962f37c82057ab416a6530d761f3e613041f98affce22ff43a6fc3eef56f0b51

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 926KB
Sample260831-b4qd2aec72
SHA256 962f37c82057ab416a6530d761f3e613041f98affce22ff43a6fc3eef56f0b51
MD5 ea4eef78a4c344ac322eb41178aa9b90
SHA1 b8f210d2f8a8dafc1397284fcc6bfb95fccbe819
SHA512 9bb0d359914fd32ad1ba69ab33f1f117501b8fe7867c18c7d358a948ad84f73d04faba6023271ec66bbfdfced9d0f7d29702afeaa1d4a13bbf81f85dfc2251dd
SSDEEP 24576:tsYmkmaM41Cb8NGH3KnAoIBlEq1tIgAWz5foj3Z:WYdmaMsC1KnAX1tIc5foj3
TLSH
T1E715E02177D0D036C2A231714BA7E7B5AABEBC305E35438736D02B3EAE345D1993971A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5772	elevation_service.exe
120	elevation_service.exe
4240	maintenanceservice.exe
2736	OSE.EXE
3308	PerceptionSimulationService.exe
2956	perfhost.exe
840	ReFsDedupSvc.exe
6088	SensorDataService.exe
4140	ssh-agent.exe
4808	AgentService.exe
1188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9cf14be8e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005e61cbfde938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d5c93fde938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bc3c0fde938dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024483cfde938dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061cb9afde938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d017483dea38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	840	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4808	AgentService.exe
Token: 33	1188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1188	SearchIndexer.exe
Token: SeDebugPrivilege	4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5772	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4496	2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2080	1188	SearchIndexer.exe	99
PID 1188 wrote to memory of 1888	1188	SearchIndexer.exe	100
PID 1188 wrote to memory of 6128	1188	SearchIndexer.exe	101
PID 1188 wrote to memory of 4760	1188	SearchIndexer.exe	102
PID 1188 wrote to memory of 5412	1188	SearchIndexer.exe	104
PID 1188 wrote to memory of 3300	1188	SearchIndexer.exe	105
PID 1188 wrote to memory of 4344	1188	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ea4eef78a4c344ac322eb41178aa9b90_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:120

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1a5e33e63d93dc5e3229bf2324ad31175d691706b05798cb12d663c80bd24d1
MD5 66a9c2a8c6e64a42b81ecb5545245adb
SHA1 37d0c95102530a0295ab29500ec2cb0b0b5f1ef8
SHA512 fb22d5fb69348c7b6851e19a57d042ef7bcb8db4758fd82563487ace396fa56a7b2b4bd14669ceae443ae6e3f59a29981e3088d699bffc0883ca43fd68c2dd0c
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmKnAX1tIc5foj3:93q6sjBZ0Okc5g
TLSH
T163D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 bb1065e272bf9c2dd0299b7e66bb75836640a8fc5224527f7a15d2d0f084f94c
MD5 fffc6575384a0bbbe9a08a88314b24b9
SHA1 c638fefa26a1e99bbe191f7f60ee9b150146ca92
SHA512 8dde9b532a7d17acbdb660896ce764663fdcfbf2a5e5d595c1fa04a88727fed5ac84132608ba9ca3a7cd3ce32ddf44833f58a179eeeaac29108fbd84516dee70
SSDEEP 24576:cXYfDtczAd3KnAoIBlEq1tIgAWz5foj3Z:btc8KnAX1tIc5foj3
TLSH
T17305012477E408FDED678238C9B28506EA33B8514770E69B03B499266F377D81D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2d60ae0eccf2c7c5feb6808a129f7b41be993e2944e245953f4d341dfa609370
MD5 c4f5d434626cc52ba89847ad38e0b6c7
SHA1 08ddb4c720cc682e891fb208e79b3282dae2a38d
SHA512 11013d6d02287284e27b255dfb4d69c57c328b93df8c3de756160f0db8fc146d62f04b2b5bd94c9341807d055d8f34b535f709f4885c77aca7d26daca75b5ae5
SSDEEP 24576:Q0Le5ji0hmxxrMY3KnAoIBlEq1tIgAWz5foj3Z:QPji0AjPKnAX1tIc5foj3
TLSH
T152359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f27bfff4b926ce34e0e22fd5ff337accafaeb1e1b31326a8df8d66b5e6fc9ed3
MD5 0e51dcc175c2bdecb2ac8d6038f478a1
SHA1 659b2dc58c2d59851743a0d25d0dd419abc69aab
SHA512 abad747ad396a49e1afbc143a211126b1fdab41f56ed039dc8d955f60b4942173248f050d0b41bbd92ff00ab483672f0a723b6b5a5051106a94558345d5cb4e4
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyuu3KnAoIBlEq1tIgAWz5foj3Z:X/ezSC6vUzPveHjyzKnAX1tIc5foj3
TLSH
T1F6756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 23fe34b03820033aaa756463b2470572f46179b395d7ee17b7e33d1370915a66
MD5 3e7dc7b1cede02fcb8c78fe895c6129f
SHA1 879126aa62555d22846e37bb7d62c09dd77938ad
