5d304149e940a87ea202acd63f9949b18d62cb92751c2e6a8f764fc9950de002

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260820-ter6faed29
SHA256 5d304149e940a87ea202acd63f9949b18d62cb92751c2e6a8f764fc9950de002
MD5 14bf284b4d772edd7b561f567abce86d
SHA1 cc9b3bc4d9f047d541880fc96b3948710c667373
SHA512 88d48f2b534919f3ce54777fd2ff3cfaa0a5f90c006162b0f8871e183e396b258bc8a5122e7c9b983d524742ce81eaee153e29d75510a0d6a43f212cc4b6732f
SSDEEP 49152:c0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3iQ/lFTjN4:c0pxfbf+/4h9hNhBX3tLm
TLSH
T1D7A5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2720	elevation_service.exe
1592	elevation_service.exe
4748	maintenanceservice.exe
6068	OSE.EXE
2516	PerceptionSimulationService.exe
3336	perfhost.exe
1344	ReFsDedupSvc.exe
796	SensorDataService.exe
4888	ssh-agent.exe
1828	AgentService.exe
2256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f6e96e1e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8e256d0bc30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000830631cfbc30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c26768d0bc30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4447810bd30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f42a9310bd30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeBackupPrivilege	1344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1344	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1828	AgentService.exe
Token: 33	2256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeDebugPrivilege	3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3412	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2720	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 5092	2256	SearchIndexer.exe	100
PID 2256 wrote to memory of 1520	2256	SearchIndexer.exe	101
PID 2256 wrote to memory of 5412	2256	SearchIndexer.exe	102
PID 2256 wrote to memory of 5400	2256	SearchIndexer.exe	103
PID 2256 wrote to memory of 6036	2256	SearchIndexer.exe	105
PID 2256 wrote to memory of 2084	2256	SearchIndexer.exe	106
PID 2256 wrote to memory of 2772	2256	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2840 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2884 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2884 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2840 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5dc22f91f051ed1b07021f713b65b1944817f2bae7e5aec39aef432bf61e4a46
MD5 69bb8adc2db4155ae03aa24b15c988c4
SHA1 0c9c0163e731532d0485bc3d4ed860d0c296a129
SHA512 b6cf889cd35bb50eae96006e3d2deda6377ce8bf0a6194e07251447f4fca1b256bb19e0c9af074ae4a5ed41022fd426f7992dd8006c98ec0442799013162205a
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzQ/lFTjN4:m3q6HjB3Lm
TLSH
T13FD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ef183c6e6bafa6ecf06b3cce4cfcf3519dd13026a3d20ee870cc0a4307a6d9ca
MD5 b5dc0ea23d1cbf700ebb98a60876f5d7
SHA1 e66cf39ef2d83ca512517842aa8ae2c2f8d1af83
SHA512 27c49c5ec9b7773fe938573dc3f4b5f23f862c742a0d19ce67f0de48a6b91600041699906aacf267f431e5061f93a0cfc9ef4d440afb2681fe0ea1171ed34eab
SSDEEP 12288:21XLsswWkxy2lRq2czAoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:0XYfDtczAonQ/tbw/2Mkjy6Fr7g0oO
TLSH
T15A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5d4cdbd3069de7707ef0644e89f6c07face67df15538be970ee957aa9a97e8e3
MD5 37869681ef0c044fd67b67ec5bd7b5e2
SHA1 5b1d9d376dfd8eed27eeca1fb63d91da38f0de98
SHA512 c53f19e6b763463d595c3454791f8ca19f57b6d607a2b8e32c6624d5fe6f2997c7916eafab37ae28327231a0d918641694a441187a3c91499bf5007f461e0151
SSDEEP 24576:70Le5ji0hmxLrMLnQ/tbw/2Mkjy6Fr7g0oY:7Pji0AlOQ/lFTjN4
TLSH
T129859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f900453e7cc7b73eef6a76c733b7c410244e875e85049c60708171095473707
MD5 4215ce83b890fa3b1320e7acbf67d3c4
SHA1 d507e2c1fc285ed5245f20f097fccb630e0d900c
SHA512 83926abb1d98bda80e6dab17462ad2b2c57e0899f56133029553d4eaa55cd0709dc49e0903476c750337a14031e7e58185626c9e403332dde8ad5577642e5c34
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyu1nQ/tbw/2Mkjy6Fr7g0o9:f/ezSC6vUzPvxHjySQ/lFTjN4
TLSH
T1C1755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60ac9cab12a6a9364e960ba4e681587670c2576822af3a0388f895f12decb97f
