205c9698eb8fe66af42d61d3c13ba741d56b95b8fd2236b7c3406f346bd835e4

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
Size 2.9MB
Sample260930-cegahacc53
SHA256 205c9698eb8fe66af42d61d3c13ba741d56b95b8fd2236b7c3406f346bd835e4
MD5 47ca5a1980b8d0dfd355f784d7c92920
SHA1 6b09bb1d25506164aa5bf805793192588918ac65
SHA512 ad755ee7b8175903ee11d2d7eeef14133c3005fcdf2905d3992650cf68f18aa434e382ad94976bbcb326cef683299f6b918ab659a904bd0411a9345c0fc60026
SSDEEP 49152:nuIIKTofs2hPd2l177BTK2VbDsar1YDjuuij3:njOfs2hPIl1/Oij
TLSH
T118E5BF00FB46D1F2ED4762B448FBA71E462996F443101AD3E3581E1F1EA6AD37D3A18E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3964	elevation_service.exe
4872	elevation_service.exe
6020	maintenanceservice.exe
4504	OSE.EXE
2376	PerceptionSimulationService.exe
4752	perfhost.exe
5872	ReFsDedupSvc.exe
5556	SensorDataService.exe
2432	ssh-agent.exe
5756	AgentService.exe
820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9188dc2f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4976	2564	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c770c7987f50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f2ff2987f50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076005c557f50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d637c557f50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e395557f50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2564	2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
Token: SeTakeOwnershipPrivilege	3964	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5756	AgentService.exe
Token: 33	820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	820	SearchIndexer.exe
Token: SeBackupPrivilege	5872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5872	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3964	elevation_service.exe
Token: SeDebugPrivilege	4872	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2488	820	SearchIndexer.exe	103
PID 820 wrote to memory of 2800	820	SearchIndexer.exe	104
PID 820 wrote to memory of 2872	820	SearchIndexer.exe	105
PID 820 wrote to memory of 752	820	SearchIndexer.exe	106
PID 820 wrote to memory of 5340	820	SearchIndexer.exe	108
PID 820 wrote to memory of 3264	820	SearchIndexer.exe	109
PID 820 wrote to memory of 4152	820	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_47ca5a1980b8d0dfd355f784d7c92920_darkgate_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 916
  2⤵
  - Program crash
  PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2564 -ip 2564
1⤵
PID:5216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6020

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 72dfef2418f3bbc696e5b8c51d9b4933a0fae8b70b408624214b1019edd7f998
MD5 bffabc34edf019729764d20daf4d2294
SHA1 c709440cff672c991f9287792d61fc929129482f
SHA512 7dd058f8d67446bed7135791b2e0ea8e0227c4774a180c1bf4e99239a659b0c42a79cedc3bd1b7b892766e726984e23ba88a55aaeb1b616181643d941f89df23
SSDEEP 49152:Eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEuij3:+3q6sjBeij
TLSH
T147D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3a2a7a66dbc1de2bd08c4d152a000d6ab47b2b134ec515ee0a88b2b9c8071859
MD5 7600ed418f94f110b2a4df0692aa2aca
SHA1 c629fae86483b25881f766713900ce5f7453737d
SHA512 ebb7c9523a2b85f84e707a1bbe1a55ca5fe540f090a832ccedede2d52ef535cd07fb1d701f239136107fc27c973d658b3326d69ebc6a58731969ae469aaa0eed
SSDEEP 12288:S1XLsswWkxy2lRq2czAJ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:4XYfDtczAPjukUenjhVjV