SHA512 d54c8833624310b44649767dd7d11ad9e96b06f51c92ba80ab11990e7644ece6a5e8cb71913fe20e9020032f647e4e227fb34badc375643be7a26d201d8c6db7
SSDEEP 24576:gVbqPb88hv/l+Yp3KnAoIBlEq1tIgAWz5foj3Z:gVO88hXl+EKnAX1tIc5foj3
TLSH
T148559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f4dd6158645ed8f00ab1cbbfe266ac9c5796e1bb45bbe0caa528e1a22644f5f5
MD5 315a567f3acf8f873029e896745d73e7
SHA1 c8976602cb7875c9ef65c02c46f788454444cc9b
SHA512 4a54987e1688609f5068a2a2e241cbb5ee33cd48161a14dbe40d79ce5815750023cb2d84fc933444fe58ebe7538f899d7b8058a759c7458cdd6d3486edb2eb83
SSDEEP 12288:ZLyZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ZLU3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1DFC423217B5C182EE7674631A2F6684AFD75DD70453A4823203AFD07B63CDA0A83F276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 aabba164f95c51271fd07fb412bf59a2b1f38f182a7c792177e63b15d0aa51b6
MD5 9b0ea0bcb45b40bbcd226bc027d864a8
SHA1 8e4b3a6a6661c52b567da32ad02f208a169454a8
SHA512 f20989d2aa9f1ba5b67645faf0daf39d8cb0c9041f937bb84300131fbaa7693e932818a2ea7de07dd47a28e121666e3142261edc5e0baa082f94922860fa6499
SSDEEP 12288:UeBNUbTVO86UPZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:UJIUR3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D005C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 809e800f0bd53b5e3ce11ec6b371f2bb5140c129f37c72504117ba7cd6f1aa08
MD5 092f1d59821e77579701dad90b6a513f
SHA1 dab94839c1e26a09ce433b7c9ecac016cc91f11b
SHA512 38bc84405d63faa8f92701b21100b79a584919181116b1748ee3b7872127a0798b680b81cf333ed3f5674454b0c95f01bac95b868fe7e4fc4b868dc2e36a6b94
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:jQvGAdlCEL8c/DRNw5Cc0Okc5g
TLSH
T149266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3da3fdf8c6d146abf012860eb83d1717a1662fd1a7d9436ea27d54bdd34cc98a
MD5 2fc6cdb0430890f3a0e6abc49ce935a6
SHA1 f3dbee8c37253cd684c3cb637dbb3c2a6bb3159d
SHA512 eadf0b178e8e645331c4787e8ede5936613391f6a458660b4365fce9449b7b8ee470cb1b305a637ce6616ab8b690c489c3f71a3e3c5c61032e4ae6f033c63308
SSDEEP 12288:EAwSfxL/2Dc3RDLLmt0LDQewsAjVZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:Z0ewsAjv3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T19D15E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb265f6b650e4ae6cc92a10611d2c2bec744c15f300d0c08f0c93860680a1939
MD5 2801c3532540b3756d7639b9e2633e83
SHA1 1110e15f2fdcec73f7ccea8d3aa822637456e856
SHA512 45225d4c6544b332a4b3b0c629997468c2c2e9be152363f40348ebf1874397221ef77cdb4e4650d9b5ee85f04772ee8d72a7d9ddf7d185b0afb464caae054e2d
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkOBg:MUEtQevvqc2W1cpV2tI32X
TLSH
T1CC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b2ae12bdcd7db3ba7b790ffcdeaa18e2fc6ffc51b4112996effa9539d94dcaed
MD5 d52e4ce6b84deb322d02c31405471b69
SHA1 0eba24819bc8b8bc75454b535796b72bca225599
SHA512 086f2c8e2821f9992316d56bb178469fd7762e106b708e2224690f1fc809f68594452f34ad4aa6cb2a0210f07cfb9d178fb0f9e4020c9b3c15ebb3789c3a362d
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zfKnAX1tIc5foj3:aoquVjnmg0Okc5g
TLSH
T1EAD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a74061d5951c6695aba32e62749cec7238b3ea03119d776b5d2404bc24ead7ae
MD5 86682884a843325867f7370280e0d739
SHA1 10a0f5f20d6c9a01b69377fc968660d0926bcd69
SHA512 0cad25fc2dd74fd307c6fc73059cfaebfa9ee78b04ab17c0d0a316b3de3148fd1ca42de98cc5372b4c2fbb7c52dfd7c195117e652403a9260fc2d78cbc90813d
SSDEEP 24576:NAhGL3IFoiwtA5l7S53y3KnAoIBlEq1tIgAWz5foj3Z:NAMUFoiq5QKnAX1tIc5foj3
TLSH
T1A535AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 093879e63942f472630549dd76e1c6fa3319a8f0a6101f20f16c4998ff0dbb37
MD5 afe8da82a597e558a257bbb42f0e5c46
SHA1 4a8bac9d315e02d6ff8ac16498867b7f8ad0a53d
SHA512 a143f1a10bcc4ac2fcf9f7d5f34160d0dee715b744ee789d2fc59091d4714477732f5a4183fe38a2d6f1c738ed91d95dee9a4eb6b9e4a5e24fbda3e352cad50e
SSDEEP 12288:Hmw5HEjsChNVBFgl0WDm+CEZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:Gwu4OWT3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B305F14537A80CF9E9678239C6978536FBB2B8112A35CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 059cea67e37f138aa8f0c7844a2eafa93e70f9ddb3513cf30aabc0e313ffc3d7
MD5 0f90cc9c2f4452204400dff8541660e8
SHA1 ee3dce3f6d23d99d0054e2d8c4773dd6eb19d558
