763bd593816a193af8532f475b30442971fdf0c1ca8d27f14cbb97c385ffde41

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
Size 1.7MB
Sample260913-st5veagh62
SHA256 763bd593816a193af8532f475b30442971fdf0c1ca8d27f14cbb97c385ffde41
MD5 4ef4c4ad24aee0d9fe9511a6f557ecb7
SHA1 a47da4b0e9b61d34235c83f04f577d756dae6059
SHA512 5deea34a12fb7d247ca8c3b8d6e0eae167cde4b3ec05bb5a81a07f76385f07f4018b0b677ba04811b94581fcaa01ffea1f3e3dfe4540cb5451a9b5d25689a115
SSDEEP 49152:wNZCWOLT4kKGAbm/K2MtENL1p7tTdvySga/9:GwnLTsGA5mfdvyS5V
TLSH
T186856B1663F95128F1F33B71EEB993645A77BC71AE3AC50E5284025E09B4E90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	2816	Process not Found

Executes dropped EXE 23 IoCs

pid	Process
2996	alg.exe
4580	GameInputSvc.exe
4516	GameInputSvc.exe
5888	elevation_service.exe
3876	elevation_service.exe
808	maintenanceservice.exe
4528	msdtc.exe
2288	OSE.EXE
3324	PerceptionSimulationService.exe
1488	perfhost.exe
5896	ReFsDedupSvc.exe
4544	locator.exe
756	SensorDataService.exe
5720	snmptrap.exe
5700	ssh-agent.exe
1116	TieringEngineService.exe
5100	AgentService.exe
1720	vds.exe
496	vssvc.exe
4820	wbengine.exe
2600	WmiApSrv.exe
3840	SearchIndexer.exe
5976	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd4569e7b68fd3f0.bin	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f02b1a43c143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b963d37dc143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046bfdd7dc143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e665e43c143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003078b27dc143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078e0eb55c143dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8b4147ec143dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4516	GameInputSvc.exe
4516	GameInputSvc.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe
5976	AdobeARMHelper.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3256	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
Token: SeTcbPrivilege	4580	GameInputSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1116	TieringEngineService.exe
Token: SeManageVolumePrivilege	1116	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5100	AgentService.exe
Token: SeBackupPrivilege	496	vssvc.exe
Token: SeRestorePrivilege	496	vssvc.exe
Token: SeAuditPrivilege	496	vssvc.exe
Token: SeBackupPrivilege	4820	wbengine.exe
Token: SeRestorePrivilege	4820	wbengine.exe
Token: SeSecurityPrivilege	4820	wbengine.exe
Token: 33	3840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeDebugPrivilege	2996	alg.exe
Token: SeDebugPrivilege	2996	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3256	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
4948	AdobeARM.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4516	4580	GameInputSvc.exe	89
PID 3840 wrote to memory of 2376	3840	SearchIndexer.exe	112
PID 3840 wrote to memory of 5988	3840	SearchIndexer.exe	114
PID 3840 wrote to memory of 3012	3840	SearchIndexer.exe	115
PID 3840 wrote to memory of 5904	3840	SearchIndexer.exe	116
PID 3256 wrote to memory of 1256	3256	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe	117
PID 3256 wrote to memory of 5976	3256	2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe	118
PID 5976 wrote to memory of 4948	5976	AdobeARMHelper.exe	119
PID 3840 wrote to memory of 5316	3840	SearchIndexer.exe	120
PID 3840 wrote to memory of 1908	3840	SearchIndexer.exe	121
PID 3840 wrote to memory of 3268	3840	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_4ef4c4ad24aee0d9fe9511a6f557ecb7_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:1256
- C:\ProgramData\Adobe\ARM\S\17416\AdobeARMHelper.exe
  "C:\ProgramData\Adobe\ARM\S\17416\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17416" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17416" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:808

