e5cbb61d5d9948364211d50f6a5257d02cc1df2db4eb8cc88b6dae20363437c4

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
Size 2.1MB
Sample260910-t18ejsvvax
SHA256 e5cbb61d5d9948364211d50f6a5257d02cc1df2db4eb8cc88b6dae20363437c4
MD5 5aa1f01b6a0b2909f7b6450d8c04dc2b
SHA1 0279faa6217cd6d37831013fa1d620abcc329ef1
SHA512 1c8ed8c24b91ec2d1c10d872fad895af0e85951c428e684e50fa8485c4101dbff47d4beda9d273a87bdbcea6fb0eb9611079f1fa79830aff0d5c367d1e3188ee
SSDEEP 49152:kA9SBxMq/ZsBjrlXuz1w61Emixu7aZL26lSBWsn7xX70rFwdpe30jaNf1TWbdz:k/xdsZrlXaw615ixu7ML26EnlX70rFwL
TLSH
T140A5B03236A28076C13F35319A1DB3BAB3BDA6704E35466756A00F392F31953992C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2100	elevation_service.exe
528	maintenanceservice.exe
2036	OSE.EXE
5968	PerceptionSimulationService.exe
4224	perfhost.exe
5028	ReFsDedupSvc.exe
5720	SensorDataService.exe
4940	ssh-agent.exe
1396	AgentService.exe
6100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\584ea0d38f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d07c864b4241dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000090002e0b4241dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004aa32f0a4241dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adb2c14b4241dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077405c0a4241dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2036	OSE.EXE
2036	OSE.EXE
2036	OSE.EXE
2036	OSE.EXE
2036	OSE.EXE
2036	OSE.EXE
2036	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1204	2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	2100	elevation_service.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1396	AgentService.exe
Token: 33	6100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6100	SearchIndexer.exe
Token: SeDebugPrivilege	2100	elevation_service.exe
Token: SeDebugPrivilege	2036	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 3188	6100	SearchIndexer.exe	100
PID 6100 wrote to memory of 4220	6100	SearchIndexer.exe	101
PID 6100 wrote to memory of 1136	6100	SearchIndexer.exe	102
PID 6100 wrote to memory of 4712	6100	SearchIndexer.exe	103
PID 6100 wrote to memory of 1724	6100	SearchIndexer.exe	105
PID 6100 wrote to memory of 4552	6100	SearchIndexer.exe	106
PID 6100 wrote to memory of 2456	6100	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5aa1f01b6a0b2909f7b6450d8c04dc2b_darkgate_elex_mafia_redline-stealer_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2cea33311fdbe5222de08176a60841929758108f9caf5b3167fd9b9d40d7c7ad
MD5 d379a193c7fb8f89574e2287796fdee7
SHA1 a325c2120d30000821fc0cf55035f68628867e5c
SHA512 8aac5125b4c78adff2f8c08788f88c6ba8f2c6b9a68eb8426597b1e863dba5755f27e0a0ab7d1c8e63dd81d8a9d1a605fd079d9502374c288d5be2f76821c75b
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxe30jaNf1TWbdz:63q6sjBYU023W
TLSH
T1A4D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 485581c37efd79d0d3b4bdb3701b109d17ee37ba4d868ba76af55858c7f9af3f
MD5 d36e872277007924bd65ea9b21e5372d
SHA1 872a2e7e31eab64c4ac00d1c6a8ccefab3fdef70
SHA512 01a7a596323006294476d276e852bae477c194b7630cf293b19f45a972c43dac6fc596d74e796284b625e5c8cd42a777dd5eb493c300be279c7cb1a7fadef6c5
SSDEEP 24576:YXYfDtczA6gXe4i7ojhsP5Lgrk1TWb4AN5:PtcOe30jaNf1TWbdz
TLSH
T15705F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e2641584a1f6d67a0799a983585101d0487342368d1c4e1d9b09dc10d9a4833d
MD5 b00f19f582ea0256a17308cbe655420a
SHA1 4bc49a90ca06a118d7971ecb591da73260a16fd5
SHA512 b334e565473b3c80d413766a2c8340d4761161d7f77da0cc7a04f156fe8213c520a3de1fc3da1be98ec62be5a7950b9a50764074adb62bcaf4f5cb12a01a5b34
SSDEEP 24576:P0Le5ji0hmxxrMxgXe4i7ojhsP5Lgrk1TWb4AN5:PPji0Aj7e30jaNf1TWbdz
TLSH
T17935AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 493482b2d8f5209b8c03755328f51970abceb7e76c811a9aa889cfe2bc190844
MD5 90510955340e73cc4cbaee2fe94af471
SHA1 2fa62f47763b7da38cdc2bbf1653695cc517b4ea
SHA512 c2dec1949e2cf4a82d384af7a573f2d2ec89010370b6fdb69f0ad03d38e31eba5f81d3560b2ab803adb5965f3d2ee7f262e755e071842cd34c571e08b268aa71
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWn6q8wyuXgXe4i7ojhsP5Lgrk1TWb4AN5:b/ezSC6vUzPveHjyXe30jaNf1TWbdz
TLSH
T182756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20e8327102724671bd7001edfa7a294d81404fe07f86cd5fbb47f65567d9d21a