SHA512 5bb7a3767c53eea623f017ddeb06b6c72655c92a83bae6a6410f898cc80691c22b282569c09c003f51e0be0458d7a6d3848ab30950fd3a169d262ba0df5a3375
SSDEEP 12288:aeZ1IyFZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:3Zug3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T11FE4125137E824BAE2A38238D5F5554AEB72B861533643CF213586577F3AED12C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 819fd0f217a2764f3ff02338267cee7727e028281b302f6d42cdfcc40154fc00
MD5 bc63d6b0a352a3bccc668b1ba3a8498d
SHA1 3ff1e624d6c169f7ce188376544c6d477b42a0e3
SHA512 bde656aa858ead3287c1ce526dc20062d55641de7306dc125d0de499c9497e4ac0b8fcf6859f93a454f74c7750bcc84392a3628ce998a34b839b71f675e4a22f
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:CQRQyi36YOcPbLvw2gAf+PN3V0Okc5g
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0590f83c7dc4df080e894486ba52697297e9481d2392fb01bbd28bcad2dcf03f
MD5 81c9436f5f9ee313b4bdf3982b758afe
SHA1 9e385fb13c88bb5586ac76c81407f8187b9ab0f7
SHA512 4458e62e3d1156fbda1735d9ea3306289b7af229bec0fb9931d05c543b1c60cec2976695ff06696c0b62310e07e33b905c17a30a3854e0c7e38732912ede1146
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:aQRQyi36YOcPbLvw2gAf+PN3V0Okc5g
TLSH
T1A6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 48fbb47922e99ba3dbd70e1bb8cd6f2f04080805befbbbb6da335bd4290d18d2
MD5 d86191b4e0272a6ea29f7d7dfd9a0d89
SHA1 cf26cabbb19840491c41206c01a83385cab299fd
SHA512 3d94038cfb95b19736fe5f73c13f80d83e5ba85e1d4a2a063f327eefc68865442f31d7fadcac1933b9c112439814a80e85dfe00eaa13f7fd28cf09bcf6958b27
SSDEEP 49152:568Qg55nhceWu7PNU3/PKnAX1tIc5foj3:HthLRc/P0Okc5g
TLSH
T178B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1af5ab2492da6243c4926269d6bc723752ec18c15b06dbecb8a1811da3a603d9
MD5 4ed76fa5be6eab3858e69d91dd805c17
SHA1 5aba97f559ecdc03d5df202c36f8c9217405f2a9
SHA512 da623810d40bf8c815e99bb06d53d58b887c40388b7928a3e81eb96eba71be2244d2fe1784b5066040c02433668c40147510e7264d62ba9777df180b09328d66
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99a:Uy5112gYy5azzVvt69nLKnhZq0Okc5g
TLSH
T1EF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4fd8d50639aa7e3d5b6d3892124a98926ba795fd6caee93bd35a207309320bf4
MD5 c7bb5427d6c2bbc3e0b6d3c317945ca0
SHA1 779132d589683113d65079d1e691318964648fcc
SHA512 8a7f079868c7e96017e0c2b229fa497ca7a86ea8bc88053c5e9ffbe203a5cebc30b882cd3b7af92baf9116f5eb370940f1af03e2057adf82b5582c7934195102
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gldKnAX1tIc5foj3:Su6Jmdxd2dd0Okc5g
TLSH
T145D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3e7df8943ff4b7b64c4a5f886e99923ddc6261f5b2e1d47f61c67ae57038591f
MD5 eb60b9e5ca527f47b00ec92dee7c3229
SHA1 326028e5bf34f785c9bd631c17473f9b0e26ef7c
SHA512 70478e03d50ade3846223ca58ddd2e1137849860af13700037ef96afa59622612b942c327b482e015f7876fbdba5501e2d6397847b6b088175b9c4597f21e9a6
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xRKnAX1tIc5foj3:6mifPWRg0Okc5g
TLSH
T1C6B5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6b6270832b7221c98f44eac19785336efde24e7876e8ffe05c2f08bad95e198
MD5 23532426014dbbbd2d27442b82064b11
SHA1 b179ac07b138d5d605d1f045140be30b8e9289fd
SHA512 6b2e39c829249ee9f18a0d8c4018c5fa3cb81666fbdef7667013a5356ddf96ebbef370fe1183ee3b4637015cb01577d1fb92bf9dc6bd0887e16e9dccc79afe22
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqWKnAX1tIc5foj3:y5dKii61W0Okc5g
TLSH
T19CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ee3fbca10a0296e53b86fb47b43e8d063ce90d0e247e4c33be212ad0bed75e67
MD5 42f83b74353c95c8dbe661252908d33e
SHA1 6b2863701397aaf4287bd4c61186f553fa2b9baf
SHA512 408ab8db892d76cb82c8b0d63c761e41e345ea9ffc6f3b3c66d48bdcca0bb910c4126e6895e0978d9dfd5df08f00034a589b037707e50bd64a8748e522adbd1a
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wNKnAX1tIc5foj3:0X2imph00Okc5g
TLSH
T1FD95BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 525339f1dfcfb5bf921a26723a13a976e0a2a3f59a48758e42c11e4b62a6ab57
MD5 0836f45a0fd57ecb0267c195f04d0d92
SHA1 cdd21c74859b0bcc069a8321ce5b6c1640299ac8
SHA512 799535103f3886dcb6f7189b269639c6c02bcb9d6997223cea53e3c8ad14b0ea4ea7ec220001a9d2724b9360eba3926cc1be991044f5e68f20c17cddbb08bbee
SSDEEP 12288:zqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zc3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A0C423217BAC082FE6538671D2F6548AFD75DD74453A4427313AA813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ed6c3065ec56f377ccc1919c7d6225e6cdc33d16ad338e9824f317dadc1ccc88