MD5 ae64a541afde171e012bf36e2dafee04
SHA1 05f8499614c6b6790526bc34def01de4ab5c19de
SHA512 84cb51a645de9f20b400b51ed0539368466200f7c629b78969077f7251b2513266061588c3d3e51f13d2919ae7d7cf885ccbc6baaf6da4daee1cc325aa0e6500
SSDEEP 24576:xVbqPb88hv/l+60nQ/tbw/2Mkjy6Fr7g0oI:xVO88hXl+fQ/lFTjN4
TLSH
T182559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 31d8f2a5b412b7b216ef74c593cbdfd6229a6fa61e0e24f26d97513b93696523
MD5 ba65e5e2e73cf7e8f51f8e8f96bc7070
SHA1 e3a4d01ea7c208e9fd900bd1b5ed04834388a96c
SHA512 fb7e32222ef6e987af32ea959d01cca404e4e554397614ca1c4e639ce6e34be1db1f7a4ce04517ca210217b1b67b699653396b21bc1761955873fc8e5c1c5014
SSDEEP 12288:/zHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:/znnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1DF5523696A14F897FF2B06B15C9284826B7B0EC1BFD0AB4E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fab6da28f66d35a58cf8e526e057d7c8b8863e2c90e9c3cd15d12e13304ae17b
MD5 ef58a9c992175fadd107fc89c3e7338e
SHA1 e81502343809a361c0068683211850c00ee6afa0
SHA512 c12224ce10a8a768761efc1ab9ee36f34423e943ec89d4a204f60d95a854c386a12381c0b7e3bacafffcc68e5f8d881dfeadc720142d5dc837aaadbff22550de
SSDEEP 12288:meBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:mJIUsnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 91e0a448bdec9e7c221b37314379e505fa68cb144b9f1abbaefa2c884e018bdd
MD5 21c54ddad131250375eabdaad44b48b7
SHA1 2326b2a16834e59907869cea9ef68f2b4d672275
SHA512 175804d60bdf7332f8fc2497a2036e8e27e974490cf17119f617a641edc0433e7752c1bedaae4cc793155b75c63bb73a5cb7536e9dac36434ec2417a0ef58dff
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:UQvGAdlCEL8c/yRNw5CKLm
TLSH
T108267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e014757182783279bb80b9b9e26c37dad847e9318ee30637d6398e7fb45b2c77
MD5 ff5b2ee8f3b5a56eb946a30fceca4dd0
SHA1 601cd4441032e2c0264bc141155192031a2f36a9
SHA512 7891ba8d3c2e91664a1c695c3edefffa17cbf8aeede76624e93e3e703b3e9754b55ab876f225e9471396b4509cbccceb282158b61d7946ec4fac9b3513a7da57
SSDEEP 12288:ZAwSfxL/2Dc39DLLmt0LDQewsAj+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:KQewsAj+nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T16075E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 21d3bb705ea9e67412b63c6c120d002587ec77ed77c94e0c2a3726d62a7aa0c7
MD5 c629541790fcf54f4d3f7d1d49d54bc8
SHA1 23d9754a202cbd574012e29a47f52d270ff78851
SHA512 5b3afb899dbb69bd3c718393f7fe2859c352b6b128749d42d527d8ae5eff20f33d73693af1ac5c66f35fab07d3af806e6541ac5001a6021cdf0304ed8ade8b59
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRL:xUEtQevvqc2W1cpV2EI32
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 218a222ceca5526be5805cdec4795d1f02d3b2f1622f804d9a410bc7746a7a8b
MD5 288f21e9d7c499befd21ab22dd438639
SHA1 aa6dbc2074f65d5524c82f0b9bd34ee6e529ad74
SHA512 d0625ef5399864f23defd04712b067f7786e07f6c3e36de17ebea87d2a96ea50c356ddefde8e57ecd1a989aca5adad4e7c74f04a6f6268ccd80c7dad47a26e27
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zeQ/lFTjN4:KoqtVjnmOLm
TLSH
T16FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 962334fdff5557d522f4f4f50cef6b270f9978817ed7ebce73bade96f7d26160
MD5 4f2a1800122eb7af07ce4bbf1cb15992
SHA1 08159ea0622defa256f490f63aa59bf2788fddb2
SHA512 4e98e909cacf08b09eaf19423b7e602f7254d33ff0b836c488945ec92b3f58b99e16fb7a1ecfbe974c009a80010f1e7418efa6fedf754545a91b4baf1d9bdfe7
SSDEEP 24576:VAhGLJIFoiwtA5l7S535nQ/tbw/2Mkjy6Fr7g0oV:VAMyFoiq5JQ/lFTjN4
TLSH
T16235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1a64d6f21a2039a636356c10c3106f3ac37da34ad6f043a8e6ccc04273846c1c
MD5 77439da4636ca43e5db93392a53ae246
SHA1 aae6c2424428f7e33a31d85b59191eff2ca50972
SHA512 1d5d3f17ba4b48d8fa53ab5901720635ee3bbc2a619ba3200405d0d0defb7df8329caa55130eb0252429f75b0185b87341834f0a2349aec03640c53130e48d22
SSDEEP 12288:vmw5HEjsChN2BFgl0WDm+C1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM4:OwuHOWynQ/tbw/2Mkjy6Fr7g0o9
TLSH
T16465F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ec928f8bafce2ec49e1ecabb7672fd37090174da88ebe66705b6ac1abef9e3b0
MD5 7065ec2f6bfb4351d9c7354dc5c0dfda
SHA1 2c3d448b3deb6fe7a5fae4371655f0454edbac61
