58f42d101cf6351b12188b060ae60e1b2ea517f2e3700f72c2c4ed56d3722e42

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 1.8MB
Sample260903-vasrvack2t
SHA256 58f42d101cf6351b12188b060ae60e1b2ea517f2e3700f72c2c4ed56d3722e42
MD5 08642f3035888b919b221e588a3d5d08
SHA1 357c3c62da69da755875687bdc8255362914659a
SHA512 80d3a3b749098947f541ae3b696ec398811ffe1971efbc53d5c998c4b2c155c8258955323e61c6c6d62f29ce465fbc6b1ae61694b806b50274c098ab65db0b88
SSDEEP 24576:wsYmkmaMC1Cb8NG5sqjnhMgeiCl7G0nehbGZpbD:LYdmaMaC7Dmg27RnWGj
TLSH
T1E985E02273D0D076C2A231714BA6E37569AEBC319E3447877BD03B7DAE705D18A3871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6036	elevation_service.exe
3332	elevation_service.exe
2656	maintenanceservice.exe
5476	OSE.EXE
3908	PerceptionSimulationService.exe
5864	perfhost.exe
5576	ReFsDedupSvc.exe
1200	SensorDataService.exe
1072	ssh-agent.exe
3924	AgentService.exe
3144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a74534a0e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d830938c43bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8dbeff5c33bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e1c72f8c33bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a090af8c33bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ece1ff8c33bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad40c9f7c33bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3924	AgentService.exe
Token: 33	3144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3144	SearchIndexer.exe
Token: SeDebugPrivilege	3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	6036	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3980	2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3740	3144	SearchIndexer.exe	99
PID 3144 wrote to memory of 2652	3144	SearchIndexer.exe	100
PID 3144 wrote to memory of 4828	3144	SearchIndexer.exe	101
PID 3144 wrote to memory of 1028	3144	SearchIndexer.exe	102
PID 3144 wrote to memory of 3760	3144	SearchIndexer.exe	104
PID 3144 wrote to memory of 768	3144	SearchIndexer.exe	105
PID 3144 wrote to memory of 2164	3144	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_08642f3035888b919b221e588a3d5d08_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5864

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2840 2872 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2840 2872 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0c55240e3e0b7367e4ea21af5be1e54c9fa3756ef197a083ed010cd6dfdc70d6
MD5 b0cc58aba9b54f36d16e48750d8c2566
SHA1 bc5d5fcab2b1db126362aca803cc00ac9468fb71
SHA512 5642258c53734b3bb607f23a8aa514a9f1725d2937476f1c27de73b6c46aeba6856e008723ec0e9c52d5bbe371b22aed3c18d0aaec31acb01d0afaa1ffc3330d
SSDEEP 49152:Ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnlDmg27RnWGj:i3q6sjBWD527BWG
TLSH
T1F2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 54a404471427e440dc638d229543a7e2949dffb4f0fc27f0aaa680e224297c35
MD5 b1039d78eac28b66d30e667161455fd1
SHA1 00e5f614bf9cce829422554a49dddec0bb87b145
SHA512 4ac5fd704a5125e141e5f52c3dcecb23716177204f0d2e3d375a20c11c7dc42bc7732373b0fbe738ea2e75c7dd564ffb8b4a820f036a1a61c9120b27080ba769
SSDEEP 24576:sXYfDtczAesqjnhMgeiCl7G0nehbGZpbD:LtcfDmg27RnWGj
TLSH
T156850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a48e3e8ecf995b9c9b458e5503794fc91c38e41b9189a6cadc055ebc8b6f029e
MD5 1e0f2dfa2700cd8ff13818728c035e95
SHA1 60a8e79dda6d7b16d7d01c486a9d05e552a2404c
SHA512 faa7d0108f543c2318e1fa36881995eb838b7cf2118ab82a2068316cde731f1f30594bc70bb1da3eaecdbe7e97bff29374e4ee94e7488a850ab43ba70848de79
SSDEEP 24576:P0Le5ji0hmx7rMZsqjnhMgeiCl7G0nehbGZpbD:PPji0A54Dmg27RnWGj
TLSH
T1E3959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1790cad2662c504139550f2278e2913c35e17c33bc55ebc99cb1738e7ca9ca35
MD5 49fbf9304b8dbde6a1f72b910bb895fa
SHA1 327327f105dd745700eebf5a7ef5b85c09930031
SHA512 53488dd7e3c815196e1eb9da93a34674edf5c4007f38e49580c196f7b38982f76fcdb88796bda1ea3532c9f2be8a40cd818db8d9b79d82ccd4380396d0eaa005
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyubsqjnhMgeiCl7G0nehbGZpbD:c/ezSC6vUzPveHjyEDmg27RnWGj