MD5 61c8d73bc84f82bf3ada77b2a5c708b9
SHA1 6d10cf74d45eb3690a2479979a782fa4816d28f1
SHA512 9babf9feb7fd9b5b70e67e7a4fb62f866139da3caf0eb65cdef088247b3839203643aef4fab3417b5745ca6c4f6f585b3d8078161f28eac48c62eb4deb1f5ebd
SSDEEP 12288:JpZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:JL3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T151C423217BAC082EE6538671D2F6548AFD74DD75453A4467313AE803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4515e223e3ce6b26d70b7b936c001587dbf1fa30f38351583802c8bc5104f7d2
MD5 8602ae5f629daf13d1c871888dce5ec9
SHA1 3ea5d1d121b50c3e3f3ed4693bae60be3da89a3c
SHA512 c31eb5e532a4fab41879d420d470bbfad520b7f97d5a14ea5e480569f81b989c87792ad5004bae1ab61f072884fd5a977612cd4a92f0701fb1a3351b5da47203
SSDEEP 12288:5nZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:5Z3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T120C423217BAC082FE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1acce2466f124f561cf6a5bbd37dbf8e9cf2e9210298938ba4319706576cc9a5
MD5 a9026ba99e68fc0a923a807ddee3a1a8
SHA1 c0a44d74078e91f81f0b6eb6ff78d2f1d40732a8
SHA512 43849d8c88d4b96a4d4b2bdba272e4ab5c3ac11e28254d33d42de715b8ddf69a31736e88544789a7545a2952b173f17facc79d396c30395ecc19add945c972c9
SSDEEP 12288:mVQZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:X3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1DDD422213BAC04AEE563C275C2F6544AFEB5FC708636446B252598077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b65ab9206f0130b3b447a9026ddbdd0e0f4b703a71d7a3635b62792672dba907
MD5 bd0300d3960b0fd85fa86ffa844ee94c
SHA1 e1ce7e7e54a76d998df1ef1766b44b5db72db7f3
SHA512 f2dae4c74bf1668350f5d7c9db7b2ea61baf29f852af13f506f515219c9798d4249d885b739fe754d4e9ae0dc54c9eea7195f5b7322500c0d371c4ae228210b7
SSDEEP 12288:QYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Qq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FDC423217BAC082EE6538671D2F6548AFD74DD75453A4427313EA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fcb135d8ade0e41ee7fe93368be4aecaca29c748e43c4a027e7a4783edcdf890
MD5 1afce22e526430f02444953e340afe38
SHA1 55f07f8dcea641233c00808214bf78f40c575e66
SHA512 4b1a065d411438352bbe33d7a5020c7c35bcda70b0830d52a372bea922be54d22d5e9dce8b2f51249f703c69502fd9d554270f5491f513632d74a04cfed83b40
SSDEEP 12288:rNZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:rX3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T183C423217BAC082FE6538671D2F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b7f4717fa0b6a790140c903b9a74d8864b7b9da26c7a38d79bdd70a3c8dc4c04
MD5 7e2e73de0bf0d5f3897000433e357b36
SHA1 c478554dccaba84b742353986ceed9249ca1de78
SHA512 9cd2bfd94e00d4c018a8daea484f40f6f1904428f93a26d28558b56bef57320ada2e909cf5db414c3012774efa3a53366bad6dced15b69d7510a39a1fdcf269c
SSDEEP 12288:VRZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:VD3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FDC423217BAC082EE6538671D3F6548AFD74ED75453A4427313AD803B73DEA0283E6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 9a6718e96bda76b340d88ecb5eb0c3e17933b6650e27a738c8d0568e42710bc4
MD5 350a27a3a3b1fbbcdba6b3fdd3bd4699
SHA1 3ac8569e102d0ffad761e93afce84acae72ccab9
SHA512 084119f180749316b0cce08422de5f765152911f633f17c0d87ee0c3a6d718cb84a338d2d5bba89609c4df11a6f8aec46af22e18200e24809b2943af76376c51
SSDEEP 24576:zZMRzFVSOr3KnAoIBlEq1tIgAWz5foj3Z:zZMRzf3KnAX1tIc5foj3
TLSH
T10B05F161739418F9ED63813EC9658906EAB2BC650770C51F13B436276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e9bb8705a40da3054c8552aaa6f0f14c576006da597d3634b3d74702441bede9
MD5 ee120e08408d648bf8d7abc115ac0a18
SHA1 7f939d598470cb953dab43aa20d376964ed3716c
SHA512 bbff321252b5ebb8239a8c567a2caf9b24bd15da7f112b02c918d855c9a38320c646693a431b5a1c6d52ae588bf30455178d020c5182a8933890cc3b27d580e1
SSDEEP 12288:XGZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Xw3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D4C423217BAC082EE6538671D2F6548AFD74ED75453A4467313E9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b97f875b11f3c10867887281d2bdc8efc6a8716a6962816c7b3493f3fa59352c
MD5 0d48b491329fbec04875d40b9dcf6de2
SHA1 3598e0e8360753be288a83dea98cdf9828f34cf1