SHA512 c9b58a616affc28b3ae4255558a47a0a82c59ddcb1c92ad8971dee4c5c858014aa7f82fe45c58fd87e9fcb4722dea5a68e7f81732459361eebfd6cabbc959c30
SSDEEP 12288:AXZ1IyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:IZujnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13B55126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5d2edb8148e5083a297a6e6ec1c97621338c2e932ded83f7778e765aebc83cf1
MD5 0527799427e743b3a9f181474a6669e2
SHA1 2adb4c54eceef67ff7907859869100e24af80abe
SHA512 7748b19a7b122a3887eade1997f67eef3a1d0751c1f3a2e20d2f591a5af7085910890938cffb49b637872dc889bd93ef8d56a45f8f0bb88b44a9898422c22f5f
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:lQRQyi36YOcPQLvw2gAf+PN3TLm
TLSH
T13C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9d63f3424fc17a12c6d05fd864c11244d30cd0725ff5db4544859063aa54c486
MD5 8394bddd2f4d4c97116cdc30fb5addcb
SHA1 f460f65088b7a22d9adaa270b0ab6f7b8d52eb5a
SHA512 29f5eefb50542932067e989ba73c3c2ac8c745abb32e579c56da982a2ff1f7a61c4a2f37e364b45cbe65c8c0cb5e03cd14521dace7b13c16c48b131288bd3a9d
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:SQRQyi36YOcPQLvw2gAf+PN3TLm
TLSH
T15C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 733c4e12249e17bd204607f61f68d80f3ec6fe7a78701ae78f67a5fe14385a4a
MD5 792850d677c06d988c0b81d5d053501e
SHA1 3642316cf34833af1b9955dc5e1ec5482877f14c
SHA512 cb882af71dc67ec561b6a0cb27239f883ee50089529928cc0a569b853403e5f79ce210d739db27b737f11ff38994daf2c512221ca8f331fb9dde335eea71074a
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0znQ/tbw/2Mkjy6V:168Qg55nhheWu7PNU3/OQ/lFTjN4
TLSH
T11EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b9920339682e0c8037d1e8525e4d50ea7f02ab94fc18858855e1e022da3874a5
MD5 84602ce1180c2c93a36766f04c59d482
SHA1 3880763ef10ba32378572a7880b15bb1ae24bebc
SHA512 50e22068efe622cacfbe7d0ecba1a545f0ced7d719f2a378bfe3c3778c70e2dea16cde37a1c71d9a82361a029fc5c9751d182c9a3d43b115fceeeaa013777d13
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:Vy5112gYy5azzVvL69nLKnhZMLm
TLSH
T1D1167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 94c649d7b2dd18e8971ee6a37001e643bbed6e08718ad116a480fa0568b81e3c
MD5 d5c29cbd5cd1a4301feda10b66a440ff
SHA1 80ac8f3c51849fba6672442adb2be32ea0319ce2
SHA512 d33f21c2279fc1eca61ecddcfac201221e0f02d5a8af1482e9b90afbab4e568eb67af781ca6ea07f6df9ed409d6659d17bc6290cd7acddbf50e286c8a822f53f
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Q/lFTjN4:Iu6JmVxd2dbLm
TLSH
T133D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a7b81699cce7e84a4b026d1ad7bafd2e690c38d81c0c615033edc5d9b7419ebf
MD5 316ab2d97ef04413bce4726e8b0e8521
SHA1 16ac266462c6f6b2b583d4ec3c4923e28bf8895b
SHA512 e5d5f5ca849a0613e47b1695cf9305de7247fe281cd99f9b850255628ef7a83f17139104ccd3670eb6b43295d6f3d6f40330ed40482d01c0a5c0b90b82f2f38e
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:2mifPbROLm
TLSH
T1B8B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 574dec5834e590e01a152c57c3cc7f87f4764751ab9b99b48bb17dfb69a0e65e
MD5 21a02069ec9f04640203118043a5b6a9
SHA1 cd5697bfe38d5f35f226441ae76e3c87cbb90d4d
SHA512 b2d41480995b2556a0770e6838d734dcdfa556c724c994e79fd48c72867855e6e921c10c397ef68d37eefebcc6f4d351c2db746b383d3fbfbfc802be92ad610f
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqjQ/lFTjN4:a5dKTi61ILm
TLSH
T1B6C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 212d9c4ae985abe6a03d3192883aa3d1e5a0e8c9e266ff5e9b748d67a55b9748
MD5 6f625cdd70211d02a5d5578f341a5d1c
SHA1 cbee8ab00421481b06091e706efb49c946990aeb
SHA512 136cb2252b6a85fa8a29a5169320d813eb0b6db5bd588b9666bfeb265411e7ea6ecb15c006aac882ec9c2807d87833d2a3994cce2d85e471ce6f59222073fe5d
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5woQ/lFTjN4:ZX2iyphiLm
TLSH
T10F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 378942724788074edcb91e584a2029d0d464b757f8f9b471cf8178a691af1951
MD5 1f934350942177b013e76e0a09f90316
SHA1 80da4e9e5b001efbb4694ef3d41b343617d7f365
SHA512 2dea587798f9cbb8e6b4a7d099b6f4539df36610a9f4fd6b4a9c632db74d09ce517bfa1acfb4b6dc907367f7bcc5f517633cc877294ea528a812d071092d2222