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:496

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2740 2624 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2740 2624 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09b9373fc8704f98cfa43c48c94b91da4cabb9e0a43c1a858d21ab87a15b91fe
MD5 9560c634c737953b50b6f95ef27f0f62
SHA1 786d3df2512cada2b9451866ddb53df06ca6c63a
SHA512 d582ef5647a47ee2112a3ea3b2d85d18a20372c67788129eaec4f1ad066ba143b8790d49b40cc8f8b30daa901f21b18aedd2d8ec0d75faf731ab53558939e29a
SSDEEP 49152:tb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn11p7tTdvySga/9:z3q6gjBQfdvyS5V
TLSH
T1DBD59D03F29900E8E06AD178D7469133EAA2BC890B34B6DF0794B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 4df3c2aea0ae11b6d57bb2182207b4842b774ea9bf9b2dde27dac3d8e95406d4
MD5 d1027ee4d559ef1347dbaaa757f1a809
SHA1 c3ef24559396167ce6af26d6d45a4147e77183bf
SHA512 139f82f70328a47a7a576c45cfa167de1164edceee65899f0956b7e11b61e549cb98098b19291e86218faeb045ba1a74b2582879daecdcc331ba14d6bf7a4482
SSDEEP 24576:0XYMGtczAZ1XZZdPVTdBdf6efpGHa/9u:TtcS1p7tTdvySga/9
TLSH
T11C05022473D549FDED67813DCCA28611EB33B85587A0E79B03B88A651F232C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 99bc021f14ccef41a67f538eddc209e57794bf95ac0113dc75288cd36eb1602b
MD5 46c386b6e9ad7217c61beab20a7b6271
SHA1 f26a1a68a53f5a28813f96663a030ca7c77d54bc
SHA512 7206b1fb3951fb806e63ff9edfb505cdc73a15650c28055c5f7f7fea5a62e95950ea9c66eb171062efc873699e9f93d779e91ddfb5a995b469b250f01c4a591f
SSDEEP 24576:g0Ne/RP0fPxOrMf1XZZdPVTdBdf6efpGHa/9u:gPRP0HoE1p7tTdvySga/9
TLSH
T1FB35AE15F6748335D073C0BAC5D2A69AEE72308257308ACB4296C77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3badfb0b5b8459431f51032000e27207e5d9eba1a4d16bb2d753ad1385b64c7c
MD5 4bd3f687cda9fb78c37240b72c0476ce
SHA1 5aa1c4e56761983532bb0d9efcb865dd738d3e0a
SHA512 25ae7e75b2b15824c58aaf1a77ba8c9045a74930045584183fc6c66dc3e1a228adf134c6c224800c200046d31fa097b40dbcb8b0636b843f1c769be9b7b63213
SSDEEP 24576:v6S/ezSC6vUyD/aqgrvW/6q8wyuFl1XZZdPVTdBdf6efpGHa/9u:f/ezSC6vUzPvuHjyWl1p7tTdvySga/9
TLSH
T1E3755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e733d0834f8216c05a5e6932022bd53edc09850f7a19b50a25ef32cc6800228
MD5 91094c38cca37862b530e97f347c1b7e
SHA1 b02ff3b7265273bd2ff6505681933f90a6bbc85b
SHA512 053fa94eb6f6a544077d365b1b7b4a756cd49b636d0951599b20898f1ca58a7c813daa43b655598da35b7fc1a36be42b167dff2fc8ecd58e8deb04579329f4cd
SSDEEP 24576:BabGPu/Tjv/l+dR1XZZdPVTdBdf6efpGHa/9u:Baz/TjXl+f1p7tTdvySga/9
TLSH
T17B559E65F574C331D073C0BAC5D2AA9AEE3234425B318ACB024AD76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 1d87bfbe7afb371abc0bbd60c4aca2bae2995d97ed07a6ab7f8724f2c04e20e2
MD5 9b7cfef107a57791bbe816b568159123
SHA1 1d47097aa5f96e8ea99f32d8122562772312dd64
SHA512 ad3e3034797e360b0448a202c734035947a928d60011ba4290d3d8a53b139dfbaabb72fd54c1dd835951bcb9453001cdc26aa4a0570e990affd255f674b8429e
SSDEEP 12288:QPFf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3Wni5:QP91XZZdPVTdBdf6efpGHa/9u
TLSH
T1F3D423A1B30AF9ECF729503BDD662FE05B23AF16C5E05EAA063EDB855324181C11F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 8b06a28bb19658004246cc62a2865a9164d74305266ba4be57adb1c87174be5c
MD5 ac9b3e9303e7d7bce6601373514bf979
SHA1 bbd7fd867eacce276e29f633f6ef58ae14b9ee5d
SHA512 77cdb63cc7b0e123723eb756377f5598d3b3be98eb5cfadda39999aeb40fe6d2478bd2366f83e9ea3ba366205973401570d65793887387cedad49bbd810079ab
SSDEEP 12288:neBNUbTVO86Umf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIp:nJIUe1XZZdPVTdBdf6efpGHa/9u
TLSH
T10215CF3BEE28FCD2C27A8C795A918740977274318B61A3CBD179830EDE135D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5f2cc3130e45ed4595ede7b229c4249bf1f1d6b94102f336111062034d19fdc4
MD5 0afdedaa33ca442244d3a7f5fdc37474
SHA1 b79cd48c8a95631417938a1a39858272325bdea8
SHA512 7401e54e5d4d71d4a7711e7ceba476c37c512b6b175fa2751a560575d87c163262dbe506d37bf9b1eddcc89d4741fcd8e6e30e7e370b21bbb782065483042b38
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ69DN5JxNRV3THp:XQvGAdlCEL8c/6RN15CEfdvyS5V
TLSH
T11D367D656BF880F5E1B7E134897A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 2a8000f4b5e5a993f31253d5f886cadc89871c37911b1a493f22044015cc736f
MD5 36e907d96023332e2abd4947a863ace1
SHA1 46e31b28de316ee60585877f83a7713deb49901f
SHA512 07a86c305e4352834b25271169966ef1a840a300decaae6ade927148ed860877a68b2a32dab695c2e0f93b3af0e0a8d9bb2df642b5355e6427d24ec4a477263c
SSDEEP 12288:1wwSfxL/2Dc3bDLLmt0LDQewsAjG6f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj4:KmewsAjh1XZZdPVTdBdf6efpGHa/9u
TLSH
T18C15E031FA75E436C37B0CB65B36D716183D7A204BA11AC3E3AC8E9D55202D2637AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5878844684580bf6a2ffae0eb28d033d2b425eb244b87f780810341c22a7338c
MD5 5a04c0d504221b84d8daf9b8715c6a73
SHA1 5a46f19d4bcc7fe9df582a8ec7243cc58e836b7e
SHA512 313209f3a139cd947165c3d062bdc48cc0245061186019a751359ce2f62e03444724830869abb871c509d5ef68e9b7748f866e6db4a97728f495b1f73ec47bd6
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrLdPlbuJHGlvtf:xUEtQevvqc2W1cpV2Xr52q
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 13da3980fb602195f2dd19a297e3e6a7b1531cd35f81163928622880fcb38909
MD5 84b7eb330c5f85a7ba7b9993e601bee0
SHA1 218ca7583767f30188b3c118b0a5cc0b7c8cd3cd
SHA512 e0f1a755357a5e713064bcfe66e33ba178264110bf69e82c595f78e17b61e5a8a67fe74bd01ace5796bf18432a0a8173c0614775df999718135dba3e2ad6ecde
SSDEEP 49152:bRbRquA/m2yL5zMfFiV+XenmE3/zk1p7tTdvySga/9:Voq1VjnmPfdvyS5V
TLSH
T11DD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1db640745929fb13fd6c8d7c38c47b53794a1b71402e0f85b64f41ecdbf5aca2
MD5 7f9a338a780840936257871d427a8d82
SHA1 7bf1051dd77a8b09a3081b717b069384c3001d75