TLSH
T1D085F12873E408F9ED67827CC8B2C911E633BC554760E79B03A496651F372D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b1ca04f58ff5c52e6e1259ae875298327d27433b2b3ffe62e3f84767e5af9b3a
MD5 841b64f6e3bab6fdf60a1df883309bc6
SHA1 4ab760a8bd9e059c9c95008da9bbc1578f8cf46c
SHA512 0f10c1c7d2ba1f51f02e759d7c8f826a9ee32f4bf6c183a4c64d1dd72d30ba0c61f973657ef5054ffb54f715a270d7432771cf011b8089da93d60027ea0e6e5e
SSDEEP 12288:yXZNYVLeyUji0h90ZD0wxpGZIVuBrHs15Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:20Le5ji0hmxSrMzjukUenjhVjV
TLSH
T1B7A59E15F6748331D073C0B9C5D2A69EE97230865B308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afe94db59678173e94a454fa625a848f1a2cc9e63a1631fb66722e3d8805fa07
MD5 90200ebaa37dcfcad549a5db8c624aed
SHA1 40757db7c0fdd01826c5253968925fae17fd851f
SHA512 9f5dc3fade2a23f54242e6e096c2a12669ba749db08c9fdd089fbcbb159584b56f43bbed7eaca11e6968d796f32d680d79f974f77742d9c3ad2a2696dae16bfd
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyu1jukUenjhVjV:A/ezSC6vUzPveHjyauij3
TLSH
T113755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 178092c793775cbdf4f197c6c6deceeabe3c591a945dc5850ddceb1333e6557c
MD5 9656605c58e14289a4667f35bc0f06b9
SHA1 e085e1377b269c7a39804d6ad43bb1328b1a8c27
SHA512 5c91dfa2eeb677bce63e8fc466c6320c6cc931e7e591ae6baeaabc2b40ac9d6332ec355bde87c56cc450e0bbb2eac4d786d2c2e5d78e44ccde37216ad29e0493
SSDEEP 12288:CVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98M5Ht5X6dk9zOfeK6n3hqF2F7ah+:CVbqPb88hv/l+YWjukUenjhVjV
TLSH
T19A559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 9f8e1a1c4fb7ad318fc1f02d2e0280b2fd8e0c1d555112db40bfaffcf75d7b52
MD5 20359522147384a3c2de1efb313a1a3e
SHA1 759167514d819b07c23d67c1c23d89dec5e2461e
SHA512 c16c4b23079c01f9053968767ff154808ea41c2f67e119e4176205472a7985b61a80bae4abd4bab00795a12e285ee95eb2b0483d294e41b4cb144f8b0818c220
SSDEEP 12288:SdR5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:SdHjukUenjhVjV
TLSH
T190752398976E20C4FB6726F495B3DC15F612CF6E9A922B33D531F2982D7E13CA069013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 f43409c33c9dbcd4d59e716f1fa228c959e504d5cc5c216f6498e24d4edd248d
MD5 15aefa6f400288a3807edd09b7b31186
SHA1 579c78fca1a6e01470e26f853b5dd3c65a7451d5
SHA512 922e51a8492b2064d2c9de976900e60bd9d7f2e06a6f0948f8a269837408a52a6c42d698a01ba5e8319038945abc0c5e3ecb9d236e7d7287669a7049f8d772a1
SSDEEP 12288:eeBNUbTVO86UU5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:eJIUujukUenjhVjV
TLSH
T1C185CF3BEE28FCD2C27A5DB85A91C600E77278304B62A3CBD175C20E9E275E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 88f475520e04b6ecb01ec394254ffe2f9d2a4bc518e24420ec3e4a42beeb0898
MD5 2d1a29c03cd432e59f8cfe3abb6e59af
SHA1 c89239dff946b793776766b4e7d056e15a5991bf
SHA512 674e309990e2cc870f373f8ddd3dbe8f84e77707abe65c878041f228e72c7e7f63623317aec5c4cbe7de95a6d99e7faf0aaf033ca9d9589f674ac863e89d47e7
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:4QvGAdlCEL8c/DRNw5C8ij
TLSH
T1D0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 00ecbfc2989c65fac6befd05dd76d4e45601a20d21aeac0317958cba6072db42
MD5 1fff911e8f3708a00953ce4c224e4cfc
SHA1 8d881491d2be011114d0b04c59c93c687c6a4ec6
SHA512 7350d4436991f87ddf120d449f70f345809060b9dff8d374d4aa4b861dc985b6d97449f1c16068240506fc06a1ce5491a42f390e3d6fee3120c9b87892715a91
SSDEEP 12288:XAwSfxL/2Dc3YDLLmt0LDQewsAja5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:w1ewsAjYjukUenjhVjV
TLSH