TLSH
T1AD755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5617dc363f9d7d7bf992fdc9fddefe85dc3a59a3b4164e6d170b7d258a683ccf
MD5 0aa700046d63973a7c4575b7ba2c5fca
SHA1 b3a9256555d46a47f745c19d46548b42681693af
SHA512 7bbb6997a5922a79c4902fd1183e591383cc3e85fbda4ffc8359b7625aec4d433faa4cc3f2e067e578e816e15227e947a1b15c67c545e1bf129511ee59412737
SSDEEP 24576:OVbqPb88hv/l+YCsqjnhMgeiCl7G0nehbGZpbD:OVO88hXl+3Dmg27RnWGj
TLSH
T142559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 77fb7a2f2b42cff2db633255b63c00a60f5a97468e6303d342601b7a4ad3cd0b
MD5 0fa590364273f835178e328e2606ba2d
SHA1 a3097259ff80d421151e16dbfedec2c0dcd34036
SHA512 6897db1deaafdf58db6755a896d7d33458a791ca633e2d22dfa2f8ab79cb757e948f3ef601f00c5dd3371e1edd2bc8b5bfc42cae047f3359371b88de90ff0440
SSDEEP 12288:999Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:999sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA6523BF965C50CAEB7604B5C3E9F11EAC137E56982008436A637CFDEAB5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 726e72df73fd3d9bd62a883f1cd26eb13221a93d0fbc10957d9a0deced438ed1
MD5 d4f9f2929e17255478ae58680765bacf
SHA1 d29f613a7908e616a191ce44692c53e9faa73270
SHA512 98725742679a3aebd587c4fd07db06e2d187368581941eb18442498c77335b7c51b37a3905493a6da32e5469cc30d46eb44a32a6b7709ebeab0d01278ec0e8f1
SSDEEP 12288:5eBNUbTVO86UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:5JIUqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C285CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 46cb967da7b8e1b2dbd2958b474652ca2b5fc7b732e1cf0de587d3b7f6127398
MD5 88f4fcf98452de84f963d5c761422421
SHA1 88646c2fe251b9c4a5686bda4ab335817c1b0fa8
SHA512 19174e6c9c265555dda30fc1c5eb0394ee1e31e01210854a7a86f66fa61d808ce0dd4d8bb53c3a8bff773c064a23d0b5ca13b5681c29f7cc92b705e9ea8f9066
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:WQvGAdlCEL8c/DRNw5C/D527BWG
TLSH
T15B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 bb4a8f8226c3f6848b7b30eaef40858b93c101344b8fa70f698f03ce6cd570b7
MD5 8c95b0892bcaabd4591c8f7e3af878d5
SHA1 d8e183f0e11ee11ed597801047691b46712faeed
SHA512 cb04128df269628c55705511be7236894fb42a3dd31542ffc75359f4ea4a35a010c81d1c39a098a07987fdd62794f7ef96d7f9d06b676f17d37380de1e1e5bc4
SSDEEP 12288:jAwSfxL/2Dc3DDLLmt0LDQewsAj8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:cSewsAj8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A085E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8972e30313ceebd3b7df85772791ca078badb4e5876c54352742a56ea474000
MD5 256e771ffd3c60a98bc75a9a17d7b777
SHA1 5dbdc143f69b303b22f30bd2f850e7fcd0d15713
SHA512 e29c1d52a3d7d03939dcc68dcf83a0302a9e5faa9c74835a01220ff617fdebd76b4b609ff1c8d73177ea8ec0041388d6268f183b326707947f7008e9261b1ab3
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQVQBWG:2UEtQevvqc2W1cpV2tI32XB
TLSH
T14F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0a4a4189b9bda4a7a2014e5d6d978ad8ba5d32a009912ada7b415f9df12eaf8a
MD5 548bb105df31d92bb0c8cbf068d7f84d
SHA1 86adde3f9e0154646e260a6cd4f31ad331f0b1e5
SHA512 062799e0fef0538fb958039e33b020afa231517a0431aec33ac30632702305892b9927a0ce5d546fc67abe0a7cc0c4bfcc17ac9ff1db7904ee6cea43ac70451b
SSDEEP 49152:1CbRquA/m2yL5zTfFiV+XenmE3/zIDmg27RnWGj:ioquVjnm7D527BWG
TLSH
T169D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e0654b54af997bc3c4fb9eacfbcce00705fb51b451d45037bfe0a05b8364c985
MD5 6a0b6664dd9a5cbb22161179c7ab2b59
SHA1 fa89d072c22d34c739605e8641e37a2b973b7188
SHA512 3b8d19b6bec87a3a3c862e4665c808c83c39eb135ffd5161961d9b651ba2194187ed4244ec27a37e5adc8caa6b8ed96e65be8d7821cbb5e75690f0c31e193ede
SSDEEP 24576:dAhGL3IFoiwtA5l7S53HsqjnhMgeiCl7G0nehbGZpbD:dAMUFoiq5rDmg27RnWGj
TLSH
T10A359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d491104d460087d96d347a9bbc3aeac5a7b13da755384d21601a3b04baa6662d
MD5 4bc9a094c2c831c074f50167d779e045
SHA1 94957322ad30db7df5bf26655732679d9bf3ff11
SHA512 78c6781df2dc433bb351221a7675f31bb89178bff0f233664d1a454a6e18bb1b9929578a3adb63f4880f02789d80087864f000d77de07004a60e78c0a7bcda73
