d621cfa8dfe6c69908e1a1d160dabdce7bb93015b15e5e38d7a9da3
SSDEEP 12288:l6Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:l3e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T15DC423DFAAFE03F3EB7693B174710B9211875CD63E60319AA498364267F8DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 018da784455d78ae23fa297ed928794c725b208031dfee031b1f55dcfdd349c0
MD5 f95a62316934ed0c753948c43314b171
SHA1 22275720c14c440c188ca1ffd2d60302f53566f0
SHA512 239e5405ba26af7e9fb6d4b145304aff46255c9afa1ef026e7f9b77ccaac11489b41a0ee2693aa2963dce0e25a75f3030d098c7dde0a03bd91bfd7f2210f1ada
SSDEEP 12288:4dYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:4+e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T105C423CFAAFE03A3EB7693B174710BD211C79CD63E50309AA49936466BF8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 1d3b125b1c84fb4a37d2924849ff58bbd211fd15e6fba23e8ceec6608b6f6e07
MD5 efedbb87f60561467a9ec29db6ec2f33
SHA1 decfa689bd3c81e7fdcbbdeb53ce806ca4f6a39b
SHA512 c825f72a5e889ffaa9e79dcc620f18e8da71cfb4ba09976d8f5dd13dd42242b4c3be76c08ec8ed66027d08ce358b8eb2e695d75e43dae20f682ddd0c2a2a8260
SSDEEP 12288:azYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:ace/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D2C423CFAAFE03B3EB7693B174310BD211879CD63E60319AA498764667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f0dce6e16a5d0c3699fbae9a97c45646d0144e535283d1d6975022514e33a5de
MD5 64a3cf3f8c71afbee242e448f93dbbc2
SHA1 bd2d65d10ca3f5559f9a36d922ba0dd71f2fbc4f
SHA512 c59bd95edd61ee943bed9a41379f730c894642ff1de10b51c0b2bf27f64e8b38c92479578a661ab554fae3adaa784ce2a8b9fe97d65f253c17fc1dc56db56fb8
SSDEEP 12288:XAYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:X1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T104C423CFAAFE03A3EB7693B174710BD211C79CD63E60309AA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 fb70b93336e03f52ae97f45186a7ee97b08b0e7a0a5ec35f0cff2b87927d68a2
MD5 b5105d8544e8cbf4c8d96d6dc7b51a3a
SHA1 b0e073b620d750e9d2a8b8306fb4edc7ee4bef21
SHA512 f5155401a55518c63055115bd549270f5efea6ec1ddafd7e690e1d78e8436f08974f97daa475f4037dd72568ca556c4020bd193bba3cb0c8cfbc998385952866
SSDEEP 12288:I7Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:IUe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T100C423CFAAFE03A3EB7693B174710AD210C79DD63E60319AA498364667F4DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 486384ca3172becd3344b0deeaef0e7ccc617f86c2ce5baaa9c70073d8510254
MD5 5bfad1be09552ea98db11f8e9bb63061
SHA1 78b6328e819be81dbf95501728272bb5d5dee386
SHA512 ebc99e6fd3123e94a521587f3b4fdc50ec9dac209d3c5567042b4158a68dc96f177d250eb5de07f1a2d3d8984c787b546b95e83f555a7d980627ce5b7bf5b9ac
SSDEEP 12288:tJYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:tSe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T133C423CFAAFE03A3EB7693B174710BD211C79CD63E6030AAA498764667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 99cfe53a3e4a0cd4b27166eb5fd83680723f5f96ba37da85542b07131d839e28
MD5 db4b664927c1eb3fe27ec93b2102ecbd
SHA1 472aa4ac31ef0b5e484ffc180a41df836b1cbc69
SHA512 60d5b0e9baf79bd73ae1fb36751478d19786a36858361a0c37217ff2fe0b24bf6f167dbd53381127947f64c9422ee834187922bdb3c2c3fa96b85f69ab293db9
SSDEEP 24576:Kfwvok9RX6wkyAIge/fvF7asVSyRmdcG/DH+M54c2yw:WMnYIgeN7xB4dcUDb4kw
TLSH
T10A35CF29EBDC04E5E1B7923C99B3460AF2B178591B31D2CF129A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7bd0c8e043bef6a496703bb797c18dbe8de2737ea2bbcc2db659e30aabf6181f
MD5 e9d4b5bfca750f5b40ee7e1c9b8e7f2f
SHA1 f282bc18ccede2af935045eeeee796394bf2c0da
SHA512 13a6082d7650102f084889630a7f66213fc2e9e27ed638a6dfe91058858ac3100d78bfe28627e235b9864c56a4529a039efdb23078dbbf49cb504806edde89c9