SSDEEP 12288:U/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:UfnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T12F5523697955F98BFB1706F18C828182A73F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6dd50c628069043a284373c4907ec979a65cab7522e2de9a4aca40d76eb81d66
MD5 45aa0e568c766241d84a729ead26fc44
SHA1 1140a3e2168ae5f4f67e5e1203ab9bc59bba7e92
SHA512 660d7b3bd8bc1642138623dd3e787fe74b57402008909931c6e39a13f87aeb5b78eba97f4d48c62af17350b62f5bfb7cd140f384b28ff7f0aec0e87ffe74b216
SSDEEP 12288:caGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:canQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1385523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 90298fb9cd394874b002462c559f59f913cbe65633a7715de57f19dbbc4c7d5b
MD5 60af0084df16640bfd8c7487855eeb02
SHA1 e55d50ab91faaa2416e26127d10ce72d88c2d3b7
SHA512 25e08706fda8b35d62811ff166b030409e302c1a503d3f62d10cf40ce1662d836666e93599a0289bd5fc8739ff534d0870c9bd58931ee7e32ecb827814599049
SSDEEP 12288:EkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:EEnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1DC5523697965F88BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 35e74270fe71deca1f8aaaa94bbfeb3cb8342886a1b09b793c3b368d9ff93288
MD5 6f0f41f0ee9d6ee755234644407cf095
SHA1 f891b160520a2a0962cbbb87571425af775b7f4a
SHA512 a325cda6b3d260e88a97927715a7ffab9a932ed41ac6dc493e17fbf656ee9a1b3faa817925fa11ae68250cd450310835f0cc8844a9b48ae0fcf218eb97497240
SSDEEP 12288:zVJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:7nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1355523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 33b17ecfe73a56f85781b9575635b163557f7628d08d99cdf92c7b2247474781
MD5 3f7c08d0feca29d859de334345967ce5
SHA1 983cebde4004e562f2705a56155651c3e2128741
SHA512 231101d94ad469f4b40b3dfb2209396876baeaa5be39735113f3cfeb484b665378bd6bc97b57fa54c84dce7f20be17429477bf3a6eaa5416af9d5d16a5f95a6c
SSDEEP 12288:pxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:pBnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T18C5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 58e1d55eb3f2f679dfced9bd16522af3e982d331e7eecbc96dda43ce90bfa757
MD5 ccab7667fecfc933795a1b26c952a188
SHA1 9ff24015715ddd05b3c4120834595257b2023950
SHA512 176a8a164184ea3f8af9a79963fcf2f58c460225f29eedfcb2a02d3411495b40fff414f1361c4fbef4cba2d939a303bb11e40e8dfc37e38b7efa8a8c35e57538
SSDEEP 12288:WWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:W2nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1975523697965F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8be9b0ba4771118c7d8525093eed50f66b8d0edcf6a9ea5718c0c9e45c1ff680
MD5 0fa6766b39254d3884e38d760309c6c1
SHA1 51a48932cf10dfaaaf02d6f7ccd1f559227c8d89
SHA512 74cc1043658aecb93a298e9629ef51655c1f9c4901db9c6376e0e2560008717056f31f2a6c011ce105b42316e0db75a137c870ac7c9314427b33f46387c87ea7
SSDEEP 12288:SCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:SCnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1295523797955F98BFB2706F14C8281829B3B0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6542c29136b44faa1a88ee4d201935c881f0dce20387a5b9820f7817f57517bd
MD5 37d2aea9c53d17e120b2c1ec8cca8516
SHA1 ef7ae7125bc009bf39c51be866511a821d72cdfb
SHA512 7e38e8bef515354cbdf05ebf7231a2c57d745e8666c8946f4e6331ba77bfc063568fac5c6ed283a34308584e126fa1bcc5af039b027295edeb9441c17d16cc1e
SSDEEP 12288:SiZwbDzzFEoS2cPvy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:1ZM3zFVSO6nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1DB7501A5B39058F9EC67423ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bfd78c8e5a2728ca1c533d9657ec758b827f7d9de58dad5957a2ac6018429c9a
MD5 76a7c36f3b019b710c17372c767af5a8
SHA1 14eb2a8f2fbfce8f55595cb4c0420c487c8e0186
SHA512 e4e5fac6bb22e5c554a30946cdb1828afa168677825617c7a07f787b8be2a32b6ae9a4455fba82f199914060aca78356e1078c29dc793bb07abce7ee291ed653
SSDEEP 12288:xjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:xTnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1DE5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b085ef7d2e54148395ee61f8a497b26371fb40b69af983cce6763969271ae92d
MD5 04fd6f1427722cb5507fff51ec187174
SHA1 09111deeaa789598f210b582eb86821942e35727