SSDEEP 12288:mmw5HEjsChNPBFgl0WDm+C7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wuWOW4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18885F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 628232859da492ef068615e234dcbef6153f7b48dfaabb829e770ab82e0f98dd
MD5 7bbf1f4c28092e970afb69821984ff97
SHA1 ec24cbf0f68d38344bcf49134f31f7a609702411
SHA512 04a805dbae20811b9d06f4b8e4e13ea29efd610471ea6f84db150d12eda4f154b92a92b8743b3e471fcb2681005e94b2d359c369f5a8eb7d28728bf5740f1687
SSDEEP 12288:d0Z1IysXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SZuBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1997512AA239820FAE163417CC5E5D609E7337C66673003CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7725491ec8e69769d6aca1b8cb2365aa48a582a1c50494145891503264c69587
MD5 a9573e1008be71dd67287546aa6ebfe4
SHA1 880ae2f89d34aa0ba90e2dab71536c2b8cd71afc
SHA512 ea274c552df0154b9624b0c9a93cf70eafddcf1b01faff4d789df41e7ff72cb3ab7db48a4029029205414645fbd8d84da1f46ec4100a9f08bb55a337e2b0521c
SSDEEP 98304:bQRQyi36YOcPbLvw2gAf+PN3qD527BWG:qQyiKa/X+PN6VQBWG
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 82964d76a5f3ecc897ed1265d96991cf64be1eafca245f98ee07c40e3063e4e1
MD5 cfefb476370af089b75dbeacafb7cdda
SHA1 ee013800c0e24f6080ccf6657053a43315f37241
SHA512 e2b9d7e9602f782c961923d6475f0b8b28df419145a08d1cc6825c6a3452eb995a68a8ddbaee7c6dfd5238339c9f73eaf3c16760131641c01b42da03b368bd9b
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3qD527BWG:pQyiKa/X+PN6VQBWG
TLSH
T12B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d86eb1da3a93d37209014ed0f182af6d78746ab72c56e8be3213674ba02d683
MD5 ff86124ada76a69b135d3240eef5c2b8
SHA1 717be1665a3c42dd2ca98e50d26938a61ce2396f
SHA512 bc1abc0ad18a6c10fc4bce784bcb18a2dfa310556964bdcf57ba916359b5e5353bb094c55d638db4c4dc1b0d72dfc66b96a1089e5b9c28bed4ed0ba2afe6e010
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0RsqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/4Dmg27RnWGj
TLSH
T15FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea2730969369f7833d8c2c7ed1dcb784bbf3ad00716e525b3f3ee69faf81ec97
MD5 1d04a025ff0617af5770404c1e0dd68d
SHA1 7189cd1e9ba934c24aa4ed969b61b958ca64d2b1
SHA512 1851e612f28ef6d476cb5cee9b77ff0b7691cacbe685d96308fd4ad4833a0b7e90ce618a1c726c72874713d7a563b11dbfaa9246f98879173526eef632968390
SSDEEP 98304:ry5112gYy5azzVvt69nLKnhZhD527BWG:GLIHEWhDVQBWG
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfae1736e0ab00a38436d9d142ca1706a18e1de5e2c58e6a35bb13915081c69e
MD5 ff415f8dc8fbf563f0b1f4c07c72f232
SHA1 85e6d0fc131269c4b1d08c319ccd2fcf3cb58d09
SHA512 6e6cc9ff63c18ac766268199e49d15e006d560bf14528791e8da37fd317938f9564382dd829e689d49561d6f26442e39eddd5a09e40a2c213d33532ae5647beb
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glCDmg27RnWGj:zu6Jmdxd2dCD527BWG
TLSH
T16FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 abfee5f1295b9b07e45ae155c2e2caf7190aa2dc9f65395ce8bc120795ce1aa2
MD5 714fd3ca0033d4917de5063c42fab8c3
SHA1 f3f83604359261355585d023b455e055e2ff5ac9
SHA512 be5bdc806bbdf53950dd8312bc50a6a42914d723ae121cb3dbc9cceb5a5432592c9943cb35c5bc3e0d2bb71683330ba8de64345da2bb9086c3af37a5f852f138
SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xeDmg27RnWGj:0mifPWR7D527BWG
TLSH
T13FB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7bb548349d00f3e06f93158fcde190464319614a592fdabe53c23e6fde3f9d43
MD5 a4d6df9bc2dec3c1bab7a964a9ad2cbb
SHA1 8fc3fb93e9c83e020e657fb8ac831ebb7fa9bb33
SHA512 47a9bc8487d86fa095733d27348e9808927ea0585d2f1325452ec45138aa1267e8a20b7157e3e5b8b487629a0f46c17e917f9a5e645eecdb189278e8fbb6b6a8
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHqVDmg27RnWGj:A5dKii61VD527BWG
TLSH
T1D1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9da6cbe0523cfdfdb8b9e4c8c5d5d374e66166f88b88810df3aa44bb7ac21d00
MD5 ef9711f0a7f191fcf6177c9216ab961a
SHA1 af0a133752e3c40acabd2a58e666753dc7070d8c
SHA512 bc73a2f7e1d3aaa2f87386cfa7b3356d5555857fc4436adc8935477e2ff9f79feca2bfa88d3a6d68486b2579a6e525bc83368760d046e55b960d9c0d34aa38af
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5wyDmg27RnWGj:ZX2imphnD527BWG