SHA512 99a17529c34b8d1e0046e35340dbe264140ef0c92671c1cec871fd3cf0d6bef19a8c7eed77e96c07132a7fb84e06924e5b944b5fe461ce5cce1f7e4de9380e85
SSDEEP 12288:wiZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:wk3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T185C423213BAC082EE6538671D3F6548AFD74ED75453A4467313AD903B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f2234dc055c805786cdceafa0ddb5688b97637cfaa6d5633b0248595bdb50ae6
MD5 f04ef71d15356e070e0e2477a7cdc87d
SHA1 5f427d77d3bebd8e2b3674635ccb316fd9c78447
SHA512 075403109224e7f675f11954698b594447fa37a66af8a712db8fea71d3f68ac3964ffb78f62a2f64eea050ad3589f3c6af11e49d7941864a0771b832f6025243
SSDEEP 12288:8yPz5L8FZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:lzy/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B2F4011377A820FDD1678235C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c1639291c480d376077dc8955d444eb672a54ad49bba4fd23e3105d3f3c245cc
MD5 d4285b77f34d8531ecc6ffdda4a0e06c
SHA1 5f8004769d4f10e913af1ef5b18f4b6515c9dd2e
SHA512 f36f3cee197dd32c5f6108fdecff134442e3421fb0e11db3f4d24e1dae830029b89c0318f02c6da140406168382d74664051f3a24b70c18d29f31cd4f6ec2711
SSDEEP 12288:6GZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:6w3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T181C423217BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5a6feb3b374903842988f57d17882441f5cb0015557dd64ee6819dcaddfcee43
MD5 14c93411082d7fb453f23a8e00fcd659
SHA1 f2429b87090612a2c156d538c347fa4e0c1dd2f8
SHA512 f54e8be616cb9df09714948286576b9b5c3459813efd76625ec0b5880c2f71307eca84458ed9af5d691f57ca61d9a430b71ee226c22b26c0705c118ea9707dae
SSDEEP 12288:kGZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:kw3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C3C423217BAC082EE6538671D2F6548AFD74ED75453A4467313E9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 50d6b159dd87a228002bf40418a69871ca94fffa0510d7bca614c3832d113200
MD5 693ad93d54bb39422aba97eb2e7d2d7b
SHA1 289f76274ae1f5f409c357bbe77278f7ecbf1511
SHA512 c2e8c4fb87d18e9ecae71c6769b16fd796068c2eeb7517e860ed43cd3911e9d4f2485adfa13694658b523950ac2c0b724a6172cc5dd3dbeda2edf6f8f0459543
SSDEEP 12288:0yPz5L8FZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:tzy/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B9F4011377A820FDD1678235C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ce09acfb06db6f239e41d4936295dd161899d4285fa4e132e085bb1336b39e4b
MD5 25edb9400907e5f67c1630bbbc22354a
SHA1 d3f754f67b6340015c28ead374ff2c6c5e871780
SHA512 14e27bad9e9acf20e69a37fd2e8a955427af84a58cbcde2ce94d980e67819c10cc729b81a225d046e44eefb4ea45bdb4fa01bcd16c322da340a81a0a5edc44db
SSDEEP 24576:VTDaLl3z0zDJ3KnAoIBlEq1tIgAWz5foj3Z:VTuLljsKnAX1tIc5foj3
TLSH
T1D105F160739418F9ED67813EC9658906D6B2BC650770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7309562e5454ce2bdd3f7916baf950244267a0461980bbb0fbc56dda0ad929b5
MD5 80afaa13fe382b66556a81700d50abea
SHA1 21baec031ada9a1f34449ccc717bdce90f5bb96f
SHA512 ff907cd6cbb9e513cdd4cafd746600e5dd488fba9172393814d35f3b63f2e90a0aa9d7c34077912b7ff46efa91b40a8fed22d4e84e9ffcb6b465714e1ef369ea
SSDEEP 24576:73vd9CHKy7GZF3KnAoIBlEq1tIgAWz5foj3Z:bvd9CHKya3KnAX1tIc5foj3
TLSH
T11625CF90F3E814E8F1B78A35C9765511DAB67C691B31CA8F03A8651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 17966703427bfa8a44456894241bd3ac77719967fed5ce6129e34be777f36616
MD5 386d3734a25003f2fc19d18239bde65c
SHA1 e1ccbe85cb75330e69182a82bd0f7013857b125f
SHA512 398971382f4e2789cd359851411bff1734560be08d4fb078d9bef05b71c79354846c9cf597af80f5a324b24c2d1a64460fb85c771ee55bef4d4d9729721e4377
SSDEEP 12288:sHZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:s53KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F7C423217BAC082EE6538671D2F6548AFD74DD75453A4467313EA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4d082f3426928e0197c03641ef4ce2cdac306ee09ca14e412e34b1a20214632a
MD5 4a40d53bbfa812380c9096891e18ea43
SHA1 7b539a0a8fc9f98dc54b56e36b9dcc0305023a8e
SHA512 ff5414b9ef04c8e24daa41ba614441e3d0a907223269fa82b780fbe2532d44bcbfd0d2755aa3f08cd07a4f20a074a6c8208eb3f0a02271622c4c42abcfdecd80
SSDEEP 12288:8lZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:8f3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16EC423213BAC082FE6578671D2F6558AFD74ED74453A4427313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c83f78496e5166eb4c9e0b9b81d7ccb91de95d525f439a1c164921e892d78e41