MD5 ce414d60cb2664de0c5303668fef12cc
SHA1 293bd27dbc3c11164c641d25358b82d05c1cfbe1
SHA512 bc78050396b3b8e5187b01d7f2dfdecb31074b18a043f7244969160aa902fbc52aa5309e7c1df5a048771fae4e485b02a59521a635cd790152008e98c75078aa
SSDEEP 24576:zVbqPb88hv/l+YegXe4i7ojhsP5Lgrk1TWb4AN5:zVO88hXl+Ge30jaNf1TWbdz
TLSH
T111559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b32b1529345cf4cbb2426a91971fd18cfd931669c228bacb22d6778b92daf5c6
MD5 bff6e920c62969580bd92a1f6d859015
SHA1 cf2e9d0b5e604dac50f6984ba01ae8ba105d7a87
SHA512 6837fc925b29d4006bf5eacd8e0460f839bd0aa6697b034b5ad1d81675cd531258ac6b10dd66496e2cbe0ece34a3e1985250b51a514ef082c9c2022d571f85cd
SSDEEP 12288:NLU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NL1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T116C423929F5409C6F38FC3F4A0F7CB91E9E11EC161448D6B47E0FAA318BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 203bb39769f062141bd258fa916c369c8a3dc09625d35a9b68fb15bdce4da724
MD5 b6668cb48d2381f48a5fc15805853515
SHA1 0c9d0be0110b11f1a6ce2fda50e0e17737ef0c5d
SHA512 ccdec000c2da2cfa266abe0887ddd6336d45cf21f632aebd03c713906725533b68a7d9f4cfbb7aebc50a851c192d900258cf4f98779db83f51f73307f635d0db
SSDEEP 12288:EeBNUbTVO86U50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EJIUmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BE05CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e4dacff22281fca22caeef62983158dac92d4f8ff15580710c51cec3d8686eba
MD5 6c67b9b7bb8e1d5038ac4780899b1d22
SHA1 ff91d852faab62b2e19bda1be306ef6d8b021086
SHA512 fee11c015defdf3289acf2bc65fc822f7ebfb8f6dab5a203882fdab0f7e27217e21304f649b6d30f434d53a9aafafd7b284000ecae5aefbfae1e5441b5acfb03
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THL:lQvGAdlCEL8c/DRNw5CuU023W
TLSH
T1A1267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2098ec708a18537eaedb4b7cf96a0032b3e2aed60e157998c880cd4b1613cb27
MD5 6653950a13d11843a766cc3603a257be
SHA1 0f0d875b25e4bb25a994ec57d490f10e56080a0a
SHA512 3d5e9a472b92996fa5f13d168e06687e5acee3c9a2a0460a851755fba959f7ffab691f4e81b7c41c79bcfa86aac6dc3c2369e39d72a86e40dda2b325ceb002f7
SSDEEP 24576:y0ewsAjkgXe4i7ojhsP5Lgrk1TWb4AN5:jljLe30jaNf1TWbdz
TLSH
T1FA15E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59341D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3d95caa5b0be3e3e3968a1c3ba639a099e4bda52b2159ccf346beba7d671842
MD5 da37c43f8f9a4c402e6209c3c372e781
SHA1 05fb21932dd2aef721e14c5bd5cdf7891a02d8ab
SHA512 31dcf5faffbfe2b32a9ba6b5688a8e9faaf1881080bf8f7dce617933945289845a5321f34e94eb83c929a7cc0c4f5bf39d6c0e080f91817dc92342d39e51c8fe
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHzp4W:CUEtQevvqc2W1cpV2tI32V4W
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d86233a0bcae776842fb1e95e01cb2c90233384c51f030c7b8b9d40c566b4d2
MD5 db30f2c1a3f684f0caaf780d3d20ef0a
SHA1 ac858cc61647e6690461dae2d858515927c16d9e
SHA512 5add1d5f28304012da75421fea75defdb928bb7faa3f4fbecd3ac496ce6a73bec64e96e5fc0294b68afc639610fe2160f9e5cbab72772d8b5da97f42cb14b4ca
SSDEEP 49152:YCbRquA/m2yL5zTfFiV+XenmE3/zre30jaNf1TWbdz:RoquVjnmKU023W
TLSH
T16DD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 89a2d9e51c0fac4b30229d5f5a69cb794e28a22ad4e9e70ffd16f42d76d48aa2
MD5 bd46d70a0add5bb0b1a21cabe865abf1
SHA1 895d0e7fc6d392b119cd8b7601a247c093dd8628
SHA512 3ae433c7a59e1d1db55b81f1ca7cc0023262dbe44fc3d949e21eba76ab6527e25b22407bb39f69026dce05ea72eade633ab6d08d2308e73292d6efbc2f64c634
SSDEEP 24576:XAhGL3IFoiwtA5l7S53TgXe4i7ojhsP5Lgrk1TWb4AN5:XAMUFoiq5ae30jaNf1TWbdz
TLSH
T1B9359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 522ed4a7f3089df161d0db3463dbd840af92d8d429fa8e225642195a1837f5d7
MD5 42f86b75d9c13ae2af510e35bc14ef99
SHA1 26cc560b59ced5b7cbbc026912e59a1ea79e0241
SHA512 006e33bd080920f17d45b85d281da5b2df15c6e5bb4d019eb6dcf153e01711170d99d392644a1a10467abf346026cae90499aab44f60c967a076c97d0e66b65b
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+C+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:vwu4OWQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16705F14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1751f569a30a3c85af2520fa63c885708c24002066ab3676e126a8e8d2f08738