SHA512 9d8ff0c6ef6f4d8b7ee1f54f61e3bc37ab8607582dad2e85ea3b1643b5afe5b4972d95bc80cc4c7c2be67e4a0d0d99b01b0e52a6b37471c756efd40fa1d43687
SSDEEP 24576:BAhGLvmFoiwtA5l7S53c1XZZdPVTdBdf6efpGHa/9u:BAM6Foiq5M1p7tTdvySga/9
TLSH
T15C45AD80E7F955D4F5B3AA789DB69570EA76BCA65E31C20F2164C21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 773cd88e4fb025fb84d95d4a0cac92b8f0e2eea5eb6df43e7435f5db23f203e2
MD5 d53021c9713842ffedcc76fb3e77597d
SHA1 c9a7ad889b39b32c090bd8158cc612c7d2c064ca
SHA512 dd548d2066d14e3f93928fcbb13e9a710e01e1c1d2493b0c0f1a2fbf8ac2002dd2403845a0f50147ad536d98d76a0b6b0de813c9aaeda7e8337ce8bdd6e2a853
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+COf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezN1:Owu+OWH1XZZdPVTdBdf6efpGHa/9u
TLSH
T18205F14573A55CFDEA67813AC9578636F7B3B8022A21CB1F0364C75B5F23251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 7ab22b20bbbbfd4f474d21f0d7f5d0a54d4db8fe7d77804793b06669ea4dc575
MD5 3877f6904e80936cd7afa85a2f389465
SHA1 330de73b88cd5cde8921654a5571e4cdad4110a5
SHA512 7700f9cb197a5f74639c1d34b9ac3c3abba8c0e61ff5883a6c33fd7c34bf5593a1c1d95f294ade53eccf70f0d6b9f8939f45b1c75a34e1a34e095f3eee0897b5
SSDEEP 12288:Nw/1Iejf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+D:2/u01XZZdPVTdBdf6efpGHa/9u
TLSH
T1EFE412953398B0F9E266513ECDA11B85D7727523A37143CF062E87A52F226C29D3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fff90f4c306ad0fb7d7712b5fcf61eb6bd3219b97d449217950f0e61ef91c9fb
MD5 f7cfae7c637bd627b97f978ee2cdb658
SHA1 207f4ac3c475610766f897c14df44433cbb202ce
SHA512 d0b081d3043e9b5f1b2b23d2720e82bd2157201832772052aed70229874f5cf1b118c5338ffa7e5fcd6a22e6cc39379d4eb2eca8ab4f0ef89ee49c5b57a20177
SSDEEP 98304:XQRQyi36YOcP8Lvw2gAf+PN3zfdvyS5V:GQyiKa+X+PNjlvtf
TLSH
T1D4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c907d64b0804b49ad60c6de7f10a54b4b8fe231c6b825cfc55ba49a8b8329eb
MD5 6cb96429acee518f9c1b44e17ee166cf
SHA1 2c650903d98f4f4c753298a3ce0c5cc4ccd51acc
SHA512 188c80c7ddfb7078ac1597125d5fbc66b16740f4afb81ee755825f7d823dc17bc49f0fb8415dceb65ef93c59928c5cae960a44d00bca9ff5611cd325aedb97e9
SSDEEP 98304:XQRQyi36YOcP8Lvw2gAf+PN31fdvyS5V:GQyiKa+X+PNllvtf
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 429a72a702235855ceb890967e80d3be92731916f4c9fd7fae35a2c314feee6a
MD5 c6ed92c6b7590bf41569628bd566dcef
SHA1 96a81bf5f40b51f70234642fa018492863101f94
SHA512 1cd0c42f0b6d01852c8b3b65b71f397321ee89c4b71d95ebf1537b5c3f4cdf5fa77a416831c593288ab680ac95e990ff790c24ef655105d29416c072f6db1c21
SSDEEP 49152:168Qg55nhMeWu7PNU3/w1p7tTdvySga/9:DthbRc/wfdvyS5V
TLSH
T18CB55933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 46313f6e094296f4c2d15525ff92aad2e9f82541c027296a38942302dc54eda5
MD5 7b6e96ea3cda05fcaadfc4a0e8b5ea58
SHA1 af669daa04307c46f094d87abe32677f97286d2b
SHA512 20314718b4f070f29727d469b3aaf632b81edd707383d92ce1c86fe4229093cd7f4961ce6074ccd414435db4426f0ef5583adf5d9f01815468abcb804117259f
SSDEEP 98304:Gy5112gYy5azzVv569nLKnhZufdvyS5V:3LIHAWh0lvtf
TLSH
T10B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89a400eaae108b949a2d8c2ee27c6075108427c0811526ccbc91cea7d0b0efa1
MD5 69ce31cf5a1d8aa72de0fa015a516efa
SHA1 2d6573488284c719862ff1ac530f6cadb56fc7a3
SHA512 440a47730d4c1ca018ef5f99a8121fd7c4175d0d5eb81b7ce1c1ba4a62d1a16f45f7792c7f54ec5ab284e2d0b4d824f07c67b970d62b9d5e4b205fbb3ff0d578
SSDEEP 49152:XB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glS1p7tTdvySga/9:5u6JmTxd2dKfdvyS5V
TLSH
T15AD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0549b29c5340c2e3f665cc6bfaff6ed8c90fff603e2ebd19f538501d42657eb0
MD5 98cfa717b2ef9febde358cc6085d4925
SHA1 271e09e9c5305e8165ffe26ac22a8f1ad7d66ee3
SHA512 20ba254146e4c93c48591ff13ae963ec2d493fdd2307b9a39c1e38d3b6072119f5fcaffa50510e7cdd346502ea6d0a693d25505a3c2004f3351e86c6433ef4e0
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xr1p7tTdvySga/9:kmifPbRQfdvyS5V
TLSH
T13AB5BE13F2D900E8D06DD17987569632EA62BC460B30B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 11c6af9a794c9bf7ce62d56358ca358ea8b59e8ecbf6182c7068a4772276f7c4
MD5 93f999fcc58b0578a17da0260688c072
SHA1 89181355ed061ef9ac0b0f14e757a952eab7404e
SHA512 efc16e90db15b24852675fcaa44536fd9b1dec8570ae4c0560282ce65fdfd101930e54fc01f8e67048d8131d0ffd3bd015699166a7926e06894fece96296ec0e
SSDEEP 49152:9SuZQIY0Be2K6RVtOnks6NMHqD1p7tTdvySga/9:T5dKoi61hfdvyS5V
TLSH
T112C5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9363f518620c9d94d78840aa6766cdbc72a7d70daa1a7bcf60dd7115b12e379d
MD5 8bc53722d0a06d33157fb9d9fe1fc58e
SHA1 5cf5249e80dedc2ba209bdce724e4ef99b632a08
SHA512 c9affa5da72c6d3ab63dfb6de846b5a49ff5740a083eec7cbe65ba44c20633505700a0a7d8c24fb606bbf5fd3a4d38030778171ae0699037ca9940f6789642f8
SSDEEP 49152:mhtSn8EApI0figTgiDn0AP5wj1p7tTdvySga/9:nX2iyphkfdvyS5V
TLSH
T127A5BF13F2D940E8D05DD079C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ab37561767b65879e39ed10d4c90e8f35fec199902146c5f04170c70af28ffd5
MD5 d01974015f25ec7b3a4c1f46d1331424
SHA1 1e7645ba90bebe546fb5d28b7ab8e76acdcc7c66
SHA512 b30c2813c5fe564fd1b0f60a9a5b67720531291f464d28104ad69e6b8b22f26a2f4cadaf637ca50d1c39bb3378bc8445d56e79d4fcdf116116ba33ba88231d1d
SSDEEP 24576:Gbwvtk9RX6wkyAI61XZZdPVTdBdf6efpGHa/9u:nMnYI61p7tTdvySga/9
TLSH
T1FE35DF29EBDC44E5E177913D89B3460AF6B178295B31C6CF029A53AD0E33ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 79c92d53e57f771a5cbd1fd98581487af0803893cefec94d4bb07f4609e3e3f0
MD5 c89e326de083d8208a57a88642457a5f
SHA1 aa456fd0af0f75237eee5f7c876346c254c25054
SHA512 4f3ae8c50cb9dbe4ab63064d8abfe9ff8b00833ede7e1d604fa7dc609ae8f5b2e2d0b2bb87769f2d18937a53b939b8840519ba8d4ad0c70badb9f39e86d05fa2