SHA512 f0a31161ef2e94ffb013a1c8cf43f52835b4301b7eae842d47383345949fb59e36d659b1bb3b073237ded6ebef5331ebb7408472f6dfcb343f323b8581042a39
SSDEEP 12288:53GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:5XnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1DC5523697955F98BFB2706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 073dd5b6d48185fda647a42256a016ac6d9feab2e09d40566b31ca40e19df751
MD5 29475d92cdb12e4c9647e46651641be7
SHA1 5ccb6affe82cde2521f64706370277778429fd63
SHA512 cc2a6d85da544c495e065db3fe967ae5deed9e0fcd437480201bd40f6db2435f67c7d5991e4e97503620e3c10c9d9da1ec3eb95e03046ffe8b53350b58dac86c
SSDEEP 12288:MyPz5L8uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:VzyunQ/tbw/2Mkjy6Fr7g0oy
TLSH
T18565021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 203d3f1b25a7f894233a32f6d1dffd54d7184a164907b3a384ebb9adde825a1f
MD5 3eab5ba658268870b14846aa5ce4d155
SHA1 9ea9a2840b81a160f16247dd38a61102c98bf12c
SHA512 d7faf2577e04a33ac72fcab7a71b9702c2e71e214545a83d822c323ce500ca54d723e554c710436517e0c0fa940f2e95f1a901e02aa2c7ffa8b8a82360b9373b
SSDEEP 12288:0jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:0TnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1C35523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7da29f104154ff48ecea123f541cc9d915bdd23c58b5cb6ab40646cfd1e46c87
MD5 79e55bee5835c7946fb7994b11a0c07d
SHA1 ab3729f9c8cbc71a4ebed8c4ab47cc925a8b875c
SHA512 3fdd1b6be96a943b928d545aea70db3c3f57d6970f7963e077a0a397f97309b51ab9402464be7c91db4670f47ce45c6a29ccc947a0d295751001ff79d8d972dd
SSDEEP 12288:NjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:NTnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1795523697965F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 96b6c266fc3a20fea3ec88712358c7957bddecf4566b98cdfa4a0c5a4bccbd87
MD5 7eda1e895a68b2ac2a6b4a018b660cc1
SHA1 fb8d6e12f6b97da5ab4d3892aca675ab5d536252
SHA512 dd609d5a3f1cd4e1804a667cf6e37fde1de175660daf4e08ab229691e3a6a1977ec9993caac60d30b34872ad730fa07141a5f0647f83ddffc7ef536554ebe25b
SSDEEP 12288:WyPz5L8uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:rzyunQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1CC65021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0cb19c9c9adaeb5b00101f02e23b9e56cb0800c4df287d2ee1231b89b5159149
MD5 3661278843867c487bc18f32237593f8
SHA1 b66a472b060379df6485e6ef8b95ec983ee5d141
SHA512 ac0830a60191bc34296cca0eff011614d62643b688164fd31c05d84a88f13b6a56f5efbd17165fa7efc5a37617e4191dac95ba8f6719bcb1f37df0438f1647ea
SSDEEP 24576:oT0aLl3z0zDUnQ/tbw/2Mkjy6Fr7g0oB:oTDLlj1Q/lFTjN4
TLSH
T1717501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 81cc3a3b6b5d5b9be9da62b8ef9293f5bf0c350c996f2887c2129fec206d5bbd
MD5 3b688ae2d3376d031328a8b10aedebfa
SHA1 fc424467097ed7323d752ec79acbf3c031749514
SHA512 d417bebd72bd9c7a2b90f123f6e986ff34f8beac2b0813ac876f8b3dfe7f5626fc641b589b0077cac06950ba050be24c856ea838118ffc7464b998eb41491a31
SSDEEP 24576:p31d9CHKy7GZgnQ/tbw/2Mkjy6Fr7g0oD:51d9CHKyamQ/lFTjN4
TLSH
T11285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6ad1aa119574fbbc0ee0a742842f0a925e0e0b7383fc0252cb89b74feea0e30d
MD5 070d21302d230926b8459304ba1cc45b
SHA1 38833a676016f5ff65ba62b29d1bd1249dbbb063
SHA512 85c9e88424b335bf5c4a1d925dafc58531170548502595b3ee66690fe46ebb5fd8b6f4d0b78e3dd0a11db119d7c83e60532935d78282794c3643fefe5c09fbec
SSDEEP 12288:8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:8knQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1325523697965F88BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fc66d978e513076dd5262fbae3277876146f31cd8738c4f2567ffca0adcc5f02
MD5 d4917105a37712c924b5bd9ca4917a8c
SHA1 93cb094fbae9be6137b7741dffcd52145e9bd787
SHA512 12b56a6492cdb85f1f8fdd4c6729f56ec0684dcafe555ccadb8f64bf0993669411b381bdb00370751b28edd938a42ecbff7e93a5d6c936150aef4164a9a1c48a
SSDEEP 12288:nOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:nOnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1865523797964F89BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dbcd6174457d133493b4a5be766f1b77afc8d9e0779a79cc2d5408a65e1688e3
MD5 f077e9f446003a5ff28c997f77bff1a9
SHA1 53a280228fee6a55af475ced065db429caa8878e