MD5 813a371a243afa4591dc858a37d50bec
SHA1 332242c1e5682f2ff7e16928660fb77e08bd5078
SHA512 8f426e44168549734991d173755e1c320d044e9262f7eb3c0f411ef1e854dd9d93977cfb125965436060186bba879b6b6b8612599011ef6c0e66eb41db48a49d
SSDEEP 12288:/eZ1IyH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mZuZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A8E4129637D420FAE2978278D4F68741E7B23882237147CF02A096A71F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cbd77067a6950a21e4f4fb9a47763057f6cf53ecc3d9c0618792359751647d41
MD5 c00fa4a7f4da7b2be8d776fc170ebc36
SHA1 becf5b57263cd6b00eb8a7a08aa34849e23c2cda
SHA512 d27b7a50f08e00e0414123f86481dfd3d21f8f9a6a40167193e499c494f49400f497fd83657824606f58cb7e28d1d2efb4ac39771645ebb983d37551134c6707
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UP:sQRQyi36YOcPbLvw2gAf+PN31U023W
TLSH
T1CD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd49b086bafad109647b0fc3519f83fdcb07baf910bf836655f2b9c525425dfc
MD5 17e20c418f2daf177672ec742cc51714
SHA1 c238ddb5f8740d0d981d0e4e9e22166aa08fbcf4
SHA512 b79be3b08c85e8deae10bf8676da67fc582d2a838a8dc97a63a31d107f9603fe57fdb5cd8187daddbe0538d28dbd82c881db13ab05d89d9c015e037dae1f2cc4
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UP:OQRQyi36YOcPbLvw2gAf+PN31U023W
TLSH
T123667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1d3ae7762ca4d511c058df38488084676360ff94e6e2c35dee9967379b559579
MD5 ae61fbf35646e2849722cb28bf627764
SHA1 2621529b5dbaedefa7795713ab1e342e3f1f2079
SHA512 28fd4e4a4050c886d2d9545216c9b961d7160fbc22b8da90061d2f5e243e6073ee3788b0b7cb0b780d1dc183733a8f48359db6e17b0b0901c73d8e2dd6971887
SSDEEP 49152:B68Qg55nhceWu7PNU3/7e30jaNf1TWbdz:/thLRc/7U023W
TLSH
T13FB55933B2F60099C04DE1769F4A873196E27C718FE0E7DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c4a8b2f313b45d9ece765c4c5c565b319411efb89815b7d11f7e02b67fabdde3
MD5 fd2094111bb4bebcdd960d6109339c01
SHA1 7d2369dddb2744865e3e4013108048224d3bde1b
SHA512 182eb0a3978ce7a4838b69a189759bf13d8c5112c816a88128f86dda2cf1eba934dadf988d2ee81292e4683bff8cddf14dfc8d5d8a4731299c8a29ef41708568
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99t:1y5112gYy5azzVvt69nLKnhZgU023W
TLSH
T1B9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 86e43a60c47b9e4fc87c071ff30f6848d166207c630e3725da6ed705c7541959
MD5 0b42c24688d22b168adeb85d849dee40
SHA1 17d3792badd2aabfc9bb97727277be8076b57fc4
SHA512 18a47dab44750a4decae4b2f3033e190b502f0e0c129a2515840aede4d9692ee29b260b983616f2593dd0d4004fb5b63a846d2fc040fd5c4617b4d9005b8c25a
SSDEEP 49152:TB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8e30jaNf1TWbdz:lu6Jmdxd2d8U023W
TLSH
T192D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a25a45461416fc18455ac5a7cc3ddaef993909d651d3555c4aa04b2c6433367c
MD5 b5b1506dbe74317d08bc51fbb48bd363
SHA1 f6b7e4764b984e10a2b0fc390094573e610158b1
SHA512 7ccf7f7a44bf237a07f02cc2ac37061bc2ad240dec06b7320d6c3bd5c31416298e80dfd1cd0f34be35d99b638d24621ef70da68e0c647d07967775a622b5c36c
SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xJe30jaNf1TWbdz:dmifPWRKU023W
TLSH
T14AB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 44f96fb081a0c81d9bd7941b44dc38491c051e4d0284451adce19046fa75dc87
MD5 ca399db887a716e5fd1af656980cd1a5
SHA1 da313063e50699c1b79de994f7de9b39195c8ea4
SHA512 334fe645407a1f69560e675b59224871473b8259a5db8b99d18c8257d47132ca67bdb357c3a1f0389897220773842aea6efbbd40a8b3a8db4b41f524645cf6ea
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqke30jaNf1TWbdz:a5dKii61kU023W
TLSH
T137C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 98e3ca68d81dfbbf5312b4ed1d784b74edc1d12fc0f8bb61cd1db01d0102042d
MD5 aa4ebbed34239c670614427a09667d48
SHA1 b32a343a108b29ebefe4b6f687b971a454e21147
SHA512 a967be59773fc0927f7e619e1cb2eb954e148fee217b80a109257d360a61b2c1ff50c9e8e8956c1ad25ed57b19f75487eedfedf507e7b07be3506f8a894841b7
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5w9e30jaNf1TWbdz:BX2imphWU023W
TLSH
T17D95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3a80b58bc1b2f3f478dc96d36e2107ef2b1e7e991a7a5c05da65c622bdc382fc
MD5 3072694e33903cbd75e99e24549c9df8
SHA1 0d7f7be6ec60f33b51313c6580619d057bbe0c73