TLSH
T11A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2a5f809ef3a3320ad9caeefda05ca6884290d7a798cfb8ee4dfcf8ee707ad1df
MD5 70e0450ab534dbdfa07dd3444c74ca75
SHA1 bbce0ee08b7b3caa2721fc70035ac05d378fa946
SHA512 37955ec3ee43861f955c440dfe1ce2cd4b9508440102705f67ef5b2a435445b4f174a1eb2f336f804e8f87d32c2ffd715744962b365ba84812ef6dbd5afd9bea
SSDEEP 12288:LFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1806523BF955C41CAE92644B5C3E5F10DAC173E5BE92004837A5B7CBEFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 7ec5d68751defd1ad131f7d3e25a94ccc4b103142a010b16e0b7abce10915bf8
MD5 7d655d48a592c710c97c45981c2b23cf
SHA1 d1a0f7e7c9405dd75e1ab51e89e429d9c7140b54
SHA512 d048148d6dfb67db9534375743800d4bfd99326d17fbde632aa79e6de325cdf036aa172ac6fe84133490e546763a9445b1dd719b5227947e33652d9dd377557e
SSDEEP 12288:FwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C56523BF955C41CAE52644B5C3E5F10DAC173E5BE92004837AAB7CBAF7B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bd8399c35ebad86d40a2304bd3cfb7f59876be92c52ebd3dd6213ba8ddcdac57
MD5 31816cb80a0eb40d62d60c588ce11d5a
SHA1 900ba104522f91d971521b2101f42e037b55e7a5
SHA512 7a247ee0a64551613711e093a73a0be93f7be1a4ea8b991aa2b5c92d56a4d67157d0a9ad24607807ff4b7add953c1092b41ba96e0aea2f14f61cadeb2d9a0b09
SSDEEP 12288:uSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1986523BF955C41CAE52644B5C3E5F10DAC173E5BE9200483BA9B7CBDFBB28584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1b70213a1342d9a8a324e3702f44019dc6ce7f20e9974ff6c4f9c6f25a29ad7d
MD5 1382f118563ca21564de1ce59fbaaf3c
SHA1 fc8f4fa7ba83244951cc97588a3b78e63ff89e64
SHA512 b6202178c176d2951c239caf5f7b2a373dbe72c3784425d5ef8a744f42c25aeb06c2158c1755f87ee65c080ef06e233a8e157b118bfdc90237a72127ca24af6f
SSDEEP 12288:QVnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F65237B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 29a5b1789ce536363e4e11563a8d8f15bf8ab9b9b842ed3158223532af16fcba
MD5 c4fde798269b5f64b5efcb02b0fc2d79
SHA1 84aebe3b157e8c63f927be0e1c4a59ee787784fb
SHA512 3cf52a0cc59273be2d4578c381668f28c304fa468204a36c078923c911cccd798f701e92ec69d51c3fd65c90b714c4210c2c26ce8f8169526b587d9a05690495
SSDEEP 12288:O/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1766523BF955C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB28584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9ee5e00c3c640d35d31f1001230094175733d83d3dad077d9e76d256b12a0449
MD5 c42426354916df2fe2355fe0b9ec8f6c
SHA1 8871d817e96ef4b4f3c8ff3e292e2df200c9c7c1
SHA512 dd51c65bb32efd1f4e3e3072b3d3eab3025a41666d3d6deb105a7ff57e0f62d3c5dfef05e78f9838174578f6d8f5796b21b3cc4a2820568006c154c8b3e62a5a
SSDEEP 12288:wkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC6523BF955C41CAE52644B5C3E5F14DAC073E5BE92004837A5B7CBAF7B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 372caefc3e8aff7b2b5ef27fb3ed5839dd6a0653c1714c90f9a9c81e95df315a
MD5 ff12fda8842b97503a3cd439cd6f2120
SHA1 dd35f394f4dc04a65f8f3bc4e05931c62e1b5be5
SHA512 04c0806bee840cd176b786b72d4263a51252007a90ba3e205144f3d069638dce304220b4c3f6df772251da9617a5cb21b2fa12b854f57336db2bf0e5353d7b27
SSDEEP 12288:QIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1596523BF955C41CAE52644B5C3E5F10DAC173E5BE9200483BA6B7CBAF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0dd8b5509d5474d889916d10975d4d2be3136c474d4f19b0b48a36fa710389fa
MD5 1b9c7c39e57abf8ce478bfca9672a20b
SHA1 5353724bfb5b60ac68d49886ad3aa54a8269074b
SHA512 9b51e9bdcdbe01530aa42b62bc2f01e5488f304c3723f270a5930f8d89f6873d3ddb56a8be09585ea7fb2b751536102328f1e5a3c23ed04189704752524cf7bc
SSDEEP 24576:KZMrzFVSOQsqjnhMgeiCl7G0nehbGZpbD:KZMrzfwDmg27RnWGj
TLSH
T1E38501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 80b7268e37720b346cb9279a33d5498ea0deb8d5b1af8f68a3398cd5a3815d80
MD5 1298e9da205cbecf8f58aa1af8bcfcd7
SHA1 ce1cbce499e282e3dda5ea1810ef55edb72f1cbd
SHA512 129d963d30b57155c99ed8e4c0fb93d80e0ccdc4a5ab9822d30ba3adbd7446a569b65e6d2b3d6aba353327e8968f0d74ceed41410a99ad75676cfc2b9c5dbc4c