T18795E031FF75E036C77B0DB21B36C716643DAA204B611AC3E3B89A9D59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ad0bf41dbd229ae39b7e7ea4ea25ca56e3041cef2c8925f3c824254a0a82882
MD5 0693dce0272a56a49a243e171ab1a1c8
SHA1 8de2e8543910dd517b5d4323b580ae222cb8c13a
SHA512 2716e144335922baca422f71e2ba63c84c25801e51ed7b5d4006ce6f89c8ee1dbfde43b40744a2c9796eab0f2fbdc125c15fc6ab0bd549bdc6179ee2d7067fa9
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHm:UUEtQevvqc2W1cpV2tI32
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef78d58d7b3e68697b9fe2bdd07e074e1a72013a2f6c4d49ba93d9a8d927f8ac
MD5 4f1f8deeedbadb1464903901b9744fce
SHA1 02094faaaee18a45bd10aa3fc156461120095da8
SHA512 547c7a85ebc4c499b43a77c6150120dc2c9e886dfb7d9846c99ebbc890b5117b6bd549735b29083c456a51f4ba00e2a492228100c6d990f8abd87be95401c4e9
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/zuuij3:Qoq2VjnmIij
TLSH
T1A2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9e714a3dbbd01f121061299728849c44810a27946b328f94399323b74c8513e3
MD5 aa18c299902e8e9ae3497b23baef9862
SHA1 c95ea2bbb7ab815dccdc85933c9f85e910c00588
SHA512 9d5141c4f75eec95cb415fecc0bfd6df7adcbb007662e33fa9013ad8bf12a7e0a19d7f8fce68c6e51f782ad2922b3c4ddcf57083bbb42b508e8ff41902e83be5
SSDEEP 12288:aAZ/GL3IFoiwtA5qy97S9uaYFLq3OY5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:aAhGL3IFoiwtA5l7S53xjukUenjhVjV
TLSH
T10C35AE80E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2160D11F0E33E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e35d9e21e76d36fb4678424f26d5c876b7ee18b1357d9a9a6edcf1e25d4ca444
MD5 237f90655c8c337e0e17a01e7f0111db
SHA1 931120904f13b15f7312fbba824a22a80655f1be
SHA512 0768b8a356456240a92ef6dff2aba79b4e8d032304657f43c50d8fa6cf19b4acb6bd134e0a3b797e4a4f0ff016ffd0bf1700d3c11f5d754d08b6678f5476de6a
SSDEEP 12288:Imw5HEjsChNYBFgl0WDm+Ci5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:lwupOWdjukUenjhVjV
TLSH
T15085F14973A81CF9EA675238C557C536F7B2BC162A21DB2F0760C65B2F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 e46b9a67131c33db99279a4b19078e80fdd08abe231e4a9d11d743c20b852856
MD5 f516d8a9b7b5a213446e5a226486bdc0
SHA1 55ef46019bcaa2d54061b05cd6115f8457ed9dd1
SHA512 137984210b97b80592c1814783e0e6ea930e5b11da9c5117fdaf752a35700661c0c9eadb9721bbd5ecc2cc33ea8a74c31132f7d2edac04e02ed2bc30b663276a
SSDEEP 12288:tRZ1Iyq5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:PZuLjukUenjhVjV
TLSH
T1CE75125933E830F5E26352B8C8F28905E732B86A637213DF553592A91F37AE51D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fbc84af31289694d8d67e22b83465ef0db1c31332a4c2d1e3058f4f300bd7a0a
MD5 52e4186e727f96f260244548f8e838ca
SHA1 efd9f1b12964051e635a2e5cf9b8b6cda7d8b9a7
SHA512 5529e51f85285e25bcfa39e08031ed01b736c0e68a77d57bca2dde899eb027e08696a26ca9650670b2ef7364f7e1458dc03c2cd6ff4ae991f7d2c6eb1915b350
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:KQRQyi36YOcPbLvw2gAf+PN3xij
TLSH
T1DD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a6b08f4417336aa2cd35b344d1fc95984fd9bf15271bd6067c6b369350f9effd
MD5 393fbba2411646377f03643adf77403d
SHA1 9d01917a9065b1427692ff7724005866ffab8c97
SHA512 916948c78aa493b550f7e8f41ac598d2d0f5a8762e7db22cecb1f872acf1d32b92c9da5b61bd9e967dbc0f7f4b9df5a03a6d46befc0e4dedd5d155618fe61f3c
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:iQRQyi36YOcPbLvw2gAf+PN3xij
TLSH
T104666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6058b1b9e28acdd77c4b413881ecfd9cab6bab2da2bfe721c4cac52ee85673cc