SSDEEP 49152:KYbKNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK021p7tTdvySgaV:qySzPGfdvyS5V
TLSH
T157066C96A16841D9C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 aa402759eb54f724914b67d3b1e7335e6a568bd55bed97b66da5873a64fd5b2a
MD5 ed3c79247f48f1bbc6e7ebc0c918981a
SHA1 0c89ff517910a7bb5b93a7720bfbb11aa791240f
SHA512 5dfd5be93620bf8664b350909e0ecc82ba7e8405889eb63ff6f23184866ae45200f281f15ff54d607445af73b4c959a6369ba9a2153bf6c97d50acaee95a6746
SSDEEP 24576:6eS7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYj1XZZdPVTdBdf6efpGHa/9u:lS7JUQjXirIhCnDHUPfF/h1p7tTdvySf
TLSH
T15865AE1DA3EC01E5E1BA927885154A5AEA71742E5F31CACF1270837D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 f79289fcbdd8381e43cc25f727a9b6cb04339ae390491c7198cd95fcab216be7
MD5 81955b728606acd779a6b14615496b49
SHA1 313150a8ca4982391e6c4be9b5b1a3d75b48995b
SHA512 db4edfdc29177897ac2d89c88f339259e099c131843468efb0d54932119eee7cd34b783dc2502150892c767062798a04f764046437497a4e0ac749a63462b97b
SSDEEP 12288:VisfCG/f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+D:7Z1XZZdPVTdBdf6efpGHa/9u
TLSH
T142F4F115E25852E8D16E613ACB521A80B7337D2683E1D3CB53D8F63E1F752809DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 824B
SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
MD5 730cdc49a49dc278867956cc11e8fad3
SHA1 4cf2bf16c29ae4538ba552700533463575edde28
SHA512 d9b58266132179c39e62a84ad80f32dd3836310b09c2c7b231137a7c70a6c343994466b0579248878f626fa849b3cea3ccbbe7a10c6967bec922241904f215ee
TLSH
T17C019A831AE91520F1B21F44DFF994735B337CA35C2DC86C90E8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 a7f631c33fee6e7862d9dd08e1c49a8c0fb3075f49f88bc9c3cb1a1e5ba9e9e5
MD5 557ef053bc0146917af4f5d90ec5231d
SHA1 38c5c21e00f2606163143ddab509d4768feaae80
SHA512 256f295ecb818a52353ffd26c0fa293527db4b35b8c16e69e878d4820851f580f18e92c938cbed8fd014bd03461c57fb7bbae9472690fbdcddf326a19dae83c3
TLSH
T16D219A832AE90164F5B35F54EFF994735B323CE22D19C86C80D8124E8CF1A90D5B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\17416\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 371KB
SHA256 2bf545b948f00edc1ac3e17ba5be6688eda22e116e3189adfe66db89dceb8987
MD5 64dd42fc712fe0054d3ac6c5ef3776f5
SHA1 c5c147a8a8b9912bde197a47d8d19477696ff4da
SHA512 36ade41904dcba97a86b98f437d1aef413abdfcc5181dde342552d081ff04f31beb989da3244d249e684eb1d522e14a8a66e138e175b4dcd1d18d917e9746ab3
SSDEEP 3072:rWc+iijqtssE6CHWjbaSjWCgTLinAPdBVUP7rotMxARzLxSv:D+VsBC2naeWCe+nAPd3UP7rotMxABgv
TLSH
T1CC84E8317326EA1AC2A545322F53D0CDEA70BA41ED0ACE1731CE173FC5BA6849FB5652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 192KB
SHA256 6dbbd4b6691556bd1775c9529624f7d396ad0eebc4bc1c09f628a259e939dba7
MD5 3128a86f28936b9740709685a9d2ee29
SHA1 7c2457ff8d7231b6ebdfb6c9347dfbf843add04a
SHA512 744f55ff09d99f67ae32b10339b07b285226df834fe4cd5ba9de5f8ed78482e0c058e7735143f5b0dbb342643234928885a732845c3233edcb972565c5bf38f0
SSDEEP 1536:/qnqijqQtmiijqqTpedK8DKrTm0SijrXg:Cqijq8ZijqqT0dK8DKGtig
TLSH
T17C14E800B376F74FC0B650339739C78EB774EC07BA866B1B3389093DEC59A1559A6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 755135389f183e4085098c66c7cefb54a045463311acbf2ff44bb68899933aa0
MD5 9a47ab1e424aac6e4525f1efce45a3db
SHA1 5037782da3fdd0324d9739239409bbcdae302119
SHA512 f572ab0f2e419f4c2fad563642c32eb60a6fdf8a37ff31c20a9d98bcf096018ef84618ae2a3950a9a114740ef5483b053ef11f80579f20cb0ba14b4499841ad1
TLSH
T190F0DC37A4BB68625A522C6822F45D3524E8A7DF08C39766253C10D087DA3E4E14F15A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 767e0a28b3bcdc3f0a938ad4cbc038532f4f7212698f0f830078b81c7b21818a
MD5 bba743c145c62e4d18130e5342298cb7
SHA1 df83c53eeaae09a72baad0c87ded3d57d2970d5f
SHA512 cb7bb4ceed65a8e4d43200553edea11eb16302d4623fdbf3703055748c6f2bdf22f004c31738f037134ae9884d3a6d663da26493dadb9f68417a90de83073527
TLSH
T1120110106A2DB35225A80D785E8C47E13D65A57A60CF69FF2FBB72C1D980B28A650504
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 fa2f4e31b4cf8150272e8d55982abb4f1c1fe85bd034b89c2e2068684bbe7819
MD5 6b0b7ed1d1b249259e4bf7121c7247ae
SHA1 86e0b70e7f7ac34c28be3bc9386a94b199b47f32
SHA512 b00396150297827da2291f9df46a7d215f267d4de6079684b3d691c67c693cabba43cc6723aa7f0c4f52e05844a4cfa266864890260929e3e84b44ed28000982
TLSH
T1070144572A95BF4174207C55DA9DCAF4373AF1AC2CC30BC8A5C205B555FA34CF14A417
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 0c6b5e9e1ebb60c222c6957ae12db59f01daec4d2fccc74fa60b91ac974ab88a
MD5 4aec2f613c8ea6131d7d8dbdd836e43d
SHA1 fddf90bce76c55bcc44f19a87affad0819bacaba
SHA512 91c025db32069560fc88803c0ac1c4bdad0ae0861551b6bac9a3e9249f90a8ce987de9cfa21a2228bf8ac24eb53947f58a67346dbee9f27b404e8d48bcf959a5
TLSH
T1CBE0D82417FE112EF1B4977443D991D55B26E1126C4556BE5E81181EA92A9104CD2D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 fda0744716cdfca06540bf1f52652af63fdc3219b3b599414b18d6dc5eb9c9d4
MD5 5dd5d3fad42e99ebbfc774b4bafd46a8
SHA1 405f46b171f41438c61717f31448fb6ea589aa5a
SHA512 742a067861b0246d221a5e318dffa73452dc9153cf8f7289b03250340832dc1d667bc5ec3174686bc8a8b3ffe98b404ed4a07e21c9da7c591ee110defba74e14
TLSH
T127E0C63032F84D9EF0B0B8390BF5AA13848AF24AA817C2791A002702EA24B008CE2524
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 514126873ac0359d04a2ec4b8021b4c83975ce5a4d100204cf2513d1d12a6361
MD5 4a37209db274df6f380d6dbcd390343c
SHA1 ba81ce6dce5cf51b7110fe56e5a779c47afb2486
SHA512 7b02ee1d47b80fcfbe16e5c52a47cb0503210a2a9efdb9a3f355957419c54cbba26247366b76b92f1f8db248d06ab10cd85646498515d5c4bf072a71a59d2020
TLSH
T1A5E0C03821EF740FF0609C3147F9A1771E4AF301140097790AC45308B74BE009C20AF5
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 1a88c472a5937923b79d19b1efcb0b2717cec9be910a63ee0a754fa57c3a7e99