SHA512 ed965a4de03a5918964fc40bdd32049143aa9c800a66caa0f17602999b290ae1fedc33953094b8cd55a9b2ada899d9168358fadd710549c5d33b4b083d91deb7
SSDEEP 12288:lc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ldgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19AC42391AE550ACAE34BC3F0D0F787D1E9E01EC272444D6F57E0B66319BCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 933403ef46fec7fadd9dc35bc2eced4619270a8ad4f3f8d30da0120b75351aa0
MD5 2bc462c1bc78eaba18fbf938c234d12b
SHA1 723271e89f58303ef241a7405fdf26c7d93b1084
SHA512 fab412838d704c3b3238be9f7bc455969b43e0b42375bf2dd4621c539a3fb6566dc36a96a767feb0f61d0ff79298b91ce93a56ed7ae727059a3d7da27756f363
SSDEEP 12288:qr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T172C423A1AE5509CAE24BC3F4D0F7C7D1E9E01FC272404E6B57E0F95319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1662e0ae62985c1909c5735a44114b4ff644d7e9a02836f479336db0f7a8a750
MD5 5a32e7b4fe7ea1206cad287f74ef81e0
SHA1 b68a34bc221f402709043a0b40ab7d1a6ce5cd29
SHA512 f4b90e217642f6464d4fa2c628d80863789badd42252299ce5bec31970f6ee93ac00cefa29a75457f58d8122c59abb5de72c16decfd30a8ced496c85d69801ed
SSDEEP 12288:tB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FAC423A1AE5509CAE24BC3F4D0F787D1E9E01EC272404E6F57E0F56319BCC996AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4e9a018743fdea6202b2cb4d7e6acc33ad3d64b72f145e3428435173122c434b
MD5 7dc1244cdb1f0d7f52012917ba7c1374
SHA1 2bce3a9bbb74510db18993cb8794adcb3bbf7867
SHA512 022bc10fb15812187373635157044fb420f260b3053e1eaac23bb65f3951554093a25c035e8bcef93dfe465bb9e3d4e5427e97e2a33a29978a79964c245b28df
SSDEEP 12288:jVa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C9D423926F9905C6E18BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5d86df3696e18500b2c891c0946083dfd00d92e69c0213d04287a42cef31ce3d
MD5 7a52652856e5a484587542155164eec6
SHA1 160ba288f44f554ba90ea57d0c48c821a5aa31bb
SHA512 6d859976c14c83cb7044e684aa10aff4b3ad57052888055b6cfe1ead20a56008574d0bc9d77fc40cbacd249dbc2390735cab97e4c964be649047cf3fe5a013a5
SSDEEP 12288:gy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:grgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7C42391AE5509CAE24FC3F4D0F787D1E9E01FC272404E6F57E0B96319BCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e2dfe0189cb41682bfa2ca3bcc7f90447c8575c7f46872cc278388fbb29e63cd
MD5 83ac2f56b8a02acf58b3c8371f4fc09c
SHA1 9fa9abb65f5633e15515ffb759c9e56b89c85bcd
SHA512 cb10b4732eb1ec20dad98e98cdd297136ad59bd4a23a9ea2d1720bde1fe58d22326893f8ef02e2aa2e3d42e28e7e5e7046a59b0b35dc13fec88e0269d3979029
SSDEEP 12288:0f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D9C42391AE5509CAE24BC3F0D0F787D1E9E01FC672404E6F57E0F56319BCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 04c97061fa9f73727ee4c866e0cd24be402879a5acfdac69429b56ae26610c32
MD5 65f5e228055736bf6a16eb5084c8d881
SHA1 80c08f1582f744f8e1613b483e0cd29206ef629b
SHA512 66d6378db6399c54cfbac35858efabddb2dc13cf96653e97452dc394ea98e53fb0ad1978619e9843acaa98192de08dd055422c5abafe69d637770cf2c49c9e9c
SSDEEP 12288:UD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11BC423A1AE5509CAE24BC3F0D0E7C7D1E9E01FC672444E6F57E0F9531ABCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4c9019a196f65d9cd52580c7984b0ac6994545efc69efc161df0b327dfcdd10f
MD5 dc80129170dabe83c6a26f9a365cdc61
SHA1 8793382e9a7d9d39de72ac61eefd689714f782ad
SHA512 b7df2b350ceafe0cdfa16f9c265800dfa9517e73c62f8313809ae9bd9693f5287587a583c3c8748e9b1a2d6a43d418b2a403f4833c1d889ab383e5c19ccd0f3d
SSDEEP 24576:UZMRzFVSOogXe4i7ojhsP5Lgrk1TWb4AN5:UZMRzfTe30jaNf1TWbdz
TLSH
T15C050295B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0ca893726c70466aed39df64761f3c773ddd21c1d52c5ed1a9512e548880f932
MD5 fc4ac38bb8e5c6c7157a13aad1171920
SHA1 bc37c5dd708aabeab4c9bd68201d766c6dc0c498
SHA512 04b6c249138cc3c85024f51af94ad298b1ec29d8f6473e1daa0a6cf9e5229f381a12d7c7038c9dcb2237f1273420556ce9dd3bcebccf73ea879c570adc34206f
SSDEEP 12288:Oo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186C42392AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3188ea668a7daef8dd890ffd6f2f92a088b7adb22c4e3bff6ee2e3b4788f9923
MD5 3399a5e0121683a1841d0fb132a4b606
SHA1 a4df147ec39dcf5821fd9f58e448e751d5ca8154