MD5 f6c01f3ad371c8e47e76330ed3603f77
SHA1 dbbd4c811b7fbf053b06db9ec02acf724159c98f
SHA512 1261fee4f956bb63dd871a4b752ac9987ec82038d9405f549ebf739182d428637e0473f51e74cfe302757a5a146edcf9717401650d65870338f330f61c81bbd0
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0bjukUenjhVjV:Y68Qg55nhceWu7PNU3/+uij3
TLSH
T1B6B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b768067a2a7c95eb6d9595b3186748ea531356c2f32e3ef62c9acf1bbde822c
MD5 275dde7e5ff5a9ef715424b289394192
SHA1 77490fbfc456e4d313b36b9b1ae29682807431c0
SHA512 65c66ecf7a4486409cec0342cd20b5ca5f72e70b18405f4b99577514c4b40e36e69c9855633159db4d0d905a21312c20a121b14fccdc5188cbfafd7ac884dc16
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99m:ky5112gYy5azzVvt69nLKnhZaij
TLSH
T16D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0399175a9dd8d0ac8c15965d3105061f668b23d373fa376c8755455786592832
MD5 5aaeb01300dba3bd777ef47b21501bea
SHA1 d03c8038a341b10e8ede2d3f0b406b37d17692d7
SHA512 71a0baa92a5de0f7f8ffb3c8b087857a0122dc125993a1e2a4f4ce2938521fb2e62a1d83eb9f24943acc4c1e1e4f413cb58cfbb62335b90301f298db6036f199
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glbuij3:6u6Jmdxd2dCij
TLSH
T155D59D13F1DA01E8D06AD078974A9233FA62BC490B35B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b8b77df3d6ce16ffb908fbca950ed49fa34ac41501f3a90a0394d28ba5e0825d
MD5 e31c9196aee0482f11137b169f8b276a
SHA1 9bb0117bab9db5cbe9d71021c0ecbfe0721367c8
SHA512 a9529018d0e6be5f7a73dc9b5c8870d1ebe0942812eb6be7200fc0d11680e982accfa208e120846885d0c6bbd5f2ec1da255ce6afcef7696160b1e1a7a29c6d4
SSDEEP 24576:yhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3+jukUenjhVjV:61hpsNoJpF1A63U44CwH7R4xwuij3
TLSH
T1E3B5BE13F2D900E8D06ED17887569632EA62BC460B30B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ec7e6f9f735f514cedc6fb771c24fb00818a59e726605552fe7b8d78df59587c
MD5 8679c329d3c72b7991c64131fda2eaf1
SHA1 5e6f10c171de30e915b27ccc2eea4fda94692ae2
SHA512 2ba1aa4ca29d902a891c0a800a7886cd2d5eecdebb593ce48772c79fc2809cc7e82d572866a531079322aaa0db9e7a9f635d8d9bee956095f2de258aef38326a
SSDEEP 24576:F4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnqLjukUent:rSuZQIY0Be2KcRVtOnks6NMHqXuij3
TLSH
T137C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3087e75e214f06a33f1d62d8bce2a346d3b08973f9a3b269bf3dbb743d9ee891
MD5 55ff333f99f18b06c6292d9703948607
SHA1 30ad7be870777f0f314b453c971cb10279ed5e60
SHA512 33af1f3045265f9e524e43fd408fd1bf7a72a7619a378a75e7807a224ba296c75c5c6ae32af7528524aa53370ed250a34c34bc21330056e96aeb3f459bedfb91
SSDEEP 24576:chiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL+jukUenjhVjV:chtSn8EApI0fig3giDn0AP5wkuij3
TLSH
T17F95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 4e2a104fb882513452a07dff5fb645db3855c541cc99632f53c7023fa84154db
MD5 a3d0e25fcc704934aaabe9c58048a2a9
SHA1 5958d2643e58e7ad90fd97c9ec03be9b942c08ed
SHA512 8c4377aff1160cdeb0574e16a104ee02652da7a06aa1b897bc34f8a20273f75c3fea12133604595f2e5793c0a3836bf09d48d6af89b004d4ed71286a3ecae708
SSDEEP 12288:J55Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:JfjukUenjhVjV
TLSH
T108752398A66E21C5F71322F0C573CD58F516CF6EA7522737A63AF2542EBE23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 802bf63af802fa4aeaa9ab08093009bb835b28366913544cfa9c6af1d0017b50
MD5 b9dfdaa423233fff06a31074ca2f35d8
SHA1 db1acf342006100f0bff0e2e0559a4a7ef902a52
SHA512 2e23370a34a6b603d54e89eb48f61224946ccc3819416860db69ba75a586c81adfe36b8c5b45afcf7895036c126f6ccf164a418bfb0bf33fb84dea28a14310a1