SHA512 7a6eb778e10a39d4289b7f5a4c3250671f031a398d1418383151975fddd5a63eddbd691ffb2f4f0fcc3cc33f97d70edd9d82da64a7ce57747fdab23edd31eaeb
SSDEEP 12288:W9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:WdnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1025523697965F88BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7b5484e47f19a7076039f1ef893c6582284535e56a850d1ce0157d667fcf1950
MD5 03c2e4c10cb5363953c0080b84c30ec1
SHA1 5fb6501a707d2f0dfa883ed07c9e77ef8923f3b5
SHA512 c0fc9a43e921e952c83df6d1be746f3f9ac3f8012f08e143a9d54d04bad653570830f45ac7c7a791c058d12420f6ebade6ada04be06f6e449e4c561566dff69f
SSDEEP 12288:QjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:QTnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1FC5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a073eaa4ded96294cbf96728910c3712a21f3eb0b81f87dfb801850216b9d66b
MD5 1230ca0ddc74ed966eb2e264fb7e68ae
SHA1 a20a89538d1681635af2a9017e5df2ab7b35c961
SHA512 6852c55fd350a992bffbec682bdd858dd51c2ed8f844c2acee6cc7eee3b63d0ad22f720d73a9eb74e659e8cc1d0af48dd703c124bca2eff35caaea05cb188bca
SSDEEP 12288:NEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:NknQ/tbw/2Mkjy6Fr7g0oF
TLSH
T16B5523697965F88BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 073e2b63687ab0011688e7a038442ae469263081789e28b78ddcc0048fdad8f6
MD5 a27440b85cf1d81508b075c791f41840
SHA1 7eab75987b035f8cd97eea20fb078644948a1027
SHA512 2316664b930790482e86dc866290306a4047753f1d42e5bd038c0ad9cce5d52006b76342fe7eb76ebc42c84ddcde545fbc12630d561392073f2a0a806d236a6e
SSDEEP 12288:BrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:BbnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1045523697955F98BFB1706F14C8281829B7F0EC6BFD2A38F7B481128967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 db1f40203023ec73dec9bfca0bfaade934c4161a1cc4ee222673f3590259e748
MD5 5d5868aea4ddeb4c490c2adcf9daa68d
SHA1 9695ce0302732ffe573765e0ff84001a2cd7dd6a
SHA512 5350e1c51aad42b28f1020ef376ec8ad93cc25a1edfc58c361d89d5da61de699bbf5373c44dabc9cdf3ab4b3b063df20d10a55cf2e44b06b3ef9797b9c7b3fd5
SSDEEP 12288:lxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:lBnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1DD5523697965F88BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f62f3b576d9408b059e1f1a2b91e5bd5195582ce845dc85d7b7d90aab1d83b3c
MD5 1ab4b8736ff6547741fd5fc71d3e1b56
SHA1 66c56cb0dbe01480224be5f00f2da0949d6d6f45
SHA512 1ea68f1eb7d8e30a6f1f3461f656fc684a252c7de17dc813de4e885b61beac83a8491279f13fd47e7371ae68649650dcb8ae44ed2d2c04ba9fe0664ae20e61eb
SSDEEP 24576:jfwv/k9RX6wkyAIHnQ/tbw/2Mkjy6Fr7g0o3:SMnYIHQ/lFTjN4
TLSH
T1CA85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 88e2656351647cafddecae4977a4bc8dd33033aa4a001985383b88fae643984b
MD5 9c54a4d7501893b5427bed758e4220d1
SHA1 147cac4365b41b8a6af99eb95643b0f6161b6d88
SHA512 a225c157384a4f492d7e8600ff651550a00fe5239843109ee3cacb307d4a033f2997b62ff070738bf3c0214ac37c6c0df8a22fc3f5e1da467a437400a1eeb0b6
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IQ/lFTjN4:0ySzPzLm
TLSH
T109066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dde1eaf6109b9d20a91fee424299c3f90aad9e28bd2f006f9e6ea01b8e50d44b
MD5 383b948133f3373b559ebc2d8fb20388
SHA1 357abe3c4a6ececb08b4c4a3d01787669e87907b
SHA512 fa4b8704ae17245326d1d320ffd84baba86dbda329310c35868edbcb2877571ffed71d1c137f111f15bfe137e131823c4fd0c440b764da8c6aeb87de799aea38
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqnQ/tbw/2Mkjy6Fr7g0oZ:j47JUQj1irIhCnDHUPfF/4Q/lFTjN4
TLSH
T17065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 750fd60dc1c951802837577bb7e83dda691f017638bd6922a3bbb0fdaa49ea93
MD5 c3fdde63707420c95d163bdc8980cd50
SHA1 8b06e5ecd46868b5f23c6a7fa61cbe32ee42eeb0
SHA512 e0bc8b0ed455fcde802b968a90a09b895d6a36ffa47719b1cc3fbc5ec7374f9bab8d250929fa557a0799a16b6728b5de6dcd9745170849dde4396555d491bc64
SSDEEP 12288:1ssfzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:VjnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T10065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 59607acf56d044bcd229a4831437c9f15d7bce8ab387d53c0f2b0e7c96765b0f
MD5 9498ec7537b0b75426b33ae29cd6f9a2
SHA1 98fd1cc4067ff75deba158855b4bb2251260d581