SHA512 f9e528cbc8b9b5ba095ba55034edeede47405fad0f757d43a233e30e1e81f5f3ba61a2089d4e4f2bf50dd5bb51f1d163c6d2f628bcd40dff6a101448b16d46e2
SSDEEP 12288:Bk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T183C423A1AE5509CAE24BC3F4D0F787D1E9E01FC672404E6B57E0FA5319BCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 56860d2288437c24c7f4d8ccbd809d4c56ce9619465ba06a06ba058f1d1469d3
MD5 f048e1f00e9c72f7dd19a5ed7361252c
SHA1 e856eac48970a4904dda34ae47d425bbf7cd780c
SHA512 7e7b15bee352f0a6abbbdfd8b1ade989af6fc5e77df39d27682bf3f7cd0f518f9007983fa7dd1ce22cc4bfdf19d48610b36b756b92d9ae224055c53bcd890891
SSDEEP 12288:6yPz5L8H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nzyUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B1F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f3427db00f55cc6ff3a86966090ab381d0dfde04f4e67d831e0b839bd48ca66d
MD5 b732460887bb4c59f3825a3bd4cf579a
SHA1 80b2fd055689ee3b40734ddc3fdbd119728b24c4
SHA512 53cb01a1ce62af71963494b0ee4923b4a99d264daa48b89d9a799cdcbf472e333c6054c2bf9a165340403cfe554bf2fce178bcfb59c15711bfd03f66dd47f6af
SSDEEP 12288:Oo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C3C42392AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B95319BCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e5d25b5113893c3dfd9a4c7962ca525ee61e537c48007bc966c963530cf0fa0a
MD5 2b76df5b9459f6d3825fc4098cff75bd
SHA1 cc44e5d5c2ceef81110e33eaf1df7ea455c350e3
SHA512 fcaba1033b88d9f9dbee67f87e0c74fb9de818064d3f078d199c5f12aa4e7fb452b693fe55eaac684ae6512d87394037ccde3367973c2540f876f23c97f6a53a
SSDEEP 12288:do0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15DC423A1AE5509CAE34BC3F4D0E787D1E9E01FC672404E6B57E0B95319BCC9A6AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0f920c71af45137648db711a3ef5e3cb58cb84999adb2465fc15b5d10dabe555
MD5 088ae61edb9cc3bb7e640e4b392df6b3
SHA1 dc0792d1e46dfc97720be1b0dac41420e0cf76c3
SHA512 96779f50d0401fc7684724e017f7b019fa20d6c2e2d3b84a9611aafed24aec4d1935876885f24875b24b6fdc6f93a664be8ddc7b15ef41e0446d61ef612836b0
SSDEEP 12288:MyPz5L8H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VzyUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T148F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5b0f659ccf97b309323e14f69adf6ecae13c777fae62b710294ae1e59f995d82
MD5 05c5ee5a83a950cd91f0d67643a9da59
SHA1 2f51836ba305522c04fdab74e537e84dfa427376
SHA512 32e5c86c556d32fe52f4bd51e5e7fc4dd7b740dee313f2bca3e70f440f1ba20ef8d38f9f4d637a1efa9f116765379c19e798f38a03785080d562c6ee206145ad
SSDEEP 24576:XTDaLl3z0zD+gXe4i7ojhsP5Lgrk1TWb4AN5:XTuLljee30jaNf1TWbdz
TLSH
T1260502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 56bdbca9f08c03cc8b0d2b3231b522d00c68880e77512bbba659f7b162290cf5
MD5 168759a9f329e8503aa9a70d368a5abc
SHA1 70ac1ca1d39c6d604a0fe9adcb571eb80e36814d
SHA512 a82cfa23b06be2ff30859f7843292cfd9de7ce9ab7a3295228166518de375d61c18ce39a8081fd07a0f04215484a8a19d8582699f4ead7513ff0da969284cddf
SSDEEP 24576:l3vd9CHKy7GZCgXe4i7ojhsP5Lgrk1TWb4AN5:Fvd9CHKyaTe30jaNf1TWbdz
TLSH
T1A525C090F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1226aca0bb39e340f36427fba233fa27abfd7b3e5d6a13709d680814da5b4fe1
MD5 4d70e2f0236b3f5d2fe3f0f99ce32438
SHA1 42041428c6000d40d74ce93a94f31605aad4470b
SHA512 1078a20be1658a3a9db178f2684abde450cf175fd69140631751cbd479c96d389d6fb5134e5d8649b2f85f7ae749f25820fb3690e00d12029b6ade4f42ef93ef
SSDEEP 12288:wh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10EC423A1AE5509CAE34FC3F4D0F787D1E9E01EC272404D6F57E0B96319BCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0248848159c53cb15a843c18ff8f2d1fb2da62b8f7a468f79009c082be8c8e17
MD5 6c3cfa7042f93367a98011a8381e97c5
SHA1 fb5711fad0b6e09336f79933e7596bcb465c115f
SHA512 cf088a852a7e539eb7e93686083f677d784c60cfbccd6200958b5dc183c6de2d055bcfba5db430f6e0aa4ed876082195bf1d736554f472bf745051eb1526bc91
SSDEEP 12288:Dn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:D0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7C423A1AE5509CAE24FC3F4D0F7C7D1E9E01FC272404E6B57E0B96319BCC9A5AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0fbc5a39c1d7eb6775915fdca545bb06c2c219ca012035f5c77cb64af6b6f350
MD5 28cd2c93b7ba038be768dcf9f2b11bc6
SHA1 2d337255cceb30a0e2fe80fe4bc6b7a562ff5513