SSDEEP 12288:VG5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:VMjukUenjhVjV
TLSH
T12B752258A66E21C5F71322F0C573C958F516CF6FA7522737A63AF2942EBE23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 3edfb53af4701ce7a6be76cd9eebac61299189152064dac1da7b470464aebe0d
MD5 c8a6aaf52a504685a4802b7185a1e407
SHA1 96856bc60791852c4b5ce3eacb78407727a8bdb1
SHA512 2f67494371aada23350c9856a57569e2da93e870c3021d3f41410edd967bc25f3ca734ba7f490eb6dc8797bb60256d9712ba7e5cf15c734a64716e97dcd0651c
SSDEEP 12288:i85Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:imjukUenjhVjV
TLSH
T1FD752398A66E20C5F71322F4C173C954F516CF6FA7522737A62AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 dd9006221130f3b11e96c1a513b398d4ff8961deec6febf81a92f3b757e09457
MD5 2612eaa232b6010225aae4619fd2c16d
SHA1 26965b072ee62c642cce1738468884265fde344b
SHA512 42333074ee712dff4a1983f2439ad436708e7e5b6aa6445328100de5670c928d076641074809855c2ca475215252f63253e0f3e0dff31a1fb3e20d918d1374a3
SSDEEP 12288:gVn5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:+jukUenjhVjV
TLSH
T120752354676E20C5EA23A2F4C573C815F236FE6EA732277F9621A2941E7A37C6038513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0e85d93fa2ca43e55b756275224a24971de0f29d4b3a92154d2b081e0a94d9da
MD5 3432b125e94c07147275f224e9421bcc
SHA1 4eaa68d4530abe1825590a9a846e13c94bc9fb3f
SHA512 96adf1aaa4264e8e70300d29ac340a53b51429891b45f62aba2744ec6d81d10cacc2f94e43e1dc391b8c5b4cf015a42ec1c00fe48e497793b002f3671a7914c1
SSDEEP 12288:qf5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:q5jukUenjhVjV
TLSH
T1CE752358A66E20C5F71322F0C573CD58F516CF6FA7522737A62AF2542EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ab2e06dbdbfd8e9a6deedabf5e5932e3f90f1d548349bf7598fa8a8c4c8f0c52
MD5 317bfd47d61d8081279f08397d70a94b
SHA1 5522436d7a1cb124be525bb476ce22f2f2fd377f
SHA512 c2bb9e1204c39e42f011f33b59942f982878878d8cabd6d36de251c0d16e8dd46bef2ca49cd78b9da20be72d09971359108dd0f9d5d9899f0245e59a550f1599
SSDEEP 12288:ZC5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:ZwjukUenjhVjV
TLSH
T196752358A66E21C5F71322F0C573CD58F516CF6FA7522737A62AF2942EBE23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 56f0f3900f5c0dd7a13e453b4fdaa180c5169000264fa24773cede8334f0c82f
MD5 10af02a58b1d2ec8c07275e1cb81b335
SHA1 bf94c86a086e4ab25606ac5bf06514c689f9aab2
SHA512 10f815f9ee6d77f934c8dbaea16dc02ecbe9d1450bcf20e57cb11a072f04567a6b963c66d9f2c868630994ab5cd68a6a894c20cdcc0b4bd88b79930a7f2bef94
SSDEEP 12288:Le5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:LUjukUenjhVjV
TLSH
T122752358A66E2185F71322F0C573CC58F516CF6FA7922737A63AF2942EBE13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 d9a8f697a649af28d9929cf05ef8b42a235bef3d3d2d2f6a1eff02535cc1fc18
MD5 1163fc15aca9d3d42ea803f9f4fe117a
SHA1 3ab834c51fff789d9a2a9dbda2fe624595c8248a
SHA512 e7db224b527c7bd42d6c6172abfe012f9167b37b8f02f1ccdec95c0df0c34ae1dbfa1bee292f743d328c2d51276274efae80bb16dbfa97d1b0311801be1344cb
SSDEEP 12288:tiZwbgzzFEoS2cPvym5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:wZMIzFVSOsjukUenjhVjV
TLSH
T148850194B39018F8ED67827EC9628905E6B2BC5A0B70C71F13B436661F773A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e125a08ae525fd823032fb1a9705b5f75ec6e3c4508d8a97a23c76d4442a9471
MD5 2a3e15ed0ccbdefb398c5e752e155bd6
SHA1 07f82d7a9825e7d57ae335fb4f7b0269ef2c0b9f
SHA512 8e7e4ed91986ae1ab83f1152dde97abc8cc8e752b6097378cc6792d8694640c6cc24e0fe80c1c736f20affdca5d9276f33456374a763fabdac5ecb4be353e348