MD5 6c6632aebb54ca45fa19ef5b26599805
SHA1 3e590686f903b6632ff36a24db4bbfdbbd8fee49
SHA512 ffada33d1c27e90b85bf565c3b9cdaf9a37cab4e7a362e760e168c27ff4707988379269f83e90e7c038e09a9725d2d17b8f0bf5232d7d03fea1fd7dae2a4dfd2
TLSH
T12A21074BF1298236346E51EDB5172FDC0F4D33270128FAAA7B64095AF29581F8F23638
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 553fffdb5967f68b3b48e5e0576d45e8bcd36b7bee08a17f7bdabf96d1f9b29b
MD5 8d22d0a86c6908e9d75bf24845fa48d3
SHA1 1190531ad03cfada938a35dc7b3baa8ef47e7146
SHA512 8af7eee150e481c88ac2c9274133225ece70353136d97b5c2cc140b141cd10cba6a7f396ed01527953ef5e84a4805eeaa808a4866378b24102c4a53a9c8fe44f
TLSH
T10A31490BF12A8236356950DDF5172FDC0F4D33274124FAAA7B60064AF29581F8F23538
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4C3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4C3F.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4D1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4D1B.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp5420.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5420.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp84BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp84BA.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpFD13.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpFD13.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a878387ad3587c09489b0c999575b2bae65ace4d3fe69e173373cfdf9e6bf2cb
MD5 92269660a9fe5e58391bcc29d3247be6
SHA1 2643f3d373ead44772ad9b5cd801d4b4077fcf2e
SHA512 a352db6f079dffdef577a12260cecde84b73fdd29fb7694c1cf07f6cadc9b9919160861f313e3a204ce78f921772afe7f0ad0dcc1611964c762953dbdcda606e
SSDEEP 12288:cv7Lf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:aj1XZZdPVTdBdf6efpGHa/9u
TLSH
T124D42371B30EF9DDF7385077CD661B602B2BB727DBA085EB561E879463201C1892EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 86a07c537dd8ad58f76bf24b72cc5de0a11adddb7a3d7c36277aacc48b8a47c1
MD5 5cb13d3e2cd930f6fa29d09b77be8733
SHA1 9c3b3e67b4a0c997154c2708911a640254cbdb8b
SHA512 c92365b664482d8fd5e41b33b562c69339c501c5afe78b6db1d503294172ef751c84c4c7de9aad6debae8124966f5c768e77ed9e0a51b62ba3f37872a5b2e241
SSDEEP 24576:FXgb6bmBIi49WNNFpg1rSvFv7bYP1XZZdPVTdBdf6efpGHa/9u:dgb4mBIBhGFe1p7tTdvySga/9
TLSH
T1FA65AE1E22EC02F5E1F9E2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 1c6fd7d19eafea7a893771122339a97aa3802c4e147675c41f0201497532b4af
MD5 70f13113549f1dcad02f05c9b7cf4fa7
SHA1 86a10949eb4da967ec4133c07b34e58f97f78cd1
SHA512 a57347a2713339190b4d391f963f760cdbf2df1904891a16429002f7cbbde91c57df6742d4ee620b4d0f0257e576113d01e17fe5e04ca998d958ba6af01da653
SSDEEP 12288:RkGBf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:CGp1XZZdPVTdBdf6efpGHa/9u
TLSH
T18CE4233532AAF4ECE639C13BCC611BA27A727721D7601AFF05AEC67597141D0A23EE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 99e1bfe9c8ad9b4788b67e15fd499ec52c91a9f16a22957cb50bf75a1588e364
MD5 0c854cbde8d708200b9817b77f9a6d1e
SHA1 b386720df2c0038140b2d021dc9fd28c011a86bc
SHA512 b4deb805e9971385bf41242b4abfff0cb2b658054cafa25f01a430796da2f3996134c3936ec0de8a63b325fff1b6ecd2e734a54ba7f102a58cdf04ac018cbd84
SSDEEP 12288:09f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WniPh:0V1XZZdPVTdBdf6efpGHa/9u
TLSH
T13DD423A0720AF9EDF724507BCD622FA05B22A727D7F11AEB466EC75193541C2813FB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 df90ed5ec960cd9e0eb453cb465c1d13f346e94551ca5171f5704c1f0cee77b6
MD5 796ac74deb1dbb2c820eae6ef8e6f8cb
SHA1 8dc9e970a43acfcbbe3b8acacd66a4845ebb8a6f
SHA512 29e93e1d906f069e24603b56fc29094f3e54b032dd4c55eac7259359d11bcec11cb939e91cfceb5e32a5caa92b0e844456a14630fe2da77ab63f58cb2443b7f8
SSDEEP 24576:XDbA8u8FpJqH1Wzria7/mo1XZZdPVTdBdf6efpGHa/9u:TbZFPqVha7/B1p7tTdvySga/9
TLSH
T19A35F16576E101F4D47BD139CA824AA3F6B2B4260364EBDF07AC8B511F236D54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 c11354ccdf4c29f2185b3737d9a9c494dea6127d899a2cd4212dab1896b2d066
MD5 5ed56bc836e6da769fcb39fbe078ecab
SHA1 daf8e6719205ab3a24d9a96b6c0bfb81a401a825
SHA512 dd30cb16cb8cf5d1d6e65a674c65f2b4037c3f1cc7539bb93c884d24be33d279cc99a7ee313a13320823191c9b14056f41a317f7b32d19bab33ed1a202d11040
SSDEEP 12288:MHvUrBFrEjwaQTf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwQ:MPUr+NQL1XZZdPVTdBdf6efpGHa/9u
TLSH
T15D05F12F32AD18E9F676E17DC9424719F772B462031192DF02A5817E4B639D8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0c6d8f982d5560750fb0b1a7c9af4a731cfe7901d59b354916f46f7f80df4c6e
MD5 bdad29a4ce362b1dd65f5b3aa77dcb3a
SHA1 63931788d3896824ae7d0eca61fa149e5f4e9ad8
SHA512 29e7473c980a4becffe3cb6a59e885ada54ab5481cd3d1027147d7f17ab35bf519957ee7e09085c4d526d15f824d249a5a2f33bd3136fe5cacf442fe9eedaec5
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc1p7tTdvySga/9:RG05lO43bxfdvyS5V
TLSH
T193D5CF6A62EC11F9D1BBD07CDAC64A0BEBB23425033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 57b5d86eef11781c67f9d11ad790bbc88a67eca8b6024ba28b417d51a0babbf2
MD5 c130e7e7790e206acf36f8fbc17b3641
SHA1 9f6b6fe07970074237e66f5bc3ab3966b5711938
SHA512 23dfaaab30ca217f81817ba7aa8d472bf8539717fe57766b8b620e0ec38426ee1b558591cbbe00246ea9ef35edae5d9894e6206b332d16fcf3fdfc86c4911022
SSDEEP 24576:jC3a5POZ3dpbWVM50JicR2hG0lasx2+47eidnH1XZZdPVTdBdf6efpGHa/9u:2a5POZ3wJt2pasx2+mF1p7tTdvySga/9
TLSH
T1D865BF5EA6FC01D5E579D17DC5834A1AE5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4391bd0a6b4ab27af56db4f16d31251fa3440a99750db423017059bdb7cd8acd
MD5 75c111a497a3ea561f528d0b16a0b09f
SHA1 70ac7415779d49660a97505c24b2011f6cc174c9
SHA512 7384210c414e83ee208fa0d492f3bc543e1526128fd47201d235aa3728d1c56f8a3e0b03c4acfadab37980d716b1dcfd9a207c6ebbb1c77ffc8f11712c4278f1