MD5 bf135b0c24f12a382545d60dbc69b3a0
SHA1 38c15951014cc7853db38513dc9fd8be6c0a5101
SHA512 74e94242d5a0fc73ae1f72afb56b19a03cb87aad7b92da0a06f2948f7b6b74acd263ca91961ab2943868421a95f8eb1e5a5f5f52242001005c6344163e0b496a
SSDEEP 12288:gsZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gm3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10BC423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 15db1ab905eb34aacc20ba4fe7838d6f752ac5da317a2d53ad35f908255c1260
MD5 36c7a088533695d79053a75bcfa9e62f
SHA1 a8467d139de72c742604184312d41e5ba635ca39
SHA512 ba4eeae96631dd0c10604b3afc886030eeaf69e477d58aaf375b43bc1d5ff4fd45db402fc11ae205472e28865d0c175a02979071a70f977e1ac85ba0c5e77108
SSDEEP 12288:RGZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Rw3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B9C423217BAC082EE6538671D2F6548AFD74ED75453A4467313E9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6f5445da60939851f098b5a5efd1e3bf230f92950f3ab9be10228151331fc1c8
MD5 d26bf1c5127ee99170cd26bb6def6ab9
SHA1 73483b9a8b77773fb7e85a8a5726dcdb149503a7
SHA512 dbb1eaad90e1bc49acfdc1a88c7814e86f710411f218df5fa72460b7dc6930e4f818f9a4fde579416eae52a379f8e8dc93593cc5f3fa013f4bab293014f13b6a
SSDEEP 12288:mHZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:m53KnAoIBlEq1tIgAWz5foj3Z
TLSH
T144C423217BAC082EE6538671D2F6558AFD74DD75453A4427313EA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f604a42265d2f29efff81c2bad5704856ae0769a88bc129559498f11517cb3b1
MD5 41a9983ee8d8a371af076580a259bc2e
SHA1 50d9a9c4ac7737b54a2dfe2314092300193fcf88
SHA512 10bc62861ae9bca8b1b2a5b6194267828a81db56c63ec3427896f2c51fef7c1134df2f817d5a88bcee69f3230260e175c4b676995c74ca2f92f328e5ce71d2bc
SSDEEP 12288:uOZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:uI3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T121C423217BAC082EE6538671D3F6548AFD74ED74453A4427353A9903B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 74968e952bb4e208dc629e56e4b2c3b311a9200ae64169a02188e05dcfd5509d
MD5 f9e6d88d03417a389f1812e7fcb3f5fd
SHA1 67615954bef102d6c2a12c764a6bfb8c7c1f131b
SHA512 efaf22e6e955fdac026ed1d9e1a46260f585388d731f0cc282e2f45d0274aada47a2bea3f3f5df902632f294a4675eb6334bcb10ef52da2efbf6331015fe58ea
SSDEEP 12288:JYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Jq3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A2C423217BAC082EE6538671D2F6548AFD75DD75453A4427313EA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e6796fe367945cdf5347a5fae365db723ebc822840219aaa366adc65c68517d8
MD5 50792a2be8774a7ffe59eaca1505bead
SHA1 22a07344f1d5b0f9c88b71585993c91d1cadd711
SHA512 bf4f120011b395f7c3eda035b2d5c6de9e92ed367404970b3379f0e9ea32263bada78bbf86dc76ece19c3430b46bef7cb262ce9fa76b75985df7a1ac6a71984f
SSDEEP 24576:ofwvUk9RX6wkyAI03KnAoIBlEq1tIgAWz5foj3Z:8MnYIKKnAX1tIc5foj3
TLSH
T16B35D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dd6c0d598ad82462936fda250cfaa5ad1cbcf47dd819269c0bc8133d3c5351e3
MD5 d9cbb57911f40b446fd3e5f156791053
SHA1 0318b21c951318cca7bfebb6cf548d588d096bdc
SHA512 88fb2f07f975a6f734ff364c72e2dd7973329c00a7a5fd6611bfc01229cb9786885c691dc37948148de26657fd560568cb20cbf1b01a063800877d8eb0225253
SSDEEP 49152:nYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tKnAX1tIc5fob:CySzP10Okc5g
TLSH
T182066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dce3c637def84916309d52f88da02da681b3fa376ec3a2abc0148d6fd0782507
MD5 44e0c6fa1a71aee708b498e6258cf16e
SHA1 51dd9e292a0dd6b7540aa4a83b9c710207d45113
SHA512 129437a526195b61d43e0abd839baa46c3cb962a9830c6f0189e2bf330a6c70772eb7fb427b2bd300fbaf179d7f827397e0d5ccb10c4a1a9068b5b6e09b8804a
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY73KnAoIBlEq1tIgAWz5foj3Z:n47JUQjTirIhCnDHUPfF/dKnAX1tIc5g
TLSH
T10D65AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6f1f5e4f91e8850dfc7608a1592a9a02ea26ad4420c6ec3bfdb5237c6842ad83
MD5 91eb0787f827475ee2aada866c3eab13
SHA1 fcf01263a897b904dcb7d282dfbd642231533b5a
SHA512 0cbe16fe39843e568fb7caf57f678f6304b57a24cd4b2fde6bd6c3e41290d7fd1661642d9d81564ca4f65226ab4e138c4651b7918bc3903fd4854a3cd50bb464