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZeN7xB4dcUDbU:dySzPCxAcob4
TLSH
T101066C97A1A801D5C1B9C1B98B1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 17205b33549543a5595cb25cf53b30c2dca6b9c76677c57b1005d9639423b1e6
MD5 30a414db38515f6686874124e83a692a
SHA1 fc1ed791edee8b54b325c92f8a9af43c2cd1d459
SHA512 ceac73be3f9a39298bc2dff0fe12d2d963c1a997a899fa968c38e31fc4f12563bd3e034ff3ed43641a6676a9d976eb5bfa440f972f586c80d3c3fba037fc9bbe
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDe/fvF7asVSyRmdcG/DH+M54c2yw:H47JUQj1irIhCnDHUPfF/JeN7xB4dcUs
TLSH
T17B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31DACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1b95c53f79617205835176122c497baf1fb53bb75b98105e6e67f4b065f9939b
MD5 3bd28b8085c7c3e17d051556f8920892
SHA1 f90d0d76dde924f27d1bde901b85ec66abf4ce8f
SHA512 0ecc99f9eb1a12303a61199ddb197a1e47620193ae0717ff9e81e030a46db523c857d0669f2e8d897197feea550e6895c29949c6bbf9e8778dbf0d134acc02e0
SSDEEP 12288:CNsfjYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:bse/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T156E4014AD2A802E9C17EA275D7624A81B3637C6557E0E3CB62C0F53E1FB4AE45DE5303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 928KB
SHA256 fa90a335d175eedadb089dbe54e0f0ec56b209b1c1f24a73fce2c3de66a87876
MD5 2ff315e9cd2f99304bbe622c8ed20da5
SHA1 091793fc827b56ced949c47f7412be857154dabe
SHA512 6011cab40a6e34def55e92bb10711efa0b352459509fbd2c4d89af47c6b3eb752646f44c99fdedf918e849c8336ef27287287b93cf13f39a5e10e71ae606fd66
SSDEEP 12288:sX0IU3fBfCtnouZ6MRoVSVMSsqoNS2fH2qKLr:sXJUP0mhSNoo2PfK
TLSH
T1171507007626D74FC66D40321E76D2CCABB07D41EE45AB0372C88B3FD576658BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f32a62d4be2ff9a77e83cb7ee4ab4da838c3f886a0e2a016a4fd659885b25521
MD5 8c5a0bb3107bacde6edf8bec46a38a77
SHA1 f929ecc7f978ac16e9e20e0ed100f6337e764e63
SHA512 34d05f2943a49500d154097b72b3cca2f3d536dba8ceeee70d30db1ffcc9a9fff054af5c7a0cdefe7a26265204097e5fbf59801cd115d82760c96665ef8485f7
SSDEEP 6144:DWVAx5b1BsZEM3DP+1XUTDIDzpSqtMxYSqtMx7ZgPfA0HINzw550tg7gGzhL0uE:DWVQnc30k3ItHINGIg8Gh0uE
TLSH
T1ED65D8419537E38FD1F720310B2A9B4CA7A4EC06B7456F26B3C8453AD86AB15A1F83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2be6068c4517806073823dce8e247211a4c6cf597fe94e07677336101b1720aa
MD5 4da61cfd1fa303d758caa8490e1e0f41
SHA1 6be731bc993289984a4228d7cb14c6dcd3101d53
SHA512 74fbd950a602535ee8c41d47a2245da39e97226054e46930c742f740de9b90f8d3a6597b4482c7d4e0f6a60580ac4619e62e3b7fb42017819eb8dcd3ae057cb6
SSDEEP 12288:zM7rYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw:Yke/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T140D4239BABFE02A3FEB6937034754661214BBDA52F5070DBF444368666F4DE81CB021E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 37d7b6d558b10c26aa40eaa19f06c05046a576b7827591b2642788b81f960920
MD5 73507222a932e9607e35d05d78aeff29
SHA1 98bde1ab89a07726709b21d50cc78dd45a8d716a
SHA512 7b20f037b554987b7d2ea7036bcf5f8d63a8ad329d70d3904808e1f26723b0134859647012d3aae0a85aa7d882e7c9ef318d35a15335fe3b409035d1ca11bc4e
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYGe/fvF7asVSyRmdcG/DH+M54c2yw:Ygb4mBIBhGFDeN7xB4dcUDb4kw
TLSH
T1DE65AE1E22EC02F5E0FAE2B89DA64417D6B378160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c43754e422f8f42db582c8575323432ebf4d2b52e626859c06c4a18f40977cb5
MD5 327453f61e947c69aa5ab0a6990af146
SHA1 2afcf1676f53494b8bcb384db36fb01235849f72
SHA512 f177af40b2b99e7577beedaa2cd166e8dcd2d14a15dc654633080eb45a18f111f2c2b09eedf4bb6593e9083494a4705ce99021ff768f0b5afa4ea49936a6d34b
SSDEEP 24576:2G88u8FpJqH1bzria7/mTe/fvF7asVSyRmdcG/DH+M54c2yw:d7ZFPqVea7/eeN7xB4dcUDb4kw
TLSH