SHA512 4f21eff8f524da91852de2c5d60ab0814788677b8a20143378ae907b68fbaca48448dff27692f7866bebd55a22340bddcd1a1ae29f17767281a7cc8b9b662d4f
SSDEEP 12288:UaQZ+eU3fyaB35oiilcEH36rJfRha+HvzZnlqZlJJy3+SC:Ua2NUPrNiVH2f7PzZl+lJc3+S
TLSH
T16D353910766AC75FC6AD40325E33D2CCA7707D41EE496B0772C8873F8576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 cdefd1083a2876f9ce35fb13d4ba9e75f5e6e1f9c428d6f10aa6366343dbc141
MD5 07d8deb057e360269f9c8516691a5000
SHA1 eb15021e76af514dc9e113e527ef914522fbff89
SHA512 c36cc34477e8731f0dc7ca597f94dbea76f608dd5b9a9f163c99353126953f89b8bffd9ced76e994b9be0372fd10381ea212ce7c9fc4d360c992758c701a73b8
SSDEEP 6144:XM9DoeBADIi4zN+VYplgxW26tMx3V26tMxiHj55JHsIgb1Ya:84xryIOL
TLSH
T12955C6815537A38FD1FB6031076A6F4CA7A4EC0277496F26B3C8453AD82AB15A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df571e983a2637e43738b1321b6e346362c70b313e5ae86cf358410ed0389b02
MD5 77c9c4998f427076e5683d8142dc289b
SHA1 348ae3279bba909b4181ab0bab66b79761c3e6f2
SHA512 6d0b0f2994f5a3a1ba908753cffde462e90682782c0812a125d6ec1fc0e37e22725129972b791039adc18388c23953305db9e6bb464af4f28f1fa190a6efd6c1
SSDEEP 12288:b677GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:CrnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1475523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2d4cff9d7fc69f9eb61bf8dbf97ab87b7c7f1665e320f5b587e8bfd57bac9173
MD5 de78998a31ada280e24abe13d3a45f55
SHA1 3239db27f916b9e6804f3bc44f7ec456bd908ac3
SHA512 5d2512ec163642e796e75b4ecd5b7256806cdeca419b06ce3a416cea4d06df3a2aeee7d7780733854d229fe85db8e9cb6144bc24903060295c27f5efe4eb6b8d
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY1nQ/tbw/2Mkjy6Fr7g0oe:/gb4mBIBhGFqQ/lFTjN4
TLSH
T12665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d4161ae23ed299b7335f456bdeecd4e9b57d9bd306a024effa4be6e96c43b9b2
MD5 383f5095b5c23a3f10e301947bf5bf15
SHA1 9ec7e44b858ba3a7aa7d1569cf5051fc976c5264
SHA512 926f554d0fb91c7b219a62768084f39943350ee8127a33e60ad87849fb7e759f4bf7a834214d1b0418ecf3660b53b72e1227d36425c27a677ca05e2514f58511
SSDEEP 24576:5G88u8FpJqH1Qzria7/m6nQ/tbw/2Mkjy6Fr7g0oG:s7ZFPqVva7/9Q/lFTjN4
TLSH
T1B085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6bbf02d8cfd8dd659e3d1a8f60753354029d8ff744d7914423b135bbfb227dce
MD5 c95324384a061d9037faa3956138540b
SHA1 d067ef33de7c9fbafb81f4746b79f4c8ba124dc1
SHA512 079a178f299d98faa291258a973a3199052d10d863b405d885902a83a2ee7f5f3d1d573b034fa866d29fa674ca5b2c00a69ef25333a63df5a68bd3023ecc53b9
SSDEEP 12288:6HvUrBFrEjwaQGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:6PUr+NQmnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T11A65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1c0833310d710bc1aa43513e7d6c739104d20baa9f2927225524afbf67627ae2
MD5 d7a4c27bf6ed55f418c70e44916138fd
SHA1 d65034e54f4f48882e362bd7ff01c5c823fb60e8
SHA512 5f9de476fa5feb58317713a066031795a6bc371c153a3b0f8e249d32445034652bcfee900561ac48f4221962d6241ee7be582e5d810371d72311b69fb1a6a458
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Q/lFTjN4:BG05lO43bELm
TLSH
T195D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e742e36d12fdf77d642e6ae4a46fe473fbef678342f319995019fc7e2ab9d79f
MD5 fb33ad53bc8c716b14423c5474ab0b77
SHA1 25edd77fe353f8e168304b23d6477a60b9fddb30
SHA512 5c4a2110070b45473efad0814588dc3eeba9ce3e3906160eb960ee63ea632c9303773ca300616e978d4503b4b62d3f81985214e865bcccc5162b556c573ed375
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnInQ/tbw/2Mkjy6Fr7g0ov:Ta5POZ3+Jt2pasx2+mOQ/lFTjN4
TLSH
T1DE65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9dd1c1f61b1618726fabfd169790bf72d4b1e9563f523683fc9896637f20d762
MD5 887c35751d7c094753fd6f35b5bea851
SHA1 ccca5026ceb374e75a55d760d663202082b03893
SHA512 ac2be57d8e6de2579a72f4980547b48f9e230b153acc6b95bf3815316fab876e133bc987d74c59614d6af69655e8f71607395dceee4761a0b4aa9be2676f2a15
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkSnQ/tbw/2Mkjy6Fr7g0oV:cNc/zEOVHFdQ/lFTjN4
TLSH
T129858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f4b91c63254d588747400c77bb54d9126b9b5c3f3f6800925a4bd38e5e95f888
MD5 26569caf2b2f96e49f84940e17e1e497
SHA1 f18ecf7eefd241e9566a82a464cc03e4413d316f