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fkv1XZZdPVTdBdf6efpGHa/9u:kNc/zEOVHFW1p7tTdvySga/9
TLSH
T157858C2623E901E4F1BBE1BE89779646FA71786553308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 4f516e174252fc6c4f46a26206ef1a4e576e4a8b86d7fa82d0ff5e92e8eb381b
MD5 54f6c9ae9fb109d6b119c941fda48ed5
SHA1 c0c9bd592719c6eec28d205f40bc752cbdff0e5d
SHA512 b4014ba920c1d0f574c9223c035f31b77c60dea887db3e8d2ff2c26aea8c6cf850b80bcfde99be5a6d4a966053a4bd4594049995d4597d62bc81efc3b601fe3d
SSDEEP 24576:BNJnJPbzB4SM1XZZdPVTdBdf6efpGHa/9u:zJnJv6SM1p7tTdvySga/9
TLSH
T1D915D03DD2A810E8E4B7C2B5815A1B59FF31387D2B2169DB19B8D5343F12ED0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0b3eed68adeb6b1f311991898c2673c26649e5916611237a7632309f76f215f8
MD5 a7a96f41f35a0f2f9c66f68c8afe7d26
SHA1 5f1bd917463f0b701318c7c6afb610572d0d4bd3
SHA512 1bdda5ee51255eab6ddcb46216e7d78893ff04519e29fff7f9bc67352212b9b22e8d05ac7e4acec9f52790254a4a6ec101e4d03a178d653b4d117b525c105a40
SSDEEP 49152:jCLHGeeV5ijCmlDWDkk1p7tTdvySga/9:+6fdvyS5V
TLSH
T153A56C05B7EB5184F8F3CAF5C92294169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 d1b998a8863d6cc0aec5b348f5b29119ac815b1bcc9f2da0c53c388e9057d64a
MD5 81870faa4eb506c8a605be6392bde3a7
SHA1 6ef7e207e9d0e8dda2893c19fa8f213ef94ae323
SHA512 6aa0615df4928dd2f3e2c72d7d873b75d2813f02d1fbf2fe990e6b4142d512745ed42226d61a5863b18ded5adc588163f5861ab809025011722acebe845e730c
SSDEEP 12288:H+1Hck6j5ZI7gQf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwQ:HS6DIR1XZZdPVTdBdf6efpGHa/9u
TLSH
T195F4015C337A60F9D16BD03EC6830641D2B2B171C7625ADF06A8C5B95BA3EC8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 caefdf7106c603f53f99b5836f2809929b0b4fca50504a3d81f6b99fd710a6a9
MD5 f90feafe559003fa28eb48ed0e1ef4fe
SHA1 5eedf92de05158ae791acfda4b4a74f34fc6b2c1
SHA512 2562ff888fe113b715bbc9a0b53179bc8a8eb6659f7cf8089d885078e6250b149dc5197ce21f98a0750c0a8c7c50f6953e49de4ed7241f3c87c69e419f1cdd85
SSDEEP 12288:eG6kySf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3z:3tyK1XZZdPVTdBdf6efpGHa/9u
TLSH
T1E3F412007398B4D8F779013ACE6307A09F36BD219B6157EF12A9D72E2B357C0A939B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 0e0f402533dc6d9611d98b3977e7a0597a5717c9edbcfff2c11d52a0b5126712
MD5 70be65a33265e998d21e5deb79509e08
SHA1 bb5e8726cc7fd5277ffa6f466e734bf3959e0fab
SHA512 2ad996b71ac701a5ce3ba56126bb2d96b455c3b0b65757763596cc0cdba48506094fab4c9efad97cb226e7079c9d1949eb10711818f5bd1b0172198c07a53dc1
SSDEEP 12288:oNM7f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:ouz1XZZdPVTdBdf6efpGHa/9u
TLSH
T167D423A0721AF9ECEB24A07BCD621B905722B33697B119FF45AECB7183141C1813EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8ed0a64fe6044bdc7493c3af88cd667cac47ddee45b5de5f9d9c2198dc55dbc8
MD5 2bd8506b81a0d2e8264a3c5374982616
SHA1 b48bc23fb8442e6ae4bf9b7d71ebad8311a251d8
SHA512 36523e7b5eac74bcd61546a40c58cf9f08748e7cdfea69a08fd59ef372158e93c8ec47815aff6ddf453fab1cd5f13c5734fc082c75ac8aae03ac10b2da5d491e
SSDEEP 24576:bugVLoTfaidZ71XZZdPVTdBdf6efpGHa/9u:KgaTrZ71p7tTdvySga/9
TLSH
T104558D1D73EA05CAE2B2D279D8721493D633B4315772D6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 38be02ebe3e06df90990a9b24cb63938e8b8258e48e30ec2e27a16daf0ea9c60
MD5 e59464349627d16781125da8c993e9d7
SHA1 05b055c1d58d4d831d466a97fdeabc4b0514fa0d
SHA512 f729f6d2a2587ba9c1099c2b8ddc36c47165f61f9b72e0fc04d7691c99daed50dddf6bd830a83ece77e0b8b0d0c83a4ffcf3e74c899415ecf74c3bc1dc718427
SSDEEP 12288:m+pJcm8CNtf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9V:m+rcmRl1XZZdPVTdBdf6efpGHa/9u
TLSH
T1AF05F05AB36E00E9E277813DCC420655E7B3B031636267DF02A9C77E4A279D9BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fa448b55cdee5f910209a9b90e389db64c679ac8dbc65347a9689985f0f9ef92
MD5 7ed15b342942eabb0f0265e9ca5d0034
SHA1 23e656949aa731945f7d426d45459eb21c03dc2e
SHA512 2fedec7a7c089b114693d6c5c09fcbf3a3d395d182b88113deddf1bcde6c4f25df24602724abb6ca709203c1761a7c0685c379f721ce842006a006034e34ecf6
SSDEEP 49152:eDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3X1p7tTdvySga/9:/3Upow8sBQfdvyS5V
TLSH
T156A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 37fba6689d02270c6a6065e47f8417c7af7a9eeae0280febc3798a7ab313613a
MD5 102909927e3206469e73c781690d2a14
SHA1 724853d54636d0ddab0330f7a163aeb8819ab821
SHA512 6eed15f48428cf407127bd8aba1248dfe558d075862825c273c59665303aaf59bb7f29dcb506da79562e21298bc074339bdba5fce80b9509f400797e45d2ccd9
SSDEEP 24576:1sTkNvNnaFeYhJNtmZBmR1XZZdPVTdBdf6efpGHa/9u:GTMwBtOmR1p7tTdvySga/9
TLSH
T13B55BF6EB6B846E4D1FEC6B5CD238512EA727461073293CB5394C13E0E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 6a3d3c95ebc36c6c7ae77bee0b51857eb0f5e4f027cb51d96a5d558f5afa0634
MD5 3cf8c8f3e1878ea46b81619828b4c794
SHA1 997fef22e7dcc47904e319b30b441502b3f768ac
SHA512 6401dfb3b9a59c3df2d26b877dc5beb5b11bedfdb1817397861ac526a06fe442b8720d2f9c0dd8584390f80bc9aaa7e0d3e3ae2c396a3966b1915cbabfdc6790
SSDEEP 24576:wYD3FHshBIYQgA61XZZdPVTdBdf6efpGHa/9u:xDVHeBIAA61p7tTdvySga/9
TLSH
T12B25E13DE65C04E4E57AD1BDCA634A06E77238A9033256DB0294C1B61F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 77a56c674270c5688d39b0d1522ec8ebc42a45436726521a2f0cbecb98f3a686
MD5 68e118dfbc0c4f3146b7f18cfadcbf94
SHA1 c1013d515df140ed8a4ad082fd0f864012709998
SHA512 dea28b919d2bdf9859adcdf3f3b83af956a676690c27eb105c6e038600fa920e0f48901db394a6e72d03137a4c2a4132021d79080f40a9c0853a76fe138b6577
SSDEEP 12288:0DyS6b3IkxjbBzUif1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRw:0R6UqjpU61XZZdPVTdBdf6efpGHa/9u
TLSH
T146F412597388B4E8F6394135DD6243658672BA3253B15AEF22EDC67A8731AC0853FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/496-327-0x00007FF60C350000-0x00007FF60C820000-memory.dmp