SSDEEP 12288:9t5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:97jukUenjhVjV
TLSH
T135752398A66E20C4F71322F4C573CD58F516CF6FA7522737A62AF2942E7E23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 0f2c494b785cc3f70f9b5e126d06e2f0180f01c5d58eac4b2dc8a2876f8c250c
MD5 94b5a6fbd69053e65f6434d093579472
SHA1 ab211a3c63ca422639c8abc8bd4893dd7027ef30
SHA512 fc8c8d086e67385aa86979f2e365ac2593be8732bf6e1dbd18fe56ca027135188f7b2db48ba3b95725fcbe4d26abb17194d4fce8ecad5e80dc60e122cb976433
SSDEEP 12288:/h5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:/3jukUenjhVjV
TLSH
T15D752298A66E21C4F71322F4C573CD58F516CF6FA7522733A62AF2942E7E23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1b121ab4530838c1622ae7a92c5ea94362c400f743aaf9635bdf1a6832fe0a6c
MD5 efe4f63059f53df0d592420ca00a715d
SHA1 cfb0ced4c2b16362861329b665ac0368578c9629
SHA512 d338af95b277725ea347c5cfe50b3bc92e9ec172474ad5e784a0479ca946f84398e0833128e424eac7734136b8a0320941262ba6d15f0b9e6609fe24532d7fa9
SSDEEP 12288:gyPz5L8q5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:RzyIjukUenjhVjV
TLSH
T10985024773A530F8E2275278C8A25E01F372B83A47215BAF576453762F3B2A45D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 de7f3ed434158aefe37b4a4613b4c0699e085baad5346adb5e13d63d0ba68a56
MD5 3d9bde41cbce3d55f749882683e5e60d
SHA1 c5a9ea03bd75c5628f22a0665b0515769eeb1c18
SHA512 18c56ec5c88e0ca69c7f70623531fbe5199a1bea7ea792fe545782e3b733845a1a15bd8d47f2f0beaf0caaa8ac5d4dcff4a1e8ca080cba5fa147d7df01d26a53
SSDEEP 12288:yt5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:y7jukUenjhVjV
TLSH
T141752398A66E20C5F71322F4C573CD58F516CF6FA7522733A62AF2942E7E23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 0c989397d9d086ddac703996e23977bfc28f0edf79247f51904a8c046cea2216
MD5 695edb2baa18834660d5548bedf03be5
SHA1 08aa8b84ab67121c2acd0b23b109f73f01232022
SHA512 2b346337a0fca4d7be35e78411881de2b3828bcaacfb1d313396fab0d24c598ecb2db2ee9e66f00f197a1998b6cf1f2884f2b754308886d6dfb4c03d297e2eb7
SSDEEP 12288:Mt5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:M7jukUenjhVjV
TLSH
T1FE752398A66E20C4F71322F4C573CD58F516CF6FA7922737A62AF2942E7E13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 92959b66f34bfaa09b57e1e58b9a4b6503300d4b856429968cf0d975b011c1f7
MD5 7a98651618a35ffceeb8af3f558e3383
SHA1 20e87b8b0c22cb7829a5a998ff1594324c1f0d62
SHA512 73039e17d08f6a242c01db064086f90603e2443073f3685aadb8a79e744ca42b967ccbc1befd7605a459f233af1382b6aeb2e170d58fbcbba2891d0287f4507c
SSDEEP 12288:tyPz5L8q5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:EzyIjukUenjhVjV
TLSH
T12C85024773A530F8E2275278C8625E01F372B83A47215BAF576453762F3B2A45D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 86e433b76448a5e6721975ec09043b4046da8d1aae265100fe00e19995748aab
MD5 c7f1b4feb4d0e3addf0ccf7b0a4cdb89
SHA1 f2dd0024f49f6409c109e1af0051e7080b4bae8a
SHA512 6852142fd3e468218cefd07424a6497fc93bbe76629469e5803955313d62058705671e057b0b8fb472b3cf180948104bdd54300b32fda7fc46e38839a0c870e2
SSDEEP 12288:8Cd9PWYoaLHF3z0z04PDvhs5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:lTmaLl3z0zD2jukUenjhVjV
TLSH
T1688501A4B39018F8ED67827EC9668916E2B2BC5A0770C71F13B436661F373611C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e9d9ad455dc269a5817ab24d6ad343fdd0e0c9816844b040978498212d7060a5
MD5 b32756a70e0a64c2f865a90f0b533380
SHA1 ef43d31dc2f1ea0233fd5e1d429dfa1fa7218297