SHA512 68c8ea939f68a14aed7fb3c7f3d25ca3369c4a343afb01ac77756fbe116bcc1aaa2b665a025b1b3d9033cc716f0dacef0fbca7d456ec00a62a66dceac0f96753
SSDEEP 12288:G20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T136C423A1AE5509CAE24BC3F4D0E787D1E9E01FC672404E6B57E0B9531DBCC996AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 afa5416cb57d81851f33c2d011d224236f64549435ba999eed8d47b9ce8af33d
MD5 8d6ba3ff62c8e3617bb9ada7f0448993
SHA1 a69400431687c0d99c3760e84860092ca094d07e
SHA512 b9053ba40ab1ec6cd7fc89db48f8a59cc07b9c3426bbe6e5cf2ab220743e176aad697d10e29f7bb4217e7538462b206862d2c1783d047181e3f120526508b715
SSDEEP 12288:bo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:bJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F4C423A1AE5509CAE34BC3F4D0F787D1E9E01FC672404E6F57E0B95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 1ec5efb51b14252f57c922261c64c94bb146e744e259c339f08bba7668ddd940
MD5 4a5817c32f0997df15eae0ea2fb64448
SHA1 ca1bc7c0942d571799a1b8a3d6aa6ec10eedac38
SHA512 635f48234d14227b2b0631904f21b797ae7f4b937cd48257de474861c70c564337d8ecd384229379f49c6b4abea6cedff738905753f809924f96472195ee113d
SSDEEP 12288:Ch0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:COgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T193C423A1AE5509CAE24BC3F4D0F787D1E9E01EC272404D6F57E0B5631DBCC9A6AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e7f950f2ad4468385d86ce58947ce53cfdeece5c56404a0bb049f49331614296
MD5 497ab90a090f571822b93d8b9242162e
SHA1 b4f6e58735cd8e2f4bc97a3a5db6b64e6e51a9cc
SHA512 46a0f165c8a1281c69286c1e1c6aafe76b3fa1bd4681cbf74b1b758d72286d8b2249606193a33b9f41bf341b699d833f5157ce88201882fe78b20d9845b46dd8
SSDEEP 12288:rA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EBC423A1AE5509CAE34BC3F4D0E787D1E9E01FC272414E6B57E0FA5319BCC9A5AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b04e3998a17b95470135a2ba7966d2e281689e9ccc588c287a191b410554c3a0
MD5 859e55c5dae145034df0c64a79b313d9
SHA1 4f15725a004ccd414d2f557a85c212dc62de7e20
SHA512 9082f003eda5badaba9c71981467bbfb8df79271cb8965edeedb99e1b90955e5c177150255fd710cf79f17545553d4af7512e9789af279217f953d9b502e982b
SSDEEP 12288:3y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3rgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B8C42391AE5509CAE24BC3F0D0F787D1E9E01EC672404E6F57E0B5631DBCC9A6AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 4d13f109e7d20c997e5015053a958b6b6a9bed42e5f42d25e48c458bf9d343eb
MD5 c00e9b4179a171e2a5659493a2a9b196
SHA1 7c6d8201ad4436f2eea525a4d0a8dc7b46f83c8c
SHA512 ab87a20ec8a3b894364e3a54ff46787262f38fb4092c31e53a55e6051e030358533fa07f76c7f1323b9384d1efd4948f8ee4fbdb4db05f04e114cc9436a7e490
SSDEEP 24576:KfwvUk9RX6wkyAIVgXe4i7ojhsP5Lgrk1TWb4AN5:aMnYIAe30jaNf1TWbdz
TLSH
T18735DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 94e9e314478de38eb760600bf9e006b2cf9a13ad082fd2b7edf970ff12926c64
MD5 11cdacb1d918f27fd81e8698227a0834
SHA1 3bcab716ce309cebb4375187c4c8caf3a5084c3b
SHA512 57888e7afded7909e5628f735894b9a4cec2d754a128e4c1f115388affaf682fb42ce5dccfc2d6ef670e724d2f22eb950dbe75d1cb9763d0ad6ca36c10923eff
SSDEEP 49152:BYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0de30jaNf1TWbp:MySzPVU023W
TLSH
T178067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 285a3ef4596223fce1349fad238475d435dafff8acbdebd91b04744369e88acb
MD5 6943c878fa3a5df6d5e72b037b14eefd
SHA1 e957ea0f8059fcb2c2978c49dc22e21bba0171bf
SHA512 a8c610b1e7723ef1a763eb001104a74128dc061faadf5f48525ea60c242018170348d25cafe22810b4947f0eadbbea65ef3a9f2f1d68b99f80d629d39260502c
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYYgXe4i7ojhsP5Lgrk1TWb4AN5:W47JUQjTirIhCnDHUPfF/te30jaNf1Te
TLSH
T1F865AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7d2ea93b5ea940ddc425d81b882ac0caad5b9bf3498db285222d28e285509aa6
MD5 709eef7b238cc5c55895f6708123bca5
SHA1 579cff51aa9cbbbd8359d6aa2214d31d7c0b0aa0
SHA512 2db4872f0a2ca3ff733f13c05df5f846015fdb66fba2d894f334ac5e0c4fe44470bb85d85e94d5e161438b730a3de150c8b8372639539f6eae0fa65a9cae173f
SSDEEP 12288:FbsfY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F8E4F15AD29802D8D05E92B5C3968A81F3733C9193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 0fdc7d828f05b837f4a6aa38125aba1133e574e0f34ad15aa5c95f2c7da8d187