Download

memory/496-275-0x00007FF60C350000-0x00007FF60C820000-memory.dmp

Download

memory/496-276-0x0000024B33EF0000-0x0000024B33F56000-memory.dmp

Download

memory/496-277-0x0000024B33EF0000-0x0000024B33F56000-memory.dmp

Download

memory/756-318-0x000001D1158A0000-0x000001D115906000-memory.dmp

Download

memory/756-218-0x00007FF6DF070000-0x00007FF6DF486000-memory.dmp

Download

memory/756-291-0x00007FF6DF070000-0x00007FF6DF486000-memory.dmp

Download

memory/756-219-0x000001D1158A0000-0x000001D115906000-memory.dmp

Download

memory/756-320-0x00007FF6DF070000-0x00007FF6DF486000-memory.dmp

Download

memory/756-220-0x000001D1158A0000-0x000001D115906000-memory.dmp

Download

memory/808-154-0x00007FF7C17F0000-0x00007FF7C1957000-memory.dmp

Download

memory/808-146-0x000001AA44050000-0x000001AA440B6000-memory.dmp

Download

memory/808-152-0x000001AA44050000-0x000001AA440B6000-memory.dmp

Download

memory/808-145-0x00007FF7C17F0000-0x00007FF7C1957000-memory.dmp

Download

memory/808-147-0x000001AA44050000-0x000001AA440B6000-memory.dmp

Download

memory/1116-248-0x000002ACD49D0000-0x000002ACD4A36000-memory.dmp

Download

memory/1116-306-0x00007FF608770000-0x00007FF608904000-memory.dmp

Download

memory/1116-246-0x00007FF608770000-0x00007FF608904000-memory.dmp

Download

memory/1116-247-0x000002ACD49D0000-0x000002ACD4A36000-memory.dmp

Download

memory/1488-266-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1488-188-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/1488-194-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/1488-193-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1720-267-0x000002EC25940000-0x000002EC259A6000-memory.dmp