SSDEEP 12288:9bsfWZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Yg3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D9E4F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 fec87705bab663eb655fe7240c8787d3061a9bd7cd0c7352149b32f1054a5669
MD5 adca0f66369dcb5cfad43d8b48b7ebab
SHA1 b97b15cd398a6bba8af87fb7a415e9b5939a0a3a
SHA512 f01fb6db0fe8cf9d64af25ff278b7b76c391b4fea9daa7c967e0eb9bcf35f45ce7021068be001841669cc91f1d59da36ee791e2cea344653fb4c89912fb997d5
SSDEEP 12288:GKOi+cU3fGT/WCLE/yU1eFGhg5m5paaCJbx+Jl1:GKPjUPUnU1eFGhgypaaCBAJ
TLSH
T12A352800766BD75FC6AD40325E32C2CCA7707D41EE05AB0772C8872FD57666DBAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ca89034f18530602b8d27ecda3d9ff4f08738b7440a6dfeb7ed1c539814690d8
MD5 1fc79a1e7f10b8949f41c0023bc5cc94
SHA1 c66cb88b99ec3b0992b97d322f8be1959c890532
SHA512 ca1497442c33b2f89756075977e6f4941727d1a1b7466dde0924a3f63f3aebc816b2892e8ad2c1fb0bc5675050fa8611d66e31453c4e993e815d5aeab29cdb42
SSDEEP 6144:8R9DDFla/i90HTOPntcnrP8QcHnyMWr7AI88mQ+TgIXsOvmUGLyF0q/Z/8uPqs4f:8RPlEUCDs079mQ+TTpaQ5FiyBYWy3
TLSH
T1DE65D8816537A3CFD1FB2032072A5B4CA764EC06B7056F26B3C8457AD82A725B1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 82a437dc6c63a763e43e1d1ea5dbd9902dde5188ba2737ecf5868d271f3fcab9
MD5 8f1bb8aa750401844c3e770306631f08
SHA1 5a8c4ea5ba75be2a0a6b84e72f82a26c7a502a4f
SHA512 123cbfa8be5640d3a171fdba818124c3177f1e5f88c86a25a8dbc4b4623b80fab0ccc5006d8c36a566054eee965ef7cc69b19b8acf08747d757a82284642013b
SSDEEP 12288:l07eZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:u43KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1EBD42221779C1C2EF567467092FA9419FD39F9704B3584E33029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5d4954e7a0e70182ea81410b7f995e72d5a2edc132c704a1d6b247c481f1067e
MD5 c21936844919cccfaf5201e809d9a766
SHA1 1223f728dad5f3e268fc3c480a6348cd8f457570
SHA512 750273acf7c75bf70aae617770bc8a15f9ed01d06f96b131e6d080d50b38533393ffab1e03c985bd379a39d4a7b4260bfcdfe677bf24b5331ed8624a8c28c916
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYu3KnAoIBlEq1tIgAWz5foj3Z:Bgb4mBIBhGF7KnAX1tIc5foj3
TLSH
T13F659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7beb6b8ba7a5970d78a91c828f6c271f17f3359079eed28e7d341ea3c830e339
MD5 c8308713c3917d5bd87b99b209ababa7
SHA1 eafcfcfbe3c122f996d5db864c5b00a6e2de314a
SHA512 a8e00fbcae749c972f3a91c32ee7c0b5b5b1e38124aeaa45215db60a386a9a42efe2ad9d2bbf12513358ac2b89aad4fc380423eebf696b79211167deb2243478
SSDEEP 24576:EG88u8FpJqH1bzria7/mr3KnAoIBlEq1tIgAWz5foj3Z:37ZFPqVea7/EKnAX1tIc5foj3
TLSH
T1B435F16177E401F5D477D1388A964667FAB1B4250374EBDF06AC8A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e643493ebed5f7819cce201355f4768da2839cb46dbd51448ee24396b08fd3d8
MD5 d791652a483d1050e9fe1ffba85ec111
SHA1 a41862df34f5e0b49bb23091ddf0a9e2c939f22c
SHA512 5117ba8e2065d72f0d910c11d406a281b05afa4da8bd795159d614feacaeeaa37d6fc7c44b708c68f7c7d0c17d5b8f171574de2670a04b2e33159dd1b2e28cab
SSDEEP 12288:zHvUrBFrEjwaQ9Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zPUr+NQn3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F305E12B36AC1CE9E676E17D85924609F771B462031291DF02A1817F5F67EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91b7b54ec969466346512ff6c307ae776f70c1b0b94f8321b81693af0d046449
MD5 88d237313fd8fa6b4495faa32444bdf2
SHA1 bdce64c647ac72bfeb2f4c51187ed29c746dcdd6
SHA512 9b01a19df5706f7eba28c28c37f0113031995ffea02cc4f75b714806230c5c6f7fed8cad3a70d001f4c57624b1b95a047a7e65d421016e092831239d3255126e
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHKnAX1tIc5foj3:hG05lO43bC0Okc5g
TLSH
T163D5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dae75ddcad6718f2fbc351ff639a3d66e22aff23af2cac036269b5b9f856867c
MD5 dd38c1404ab3eaa2718f73c8f92444d1
SHA1 9a176875f2c9eb92f7249d5c37be945632930a5c
SHA512 1585afa55f0533b6eae8ab307dfa4212508e897e090a849bcbe841a50f882325414b369f0acce4f6c0d314d2a33d0a9f9de1c7a4b743d3a619ab02f89f1cf194
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn93KnAoIBlEq1tIgAWz5foj3Z:Ka5POZ3BJt2pasx2+mPKnAX1tIc5foj3
TLSH
T1B165BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5e85ac6b0e2caa81307679c46ab8ddc865aceee00b33e57e1bc312a9d3cc5905
MD5 bab2a25be26c08b445250b688dbd7ef7
SHA1 ed13ba044921c282bf1581e84a5a09dd6351eb21
SHA512 9c50c27780a4fffc9b9af5f229d0a00492a6e678a7651a37d451af82a46e78fd340cce087b93fd42a4ed5cf0f678c744c76ec56a779a69e3ab22406e270293f2