SHA512 6d7116b330f9dcc1a331c1ea62afde1e4982e07b9c2a5614508589c94ca148ad5d27cc7d3b9fc6633770722a689aaa094101e8e02920db3fccbc88ce10d68e0e
SSDEEP 12288:qi4e7VRdTfgwCHKy7GLbbdIvb5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:q3ed9CHKy7GZ6jukUenjhVjV
TLSH
T1A095CF90F3E810E8F1B79A75C9728511DA767C5A1B31DE8F03A4665A1F336E18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7af6c96e6786c40fc98d3787e8596a1a8636d7d83a7cc9307754f8a07f1517a5
MD5 b279731f77b395bba6e662dca91438e7
SHA1 ac085ee7853283cd7a82f2dfdbb3c89fd8a62b85
SHA512 089ca046e6c27d1405aab8df28bd0aed22b1940ce49a0816e2e9045a70c029b435becee4708d80fd5417b476bc9d1d99d7382a9e2f1ed22b63d346545071a0c0
SSDEEP 12288:qc5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:qGjukUenjhVjV
TLSH
T178752358A66E20C5F71322F4C173CD58F516CF6FA7522737A62AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 eee6f2d6b798e59125c620f320ce2d486ed020219ca88a1416914a781e467a01
MD5 658586e40dc716807e6e325f7164227d
SHA1 560fdea7de4758a20ba8e4e8f1e2568eb4f2e693
SHA512 a3b32defbc5faf513153b4d694d02d12fc4e8dcde6d6a90f35744642e3e12eead3bedfafd432b5128fe44de05d6b864fa020d8b50178ec3eee71407cc5839d89
SSDEEP 12288:aK5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:aojukUenjhVjV
TLSH
T1A2752398A66E20C5F71722F4C1B3CD14F516CF6EA7622733A636F2542EBE53C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 18f7982a662d8320e5b75ac73210adf007a17868fc30916b62c271cb0fc41200
MD5 ac7a6a99d82087801651303725e61bee
SHA1 396f74203bfa90bb1acc05d2a615f76603748d74
SHA512 a0c87c1d7d72bd0f3fc397d81896e50c8d2fb3efddb4b1f4557b17102c7c8edc9b70f5960719ae3d2a8bc062b35ae0633c45d53cfd69f45f5abcf37b04eaf905
SSDEEP 12288:/b5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:/djukUenjhVjV
TLSH
T1F8752398A66E2084F71322F4C173CD58F516CF6FA7922737E62AF2942E7E53C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 c620b05b72c9e87bb54ed6172eadfe3ae9a9c4c7d370ef89ab94fe9c45750a2a
MD5 d5d8f4a41a844c33df10ecf73a19fb5d
SHA1 e9204b1e4d5b9537260aadf03a0a8c864493defb
SHA512 62468fb54ca45bcb0c55541c0c315f11765a84ae6d3b597185adc7e28540523cb72d65f2840a637bccc365392df773f91e8cf4d11fee0f9753079787e2ee3042
SSDEEP 12288:1t5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:17jukUenjhVjV
TLSH
T1A8752298A66E2084F71322F4C573CD58F516CF6FA7922737E62AF2942E7E13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 03b957b6a6b0b73b883b1ec4789940cdeddcb1783c0be056b03e5196e20ab1b3
MD5 86bd979bb81108e5f7636998256ef28c
SHA1 39344f6f5315fb8cc4cb23a3ddc3445362bc4466
SHA512 81a187b37df584f2997474023cf5fc34dcdede53e5c06cba7df24e77bc2a1dcec2308531fb2454183f4aa7fccc4db3ce0215844540c5db69f4a58958d5fbc83c
SSDEEP 12288:Tc5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:TGjukUenjhVjV
TLSH
T1FF752398A66E20C5F71322F4C473CD58F516CF6FA7522737A62AF2942E7E23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 3a9340069bc990c765984ccf26a62f63fe19e0107d00f7f89e8334fc2b04f1ac
MD5 2ead2844b2cc50ed45c3ffb0d7329b60
SHA1 01e4e7f8e7f61f94571aaa49c83d1fa8c5dcc1c8
SHA512 05fe5eecb73893809f7fc45e410c6e86c5b182f67e08c956471ad8dad7e40c26b1c3659b356950daf8d070a1d9a09bd372ffe74d3ee5037183e90426875a72be
SSDEEP 12288:wl5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:wDjukUenjhVjV
TLSH
T1E5752398A66E21C5F71322F4C573CD14F516CF6EA7922737A63AF2942E7E23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 8083c9163cbc7d40e284814bc6dbd65143adbe5e8b12de0fd30a40edb5e873a8
MD5 e63dc05da651c9425b009ad78df7a1a0