Download

memory/1720-268-0x000002EC25940000-0x000002EC259A6000-memory.dmp

Download

memory/1720-272-0x00007FF7F40E0000-0x00007FF7F436A000-memory.dmp

Download

memory/1720-323-0x00007FF7F40E0000-0x00007FF7F436A000-memory.dmp

Download

memory/2288-170-0x0000014A2EE70000-0x0000014A2EF6E000-memory.dmp

Download

memory/2288-172-0x0000014A2F090000-0x0000014A2F0F6000-memory.dmp

Download

memory/2288-171-0x0000014A2F090000-0x0000014A2F0F6000-memory.dmp

Download

memory/2600-296-0x00007FF688DF0000-0x00007FF688F1E000-memory.dmp

Download

memory/2600-333-0x00007FF688DF0000-0x00007FF688F1E000-memory.dmp

Download

memory/2600-297-0x0000020FE7F00000-0x0000020FE7F66000-memory.dmp

Download

memory/2600-298-0x0000020FE7F00000-0x0000020FE7F66000-memory.dmp

Download

memory/2996-16-0x0000027A01530000-0x0000027A01596000-memory.dmp

Download

memory/2996-17-0x0000027A01530000-0x0000027A01596000-memory.dmp

Download

memory/2996-15-0x00007FF6AFA50000-0x00007FF6AFB72000-memory.dmp

Download

memory/2996-18-0x0000027A01530000-0x0000027A01596000-memory.dmp

Download

memory/2996-157-0x00007FF6AFA50000-0x00007FF6AFB72000-memory.dmp

Download

memory/3256-0-0x0000000002B00000-0x0000000002B69000-memory.dmp

Download

memory/3256-5-0x00000000028E0000-0x0000000002A1B000-memory.dmp

Download

memory/3256-7-0x0000000002B00000-0x0000000002B69000-memory.dmp

Download

memory/3256-6-0x0000000002B00000-0x0000000002B69000-memory.dmp

Download

memory/3324-180-0x0000019DEA6B0000-0x0000019DEA716000-memory.dmp

Download

memory/3324-254-0x00007FF6CAA30000-0x00007FF6CAB79000-memory.dmp

Download

memory/3324-178-0x00007FF6CAA30000-0x00007FF6CAB79000-memory.dmp

Download

memory/3324-181-0x0000019DEA6B0000-0x0000019DEA716000-memory.dmp

Download

memory/3840-307-0x00007FF756EA0000-0x00007FF7571DE000-memory.dmp

Download

memory/3840-309-0x0000025580F90000-0x0000025580FF6000-memory.dmp

Download

memory/3840-308-0x0000025580F90000-0x0000025580FF6000-memory.dmp

Download

memory/3840-334-0x00007FF756EA0000-0x00007FF7571DE000-memory.dmp

Download

memory/3876-139-0x000001C578120000-0x000001C578186000-memory.dmp

Download

memory/3876-137-0x000001C576F00000-0x000001C576FFE000-memory.dmp

Download

memory/3876-138-0x000001C578120000-0x000001C578186000-memory.dmp

Download

memory/4516-35-0x00007FF661890000-0x00007FF661958000-memory.dmp

Download

memory/4516-36-0x000002B9F8370000-0x000002B9F83D6000-memory.dmp

Download

memory/4516-37-0x000002B9F8370000-0x000002B9F83D6000-memory.dmp

Download

memory/4516-38-0x000002B9F8370000-0x000002B9F83D6000-memory.dmp

Download

memory/4516-200-0x00007FF661890000-0x00007FF661958000-memory.dmp

Download

memory/4528-158-0x00007FF77C2F0000-0x00007FF77C409000-memory.dmp

Download

memory/4528-159-0x0000028EB6730000-0x0000028EB6796000-memory.dmp

Download

memory/4528-160-0x0000028EB6730000-0x0000028EB6796000-memory.dmp

Download

memory/4528-245-0x00007FF77C2F0000-0x00007FF77C409000-memory.dmp

Download

memory/4544-209-0x00007FF7FBE70000-0x00007FF7FBF1D000-memory.dmp

Download

memory/4544-284-0x00007FF7FBE70000-0x00007FF7FBF1D000-memory.dmp

Download

memory/4544-211-0x000002626CAD0000-0x000002626CB36000-memory.dmp

Download

memory/4544-210-0x000002626CAD0000-0x000002626CB36000-memory.dmp

Download

memory/4580-27-0x000001F16CB90000-0x000001F16CBF6000-memory.dmp

Download

memory/4580-26-0x00007FF661890000-0x00007FF661958000-memory.dmp

Download

memory/4580-187-0x00007FF661890000-0x00007FF661958000-memory.dmp

Download

memory/4580-29-0x000001F16CB90000-0x000001F16CBF6000-memory.dmp

Download

memory/4580-28-0x000001F16CB90000-0x000001F16CBF6000-memory.dmp

Download

memory/4820-285-0x00007FF73DB50000-0x00007FF73E056000-memory.dmp

Download

memory/4820-287-0x000002A60AF40000-0x000002A60AFA6000-memory.dmp

Download

memory/4820-330-0x00007FF73DB50000-0x00007FF73E056000-memory.dmp

Download

memory/4820-286-0x000002A60AF40000-0x000002A60AFA6000-memory.dmp

Download

memory/5100-261-0x0000023798660000-0x00000237986C6000-memory.dmp

Download

memory/5100-260-0x00007FF655480000-0x00007FF6557A0000-memory.dmp

Download

memory/5100-255-0x0000023798660000-0x00000237986C6000-memory.dmp

Download

memory/5100-256-0x0000023798660000-0x00000237986C6000-memory.dmp

Download

memory/5100-263-0x00007FF655480000-0x00007FF6557A0000-memory.dmp

Download

memory/5700-236-0x00007FF67AD60000-0x00007FF67B002000-memory.dmp

Download

memory/5700-303-0x00007FF67AD60000-0x00007FF67B002000-memory.dmp

Download

memory/5700-239-0x0000017C6DA60000-0x0000017C6DAC6000-memory.dmp

Download

memory/5700-238-0x0000017C6DA60000-0x0000017C6DAC6000-memory.dmp

Download

memory/5720-229-0x0000023AD4CB0000-0x0000023AD4D16000-memory.dmp

Download

memory/5720-295-0x00007FF7C8460000-0x00007FF7C8513000-memory.dmp

Download

memory/5720-230-0x0000023AD4CB0000-0x0000023AD4D16000-memory.dmp

Download

memory/5720-228-0x00007FF7C8460000-0x00007FF7C8513000-memory.dmp

Download

memory/5888-129-0x00000202DD680000-0x00000202DD77E000-memory.dmp

Download

memory/5888-130-0x00000202DD850000-0x00000202DD8B6000-memory.dmp

Download

memory/5888-131-0x00000202DD850000-0x00000202DD8B6000-memory.dmp

Download

memory/5896-357-0x0000015B803D0000-0x0000015B80436000-memory.dmp

Download

memory/5896-359-0x00007FF679420000-0x00007FF679B63000-memory.dmp

Download

memory/5896-202-0x00007FF679420000-0x00007FF679B63000-memory.dmp

Download

memory/5896-201-0x0000015B803D0000-0x0000015B80436000-memory.dmp

Download

memory/5896-203-0x0000015B803D0000-0x0000015B80436000-memory.dmp

Download

memory/5896-281-0x00007FF679420000-0x00007FF679B63000-memory.dmp

Download