T1C235F16577E502F1D47BD13889924663F2B2B8251360FBDF06A88B511F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8e823b1e4a9b6f3bb3efd43c93eb5768b7c19278c1647ff0e3d5ccd9f0d9c643
MD5 aa4f26824c7ad31e8e12524e3c85fe4f
SHA1 6a9944f87437c818fd178df8c5f66f714a032153
SHA512 b6bca3b9c982af3e5db073527909623781f856f6892829cba69095b73c1c136336d1948c9ab16d7f66307fb59e1015143e6e816eff90e78abf61af19707e01e2
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjveN7xB4dcUDb4kw:oG05lO43bPxAcob4
TLSH
T12FD5CF6E62EC11F9D1BBD17CD9864A0BEBB23815033456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bd0ba36b9f648c5dcbba890f18402e7a8542ed3f62b39d362ccdf911c43ed749
MD5 f57285bf27c076f7a7aa38cf49842050
SHA1 97791c3c8ee37df907316fe6ae00fddf2b9b2830
SHA512 d8b9e8e9530c3d520945e1686544eceeb273588058d0098f7468244bdff330b8b43c04fd7f95a6e7886007c6c1fa70c83ecb34ea6ff13b0a6071b28a1c470d0e
SSDEEP 24576:Zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZe/fvF7asVSyRmdcG/DH+M54c2yw:Ja5POZ3+Jt2pasx2+m3eN7xB4dcUDb4x
TLSH
T17665AF5EA6FC01D5E5B9D17DC583461AF5B2382213319ACB112182BE3F37EE89E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99b816fdab5b4326dd39e15310f455886d0443846d809be4fca4eb58a720da24
MD5 c703544871e55a43e5a91849f9ccb844
SHA1 aa576e5d72137595a4767fe1ff41b3ef902d571d
SHA512 73f353da89dc949ceaa47cc556b95a8d5f49cec3b0713845f7589e92834c9ebef59e16749ad9cedb52eaea528d85c245b18a850570cc363d8287a5b0396d97cf
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fk7e/fvF7asVSyRmdcG/DH+M54c2yw:yNc/zEOVHF+eN7xB4dcUDb4kw
TLSH
T1B8858B1A23E901E4F5BBE1BE89779546FAB17865133096CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5194ebbc426a026f3d0272b29e393eccf8ffa8de1855b5af25c832ffad00472e
MD5 7d7baef2e9769558e88fc035f097269f
SHA1 5ca4f687fdcfdd2699634d0469af14868d41feda
SHA512 54770671c13867a7366130dddb4d147a1bafc5ef60c18a02284eba256bf323d53c245c4d3214f43038b839a6903764be64b116ae65bf121e7cdcf75355a17ff4
SSDEEP 24576:F8kNvNnaFeYhJNtmZBm9e/fvF7asVSyRmdcG/DH+M54c2yw:F8MwBtOm9eN7xB4dcUDb4kw
TLSH
T10B55AF6EBAF806E4D1FEC6B49D238512E6727861073293CB9290C13F0E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4609838c18534d75f13f0745abf4b837ffa1c4e52ebc0b872e3f02eb224fe901
MD5 c038b09590650592c4df9a45f97ec9ac
SHA1 c9da726072ddf89bc93f187f1b9664458f5efefc
SHA512 eba26b515486f6561bf715ed04c710854417a15705759cd8e2779b2b27782f170ff6aaeb0b3025ce956dc381efb7b0b76ee28903b7c62bef0d3f6aa2ff91ef71
SSDEEP 24576:+PUr+NQfe/fvF7asVSyRmdcG/DH+M54c2yw:+JQfeN7xB4dcUDb4kw
TLSH
T1D105E16F22ED18E5E676E17D85924709E372BC621711A2CF02E0917E4F77EE8AC39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4f9313ea3cbd653ed9b4c90a0f2bc9933c3500dfbd9c1246a24aab7fb10b9cbe
MD5 138d3ea644388de2723a5b42480c2da8
SHA1 3bfe0c80a408c4df19dccb06b50f30c131fc3b55
SHA512 a0820cbb4f2d03eadd3f21a2d895c2148f01615702e205997c11ed49f3f1ee099abfac87f81010e1a0cc8d0fdb235553eb6a483262803190fcb31305c75411d0
SSDEEP 24576:+D3FHshBIYQgAIe/fvF7asVSyRmdcG/DH+M54c2yw:+DVHeBIAAIeN7xB4dcUDb4kw
TLSH
T1F625E17EEAAC00E5E57BD2BCD5634A06E3723CA9032165DB01D491B61F7BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/936-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/936-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/936-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/936-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1088-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1088-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1088-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1088-337-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1088-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1088-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1324-0-0x0000000000400000-0x0000000000712000-memory.dmp