MD5 88a4b3369490f61db7b63369ac05d9fd
SHA1 83ca6ec23504e16975c31f5a17ae72c18ef50632
SHA512 8e97fe27ca95248e5d01331fb3d5488a96e898b4f23ec60265cc6f0839e641f44c33fe6a6edc718d46f4c24664b6ae07dea8933a0491ccc9adfcb2137473eff9
SSDEEP 12288:0wF0aU3fRpc6qJ7VhMtuJxfgVWHNXwhePJsd9Omw6Wj:NFPUPzQmVWHNAhePGdkmf
TLSH
T14A2507017666C74FC6AD80321E36D5CCABB07D11EE446B0773C88B3F9576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 734434b778d3b8b117dc1c55bf0669bdc6c09128d27d0cce74636b2f24a00316
MD5 2b5fc7ea1de4cff6a103b38da6ea977f
SHA1 586fe7e5f5587e1ea96310e7fe25249153832cbe
SHA512 4f4f814073bf91ba386c11fc2a60e647d16035e9ae4eb6aeb79486e3e2f9b7ce596474ecb320c3e6cb238737f5799f8859cc30da2231691336bbb0de80e15143
SSDEEP 6144:WM6oVmlP2LRRNnnld0ytuJxf6G7cWz5E4yJqSqtMx6SqtMxWRl491+5MR3b8FE+w:jHJnlrtuJxf6G7cWBBMR3b8FE+QH
TLSH
T1BA65E9405437A38FD1BB6032072A9B4CB7A4DC06B7496F27B7C8453AD86AB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 368dc3db49f8130aba72cce86d061affd23897ab02feec78ab716dca2254e5a1
MD5 c9ea826f7c7b425972072ec05d880f4b
SHA1 32fb153440bcf919cd4e49335444c8339645db31
SHA512 3ec8f8455a5b07932b70e02ff495afe3f7dcd01cf04b8689082c0608cf28943cfc4f2d883e172e1d3f50162eefabbb3c75c309935b9a7dc582b2aa271f7a26d3
SSDEEP 12288:507w0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T106D423629B580DC6F29FC3F090EBC760F5A53EC1670089EB96D0B69319B8CC99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 675c1cc5750cc5977532c9e704190f797a0ae5598f2008570f318efc3417a18a
MD5 37260e37e85241e44b5ca26bf55cadc4
SHA1 ca0c17b5758810ee639a7e6ff91a6f20da87823d
SHA512 ab9df745eee28ad68608043591c49a59da44e0aafb7b37be7bbd961f4d69b33b156e7c3682a7133a56510d6e885f8c8e979d2a5cfeb9072154fbbbb44bb2998d
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYXgXe4i7ojhsP5Lgrk1TWb4AN5:kgb4mBIBhGFve30jaNf1TWbdz
TLSH
T17A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5f9048a937f319af4931638b9d784d5536e8424a1d5c58a5efbb5b8c1056de6d
MD5 41c8e64cee2922c5d643a2c4d4acaa4d
SHA1 0742036d0519397c9c285551132f0b6b8c8a4191
SHA512 8011c93ec1c5f1fbb0dc1397c6b93ea0f1301330846b40b5519dcbc93679409345e6a58306d7c63ea5d8d6f9be631921fb0cc6a61b7cea62119121a52b0afa6c
SSDEEP 24576:8G88u8FpJqH1bzria7/mogXe4i7ojhsP5Lgrk1TWb4AN5:/7ZFPqVea7/Ge30jaNf1TWbdz
TLSH
T15F35F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 5ea99192de5130ef1142d68cd162de0097b1bd5b5717a16ffe7a0c1280a5493e
MD5 4412be92b4a8b78449e216b511ccd878
SHA1 143202e28b819a933e5126bd3dc009d3bf548c1f
SHA512 ae38e9173842037271c7e2cbf9f6d9ac03ca62fdca1f6db999989d525a1bf5bbc526d515659fb9622f67a32120c74017fecb22eddbd89752b62bfbbe105c8042
SSDEEP 24576:TPUr+NQ8gXe4i7ojhsP5Lgrk1TWb4AN5:TJQTe30jaNf1TWbdz
TLSH
T12A05E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 757b9c119d3962643a21ed5d4f095ada8243228e481c604fa4b3ab3dc003b7a9
MD5 75efa0e2661dfc1826197a255d864a79
SHA1 238ebb0046d6d53010672a78039ad75f42125f1f
SHA512 425dd7b84f4da2a9fc93a0e9754a87019b1e4cdd1bc62da3d4dc08c4d9feda04f15010580f3cbd156fdab5e78485cb1166b7df61aa99c5ecf5906a10c5f8f064
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDe30jaNf1TWbdz:vG05lO43bIU023W
TLSH
T1E6D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ead0db024c28e188133e26817217d7ef0bee52b5b16ea209bcfdfd309330b4ab
MD5 a6aede2a19158c7502ff812581b7a4cc
SHA1 9480945a714dfd32548fbc073731f3fd558f51c4
SHA512 70cbddcee91684758063cb58dfe3e73c8792a8525ee23947b22190b2ebbd379ead9ad2b97b46e34bc9d8d3d07a5ea6b88bbeed87dee6ed47888f480788118e26
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnagXe4i7ojhsP5Lgrk1TWb4AN5:xa5POZ3BJt2pasx2+m7e30jaNf1TWbdz
TLSH
T10265AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d7008af603c0ca3f31cc56bfe15b4fc8abfb0f0e60334afc2ae2fbbf2fba66df
MD5 e8d00324ebd3682ef61d4b661e608176
SHA1 ade522d978abcec6dbdbcb0a9aa0d95a86de92af
SHA512 a25a3080f2cb9adb3d0c298690c710c0364023f75555ea578e338eff6c50bd0d395a7be26272a30f8f98e3f063f0f9e1e3e272a8f1d5ef8300a1b37dfeb8edc6
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkwgXe4i7ojhsP5Lgrk1TWb4AN5:KNc/zEOVHFme30jaNf1TWbdz
TLSH
T131858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 32d2364ed54bb059dd3c8550f0e051f71620c3c45184f46a4a83d23b51d61009