SSDEEP 12288:pxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E6523BF955C41CAE92604B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e89007085b172788b6938a204fa80bd1a2bc5627a7f30a4d828b1e2ffc6cb769
MD5 9fe8af65d5fff58fd96cc73ee00f2528
SHA1 d0e7dcc554c1f7831ca05e1583e70320fe34ed3f
SHA512 17d6ee3cc81e9817a574611c56da73b21f0aaf913022e5b434a77e0c1946bf87bef2ef26b9e195b2b7402072e5e51f21d4b9c98312b0a410052bb15033d46665
SSDEEP 12288:wtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B6523BF955C41CAE92644B5C3E5F10DAC173E5BE9200483BA5B7CBAF7B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 ebf79257c45f82edba27894521f86f719d700df6fe2c4f8565635f83abede4c3
MD5 329e6089202554c726dc0a664a0b1881
SHA1 be905ddba5aa24b0899e51a0d32ca0279c0e4033
SHA512 780b656ec1a86a07d8e318df87ef0787173f6e3d08124aa46b469c1d4d9b57390568839e2f045af075b83f3b4fde20f1ee12b59a7475df3368c9a37ddcb47886
SSDEEP 12288:+yPz5L8sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyssqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A75125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f759c258d7a5644b1c3d0b9a2c3c2257a316da0d81c270c195a75d43230f5951
MD5 8f6f0a1dbfd8f1d2d089effe0604200f
SHA1 5a959d1eb24126f977099cf35d409b137acb2567
SHA512 5b6baac301adfdb5484b4df0e4a86eed348cc033371575354e23f18f0526dd5c6b500ad21ef53d73c2f66067edb0a1bd5bc86b79acb934819d6d24d7a766b8c5
SSDEEP 12288:sxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C6523BF955C41CAE92604B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0ff7b64d155da3f295aa11b26b63812752cc1f348da374aeef2e5d26a21234fc
MD5 2e3d264b23296042a2fdb44b037c488c
SHA1 baa278f20eb2a472ed629620c5b244f0a7cfad0a
SHA512 966a7381a6a320745e8b52173038c0b631cd508b795c0fc94790b4d3cb57456690ca2730936ab88dfda5e9ee4c52d4653ae9a2dafc893c96b91ca3ed8382d625
SSDEEP 12288:OxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A96523BF955C41CAE92604B5C3E5F14DAC173E5BE9200483BA5B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c5da48dda1c6a0248b4b261244012e34d4854ed57cd7cedd7b856a69a448bb3f
MD5 c8955f81758312b275df22d0a2e93415
SHA1 68d232ebfd696cddf9a52f0daa1be0f3ea0bc404
SHA512 8ac4f442cd3e4b0f56131806b5a1a50ac9b6e501ee7ba7bac859c2ce71175723be217f7049b3a7f083248387bde665f46e1adfcea8d983f9fd4c32e8988f1308
SSDEEP 12288:8yPz5L8sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyssqjnhMgeiCl7G0nehbGZpbD
TLSH
T12275125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 8524e355119cc7fd4bf45e12b8e9b029d7a9987ec9f9b53df37747a9e2b6da9b
MD5 83234fe4ff7d13a14b8077eb5257b203
SHA1 16c8e371f3c2284a035d9ddb8b7fe6a3da2ce681
SHA512 c65d5084ccd77e4708d7b07fef29d2bfb1ddcdf5c3c005981a38182f50f9089fb67cbfb97b1f28ad170045f9ff8023b3b38059dfb016cb6cd038fe95a6e78558
SSDEEP 24576:ATxaLl3z0zDisqjnhMgeiCl7G0nehbGZpbD:ATsLljPDmg27RnWGj
TLSH
T1458501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 35f67daa1e360c7d4802ce516aafd665302f012465858c6be10e3a6a921ff2ed
MD5 189feea70088563d95b3c8705ac19927
SHA1 67166b2c3edcac5bde623e2f1ab6a7f94a5d1b4a
SHA512 d99699ba27914b3ad48fe27a7ba51e47c8a12de85c8284f38f5fdc1dfb52a6292114b9a10bedda8bcadcef4709f5aca0e01e3e2f2e28c6fe9185f9a9e9dd4796
SSDEEP 24576:03Zd9CHKy7GZGsqjnhMgeiCl7G0nehbGZpbD:+Zd9CHKyawDmg27RnWGj
TLSH
T1D495CF91F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e01f5f34ff870660712ae1feba08335f8d376d316b05f1887e797e9face65828
MD5 5a30f0ce0465497cb0447fdd574cb806
SHA1 8c99bd465fed8817fa64b8d2541d9729e2dc045b
SHA512 8056605c32ef20607c3741d27ac47c9868c4ba6b8e5274301e15b846a9597955130c0e8c9e2a391253f99ab689d68015ee183abb07e75dbdcb66551aa61c7552
SSDEEP 12288:HyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HysqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C6523BF955C41CAE52604B5C3E9F10DAC173E5BE9200483BA5B7CBDFBB28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 37e336afc393a9e8754560a11ff3f4e810e019d36ffe9c3cd3f216f33dec8379
MD5 1c57efa75b8313c769311afd6147bfcf
SHA1 470197bb0dde7f674e3730f6724f9633ef683ff2
SHA512 9cb8255e2ebbc1004d84e74dffbdbe12b417d672684d6249123e26e7612bdde987790a3d565e9c836961d2a89f790c8cac3f24c1bc515e355a456c26616b3000