SHA512 5f376f0579d605a499453006693603e7ce80c11502ab70bc6a2a9669dc1e537f5e9102ec76029d0783a94c6c36b46688eade04b9ba29c2d2be42cdb0c88bc221
SSDEEP 24576:98kNvNnaFeYhJNtmZBmcnQ/tbw/2Mkjy6Fr7g0o3:98MwBtOmcQ/lFTjN4
TLSH
T1C455AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 32f15318888fb403a8de8ed4200e8246c8e8255b5cf7d0bb7db4de6a154620b3
MD5 8f3172c4995995e549abfd813daf593c
SHA1 228153f95150363906f0777fa252f0795cb50785
SHA512 9ded9eebbeed9807f56825151609918f5f693e36cdf8d423ec4f7ead9a77600070d5896c6c26043da1937ae2f5eae255bdfe46cbad3c44819bb1673e488247be
SSDEEP 24576:QD3FHshBIYQgA/nQ/tbw/2Mkjy6Fr7g0oZ:QDVHeBIAA/Q/lFTjN4
TLSH
T1D875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/796-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/796-312-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/796-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/796-316-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/796-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1344-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1344-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1344-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1344-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1344-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1344-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1592-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1592-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1592-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1592-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1592-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1828-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1828-128-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1828-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1828-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1828-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2084-407-0x000001DD26F40000-0x000001DD2710A000-memory.dmp

Download

memory/2256-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2256-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2256-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2256-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2516-283-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2516-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2516-67-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2516-73-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2720-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2720-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2720-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2720-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3336-84-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3336-79-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3336-298-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3412-77-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/3412-8-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3412-1-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3412-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/3412-6-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/4748-39-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4748-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4748-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4748-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4748-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4748-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4888-115-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4888-121-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4888-122-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4888-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5400-329-0x00000249BC560000-0x00000249BC6E3000-memory.dmp

Download

memory/5400-398-0x00000249BC560000-0x00000249BC6E3000-memory.dmp

Download

memory/6068-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6068-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6068-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6068-247-0x0000000140000000-0x000000014017A000-memory.dmp

Download