MD5 a2853f937fcf1844ae34b236fab2f015
SHA1 af09cf142427a8bfddcd65a34c91225969510938
SHA512 4f65f59256474d043dff47e3473baac37369de80e0ed4174652fff2a20569861d39f5fa3a6244e9dc7bcf54c9d9f56a163a54a752d002a77faef2b80b2eb4f3d
SSDEEP 24576:mTkNvNnaFeYhJNtmZBmlgXe4i7ojhsP5Lgrk1TWb4AN5:mTMwBtOmwe30jaNf1TWbdz
TLSH
T1B855AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 60ad389c8911f9e90963b3f596060e6269c30a281b20fe282fa19f6562a0d833
MD5 d58cd48a4a0d28ef1ced1f31a506d4ba
SHA1 905f2cd2e1cd8059f7af4eadf6a09aa7d0ac1b8c
SHA512 8b55512a23a08eac0954d801c7edc9a046d1cda1588e0bfe01ec600201caa39a6c5727297ffaad263d8b23d67b6a7445aa7f7a354761c76578950b54a4035807
SSDEEP 24576:tD3FHshBIYQgA9gXe4i7ojhsP5Lgrk1TWb4AN5:tDVHeBIAAYe30jaNf1TWbdz
TLSH
T12D25E17DEA5C04E4E57BC2BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-32-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/528-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/528-42-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/528-31-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/528-40-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/1204-7-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/1204-27-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/1204-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/1204-0-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/1204-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/1396-112-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1396-113-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1396-119-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1396-121-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1396-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2036-48-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2036-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2036-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2036-47-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2036-229-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2100-13-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2100-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2100-20-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2100-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2100-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4224-293-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4224-71-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4940-101-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/4940-319-0x00000000007B0000-0x0000000000982000-memory.dmp

Download

memory/4940-99-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4940-107-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/4940-296-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4940-300-0x00000000007B0000-0x0000000000982000-memory.dmp

Download

memory/4940-318-0x00000000007B0000-0x0000000000982000-memory.dmp

Download

memory/4940-391-0x00000000007B0000-0x0000000000982000-memory.dmp

Download

memory/5028-75-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5028-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5028-314-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5028-74-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5028-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5028-294-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5720-87-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-297-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5720-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5720-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5720-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5968-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5968-67-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5968-61-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5968-59-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6100-128-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6100-301-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6100-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6100-129-0x0000000000620000-0x0000000000680000-memory.dmp

Download