SSDEEP 12288:lMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A06523BF965C41DAE52644F5C3E9E10DAC073E5BE92004837A977CB9EBF28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 e4d1ff0912e4f0666c1c0cbefa5f93e50edc09a371c8d81579e623aaf1feb750
MD5 c2517b3a39fa8fc17051f3225f49e21b
SHA1 d27cdb640ed20ebd1b220e420249cbe86ab9485b
SHA512 794d1426453ad8892ec08bdb7b908bef6dd974b54255345dc00ceed480aac2ee18fe737ef4b9b2089a5932120cb3a87bccb3e8ee933d9716f21528bcccfba696
SSDEEP 12288:uTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E6523BF955C41CAE52604B5C3E5F10DAC173E5BE9200483BA9B7CBDFAB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7f386bd49189ccac3d45fce0ee272439a43f7a15e96b19cc307147bdf62dfc41
MD5 930737d56e36afaff4689c41d1270c07
SHA1 707067ba58a9a5011d90c23318a380c327155e48
SHA512 32d6697440f770a868fed38474c9add4f603253d409e7ca22ba81014551dd442e0946da8ec09054b4619172698ea5fc10f40f67d0a03f10fd1451fba46d8c707
SSDEEP 12288:LxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1416523BF955C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 fa08e87e91aa905a5e48aa3fc9d6f9d567229af84c9a6aa963e59eb2de226596
MD5 b7ae67b42c1e7c9fe5c33978d00e6bf9
SHA1 69f9cd1c14550eb4370c39ac2a2c24d1750947fc
SHA512 c513e4999e9411df7abe5328fdbed901735eb61a3ca7f33ce88886b3456281c2e6ab36b3bdd6c4f631522c5e9acc6e85f441eba17c8da85230400c07e04b5181
SSDEEP 12288:syXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1106523BF955C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 c4c3f7d10b65f2b8db9f52508d1b5c6c1ab3120978f4d5f582afde91466b7d90
MD5 cc3b2f1421e88a424150f1af76bff7ea
SHA1 252fff71074a9712a20bb043734eed98bf094d8b
SHA512 8346e0249368f67dce395e844ccd57204815faaac6d25f33228f13256b3f03d004c52c3bc89e0891ffddec7abe6bf7dc157abdd6d48899b17040baa1e648eca4
SSDEEP 12288:OpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1936523BF955C41CAE92644F5C3E9E10DAC073E5BE9200483BA577CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 b744aaaf6905f69cc61a0186ef63aa3e8077fad5d2458b991bad8ac47df728e7
MD5 c775f2a08958b13b29515e947c65c232
SHA1 8de32626db25db10dfa8a4c7872437a7c643dfd7
SHA512 1b54f8fdf23f559c16deb96df104fa2192d871bebaf8d467c62e4b923907df69a67f688b1b7a1d27713970b6ed37ca392577bbe90dd793e9e707383437cfa4f0
SSDEEP 12288:b/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1426523BF955C41CAE52644B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB28584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 985b8e252aaaa95ec90d55f9e020a5e20d2527309dd9514a2aa5ec651a5535a2
MD5 c1980b18e71e0189db530564e3ef7549
SHA1 b31c12cf1ac3c877cb09d8d6af83767b5744536b
SHA512 54abc51f6c1f109e9025f5d6d03a167074b04995690952885a7e6bfc87639d236ec46b67f7194564fb7798e2546d0f0bb3f000a6eca9d17ccc4ebcf104dfa543
SSDEEP 24576:Dfwv2k9RX6wkyAIdsqjnhMgeiCl7G0nehbGZpbD:7MnYIBDmg27RnWGj
TLSH
T1A495D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a2569eb24c68d1c6b2467daa603337386af39dd474dec32a8adabd09d2678a0c
MD5 3c8417984fb1563a243aaf5004e67fb3
SHA1 47af671859b8fefac3df5cd6283d8779f322b88d
SHA512 79ebd73a4fb1ebb1566ac695fdb527f7729ac096829e2237b33e27aa9f1f641ae5755df492aa629fc05bf4dce8e1f600a2d83d2458f8de0e452c76ed87a66d2d
SSDEEP 49152:QYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SDmg27RnWGj:3ySzPKD527BWG
TLSH
T1F6066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4968d744e3c3ee1c4410d0744befe6d27f88e5ff5896454bced0f7698c151e36
MD5 cb8d8513b7124ad13ec86982608f895b
SHA1 577251af8748a5925a5b190aab190b398bf32b49
SHA512 0b26c75608e886bb7cf77a4758209ca63a31a65499ccae59a6243e8676ab49c8d0322dc904872e0e3d126dd3e89197896b30dd5b1092d304e621537f9d616bec
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYAsqjnhMgeiCl7G0nehbGZpbD:L47JUQjTirIhCnDHUPfF/CDmg27RnWGj
TLSH
T17365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6900d2a3fd297f571b63de140dfc7e53c893bfe964e791a8ca82636b8406cd16
MD5 9ba6a04a15b031c1cfe85e58bb3039d8
SHA1 ecef51fb4d416689322f12e51a40d21f2c333814
SHA512 12400516f94602f3318f43c57ed855467367f89e28bfa6768775322997daf481ce16bc451df048f66214795512f792ce9ff1a1d21a64d64b6f54a8cb3a95fd37