Download

memory/1324-6-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/1324-7-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/1324-1-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/1324-94-0x0000000000400000-0x0000000000712000-memory.dmp

Download

memory/1992-335-0x000001C25BD40000-0x000001C25BEC3000-memory.dmp

Download

memory/1992-414-0x000001C25BD40000-0x000001C25BEC3000-memory.dmp

Download

memory/2396-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2396-71-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2396-80-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2396-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2992-318-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2992-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2992-326-0x00000000007F0000-0x00000000009C2000-memory.dmp

Download

memory/2992-322-0x00000000007F0000-0x00000000009C2000-memory.dmp

Download

memory/2992-424-0x00000000007F0000-0x00000000009C2000-memory.dmp

Download

memory/2992-122-0x0000000000EF0000-0x0000000000F50000-memory.dmp

Download

memory/2992-128-0x0000000000EF0000-0x0000000000F50000-memory.dmp

Download

memory/2992-341-0x00000000007F0000-0x00000000009C2000-memory.dmp

Download

memory/3084-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3084-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3084-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3084-144-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3084-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3716-323-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3716-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3716-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3716-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3936-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3936-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-319-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3936-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-115-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3936-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4512-85-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/4512-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4512-84-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4512-90-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/4672-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4672-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4672-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4672-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4696-256-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4696-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4696-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5180-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5180-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5180-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5180-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download