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fkz3KnAoIBlEq1tIgAWz5foj3Z:UNc/zEOVHFkKnAX1tIc5foj3
TLSH
T11E858C2623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5e8147d0ea78539b6d6681d6965e8543f5caaf14e6680121e0031aec01c00ee1
MD5 cf3931f547913a95d20ce0f07cbaac1c
SHA1 bcf28c778112be0c366500560d8eb67002129698
SHA512 60160af8dce42f5153d0447c2d39d97964ea3029825a839dd1f43ac073a3e3ce5e85ab5073032301159c5db1061b15342cd19d85bd52242fb6bb549d13d981fc
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmh3KnAoIBlEq1tIgAWz5foj3Z:FTMwBtOmhKnAX1tIc5foj3
TLSH
T11F55AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 562edd89db6b55b25c3434390cc26d8d876f05d6b5e4e7328b85224e9a7d5b0a
MD5 5962d2a5ff6a7ff7fc74b29e94c1a2d9
SHA1 20c991acb320c686a62bc5e960ff6018c68bda4d
SHA512 61fd9f952efb9ec0ba7d06d7abf3f6f21deb2d965d34a2b94f13c5c6691ad286f1874cece43acedb824af4f8c1e0613916e8bfaa5f7d0f876cc8f2b0803633ff
SSDEEP 24576:UD3FHshBIYQgA83KnAoIBlEq1tIgAWz5foj3Z:UDVHeBIAAyKnAX1tIc5foj3
TLSH
T15625E13DEB9C04E4E57BC1BCD6A38906E67178A8033255DB1194C1B66F6BEE43D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/120-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/120-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/120-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/120-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/840-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/840-82-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/840-320-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/840-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/840-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/840-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1188-134-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1188-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1188-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1188-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2736-271-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2736-55-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2736-61-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2736-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2956-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2956-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3308-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3308-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3308-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3308-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4140-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4140-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4140-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4140-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4240-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4240-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4240-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4240-40-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4240-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4240-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4496-6-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/4496-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4496-2-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/4496-7-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/4496-77-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4808-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4808-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4808-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4808-142-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5772-20-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Download

memory/5772-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-21-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Download

memory/5772-14-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Download

memory/5772-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6088-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-306-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6088-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6088-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download