SSDEEP 12288:vVsfBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E75015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9f6c44b423ed721147c8e1b27ae70fa0b4821cc85aac9e9c9741366693c0d592
MD5 c212b0d51e22c7b657f9fbb939bc6fe5
SHA1 7f95cd03655a486f8236a46b26a5301de51b48af
SHA512 1e73dc91b54e2157791b48f4c9321dbdc9a260a77314816775a6f72fa9ebd3e6aee78630d6dda7a97a4a0f793416ba667bb3c4445dd8a72e205ae3ad601c4939
SSDEEP 12288:Z8xz+QU3f3wtGSxazbp1eFGhg5m5paaCJbx+JN1:Z8ljUPKwp1eFGhgypaaCBAJ
TLSH
T115353840766AD75FC6AD40321E36C2CCA7707D41EE45AB0772C8872FC57666CBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 05b9bd0d769c7a4f885386dfe2b2be165573638bafe1cdcb8441edc672ec8634
MD5 9b5f3fb0cb3cda8001b15eac5a74f120
SHA1 55c556752a0b5298c2879f448a2119a8de8bac77
SHA512 ebf2bb19305420005cde9fc5098f2454a40174d9a77d9e457bfcb0d3d6d33c223aa932bd24232b25a31fc77e4151e874f0dc107fe1ef5ab62e3e0d863886ba33
SSDEEP 12288:UvVkx2AZQoHySlG1Ap3+eWrH2MrCI4xI/y+:U2ln+eWr74xI/y+
TLSH
T14165E9816537A3CFD1FB2032072A5B4CA764EC1677096F2673C8457AD82AB25B1B83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 89e653963748183b29ba58d3597a011640418b988eeb772fef02da47a8ff8b79
MD5 98c0e8804e7f4b4b5158a1bec8a4f79a
SHA1 78c5e15286aa2146e0df654a4d20b67c9c19f36d
SHA512 be1d7d802c15e29b045337b80db08cc9710f3498b4acf87a1595f3cb7239dce016215d4030ae543f2a7530ded5af4d6c75d8019d91ebb5b5e98648663625c9b6
SSDEEP 12288:NO75Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F65237B934C518AF83605B482EAE12D680B7E669F1044C3BA5778FDFAB18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6b635ae3d0041f414d360d828c2a6dc1a214f5150bac04cd4367780771004ce5
MD5 27d368d3901b955f0a7070326e797ca0
SHA1 61e3c36b0b3963890328a324834cfc8fe3e5f373
SHA512 888129f83ec9e9468b7631313518edd6255a9d840079f25e4aedac6dda47aacd38d67308b74d0e95f6fe4a22ff00648a69cfe7f898a971266d1d0bd750f1bd11
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYbsqjnhMgeiCl7G0nehbGZpbD:1gb4mBIBhGF8Dmg27RnWGj
TLSH
T1CF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b110bb69023fe1c3c253c3082eac0edc6608e97d96d7312b2a4774b42d0a5e3c
MD5 82a3c309ac85a8b604311dbaabeac5e7
SHA1 47d1c777035593b75ef97c4c649582ab8840f6f1
SHA512 2abc1d5d945f6f7dce1b7046e34b74f2e413f671b219ef457ec38ca35ace70885fe728972b1cf97e3023ffbcfc79c92dca7ee839a55afd339386ecec76ff39f2
SSDEEP 24576:5G88u8FpJqH19zria7/mQsqjnhMgeiCl7G0nehbGZpbD:s7ZFPqVka7/3Dmg27RnWGj
TLSH
T19595016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a6d24af7f5e0d16f2d106a2d32b51e1cc8ae4ac8ac4509c0421ea195465443ec
MD5 15195feeeafa760b2c281a6c72c41112
SHA1 d5f19b9008e470c69f441af19e15e59fd029ae99
SHA512 349981f25507af7d5fabb045943ccca3927defd92d8c0ad59df0ea84fed47db8e29cb48d1517bf4f17c27e775343d90725d415e6f6abb67900d03c7934cf93df
SSDEEP 12288:9HvUrBFrEjwaQUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:9PUr+NQUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B285F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b72a99ff7fa269b873fbe1920fc89b5fa30b16e089877d56fa192eb085cfd3ae
MD5 54ce2712b4c99754858f0d39ffebb330
SHA1 3dad3bdc9c9dcfb8c5621c667e427aea9d00d4e4
SHA512 1d6460d42b1177537f1ce86f40d51ee44d66f32d5190bc3ac8608e264f4563d9bef0bd2909031cc5e322133d3c4b6c9f04942292470ebe7b640125121120860f
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjADmg27RnWGj:7G05lO43bpD527BWG
TLSH
T1B6D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fab501eb9c2010c725f8dc7b2b51c35f9d7d5b3b4a57f343443953420d7d642c
MD5 e60c8b586046df21dc1b53d14731593c
SHA1 8b3100978ff7b55db09a04fc71d94563e920c114
SHA512 efbe686bec0349bbfd7b76f9b84e403bacbf71d9db5e24af8f05c78c43f2327065a753b440a9848b81273b843180b4ced24bdb1f009612a00285b81a335a9c11
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+sqjnhMgeiCl7G0nehbGZpbD:ta5POZ3BJt2pasx2+m4Dmg27RnWGj
TLSH
T11E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 524b49bb808d53cbe20aa148770366d63f8b78342d3e84ab8ae8a15dd8afe27a
MD5 ce9b6cbee33c2853825ceac41633f51f
SHA1 471ee6b0e6d8a8187364012d2ae6945b167a2ce4
SHA512 7bedc8e46767aa28b994111ebe72cf10408b0ce53221760422105b44fa11409c3109598adbb3453d989c4d2f0257b9559549e7319e319f162fda9cf7da81d0e2
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkYsqjnhMgeiCl7G0nehbGZpbD:sNc/zEOVHFXDmg27RnWGj
TLSH
T199857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b1421a75fb0bca2eb73ed8ffd584702dd7bd2a99260fe9f2658e914c896ebfa
MD5 37e57c5b43d33b5e1ecdac9a83bc332e
SHA1 cbc9702630a9d9aa24517f68e84591f0447594bf
SHA512 d73aa306700a7ff30e3d07f057a7cd7775d1ac1ce31f6e6f714080dec7ee3df2a4551dec73b41f2ecf443d7fcfa5cf0865df2cefad631b86125bcbb752973939
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmasqjnhMgeiCl7G0nehbGZpbD:/TMwBtOmuDmg27RnWGj
TLSH
T16355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a28c0e7d5dda2d7137ff9bafb2326ea6cd3ed92d30dfa1de026a4039b6130b9d
MD5 95c69ce8498e466d6419d225d0d648c4
SHA1 46c78ba079aa32a717b96ababffd8ade119711f9
SHA512 67a0e21d80967092bec4e9442cf772fa41c7fbafa1a998fa3aa53ed4d56d085c04ae033a5e67ce12aff5d99725b73a0a29d7981800f81f08fe441f4d05b975bb
SSDEEP 24576:kD3FHshBIYQgAlsqjnhMgeiCl7G0nehbGZpbD:kDVHeBIAAZDmg27RnWGj
TLSH
T19095E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-304-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1072-106-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1072-113-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1072-107-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1200-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1200-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1200-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1200-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1200-305-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1200-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2656-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2656-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2656-51-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2656-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2656-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3144-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3144-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3144-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3144-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3332-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3332-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3908-72-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3908-66-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3908-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3908-267-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3924-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3924-118-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3924-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3924-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3924-129-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3980-79-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3980-0-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3980-7-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/3980-6-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/3980-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/5476-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5476-53-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5476-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5476-233-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5576-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-319-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5576-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5576-81-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5864-284-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5864-76-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/6036-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6036-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6036-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6036-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download