SHA1 3fc4bdf92c07a25740d028e90e3325fccb1abcc7
SHA512 23eb4c5a2a14fb7d5a60a1d759647855919a0366d9f0bd94da6d9d8743a1977ffb0cd67899f6011214b7cf6b9e6605c83101bbdde80a7b7ca04442b8f87a520f
SSDEEP 12288:8f5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:85jukUenjhVjV
TLSH
T165752398A66E20C5F71322F0C573CD58F516CF6FA7522737A62AF2542E7E23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 6e6d31bd4297ac549467a3045022481c511bda48bd0d494f6353118b6a998437
MD5 0532928c738b169f2056c6a19f1eeff2
SHA1 62ee58fe4110619388f570831d50553aad63ba7a
SHA512 60df18a25282cc79f0377549486dfd5ad4f56bf34af0d67513e4f6149171a5d5f3a4a6159b8f0c2639c19ad06e6f2d08fd3a90aec919c88d219228da966e58da
SSDEEP 12288:LfwvD5uQ64Lk3tRX69qkyAI5T5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:LfwvPk9RX6wkyAInjukUenjhVjV
TLSH
T17395DF29EBDC04E5E177927C89B3860AF2B178691B31C6CF025A53AD0E37EE45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 657979b5d30dc43c8dacb67dd67c37ab7dfd985e44c070912fa10babce20aac7
MD5 e4173c6d8c0679e99b2d3918a794b5e1
SHA1 74288c5c6fbce075560c4e25e33873fa0983b048
SHA512 24a74633931c93ac15a7411774469e8c1190b32345440cbfd36e415bea51952b61bf922118f5cdefbbda3aab64873a037e6730ff709e95d96f042f59d41f8a6f
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Euij3:BySzPRij
TLSH
T1E3066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 087f01a4313fd04ed6b93d627a3d5f2e1322984974a912a98b6e6dcb7bd17c00
MD5 9531acf0b88979565b8dddac3b502824
SHA1 320830d71ed75eba072150c295abe7b6edf82bbd
SHA512 0b134517a7ab18bdca8a89931e25fd15fc4168896dbc6043a9ff51ee56053f2cca6376bf6d0c82c66c49c8f485b1fb9a9fcba240c8b5ad5aed62fdf05632e7dd
SSDEEP 24576:R47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYcjukUenjhVjV:R47JUQjTirIhCnDHUPfF/Uuij3
TLSH
T1B565AE1DA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270837D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3792fe490e8ad0963ce991c9c1b0cf99d272021cca2789c1ba03f3a4780856f2
MD5 4533f51b96003242ae34f9a558f22933
SHA1 05ee3b928e098e369cb12c3c1cd5173eb6a276c7
SHA512 43bef75dcf0180b13fdb5eb7511cf3105c66074264c0899eb93e3cfa0d766b9f13ae0703e8191c23142411ae1b765e487f632f7e5d164f4763873c304fbbc818
SSDEEP 12288:P2sfd5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:tLjukUenjhVjV
TLSH
T16A750119D29812D8D16F62B4C7628A40F333BC2993E193CB53D0F57E1F7A6A45DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b87c614eb1001632ba61feb70eb9de3b5dbebd834d3819f917db70b5673edf6e
MD5 d9963c12a76e03e871c2e7b252c32517
SHA1 997f1ffb8fd348a52b4ad198442db92f3a584715
SHA512 80c82c007a3fb0b87de1e20c271ac278323f3724c8ca583e3397d319642faf03f9daf265250af3ce24d967b2de7feaafd580f08a24a3f3e1ecdf6a55a64f2769
SSDEEP 12288:awOOpyvtU3fWsMr4rBM0I/Q8Il2mUQ4ptYkoDjvvfj7hVu9lsV8OoETFI:awppylUPM4cFQ4B4jvXvhVu9WV8Zw
TLSH
T1F73507007626DB4BC6A950321E37C6CCAB70BD06FE059B0772CA473FC576659BAF1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 381bde868a87e62911a3b8737150b6aa9665331705e859de7bf147306e03232a
MD5 15d43458bc53a5269c8d32b1ce12047b
SHA1 6f471f6c1a6c431518d7b20b5f6817da707c4ce0
SHA512 7db4373a69cfab98a403aa82f090492a07f88ae56a43e1a0733e1d10399789ef28ef76cd651a7b3831576e650cc7f86cbf7de64fad22ebeefb56ec5bae20d8c5
SSDEEP 12288:eMkwaow3gpQaU71pli3c5LJUbsArzaRDDAT1cSyvcZXoyvDZyZnfD4/knfD4/dLB:fkwHh0r8MdJUjwDATPL49cFZeCqYxg+
TLSH
T1F4752A0165B7EB4FC9BA90370332868DBB749C06B7492F0573858879887795EB6F23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ad3899635ea9aadb32ff7d9241821a7ac2ff3448ccfe3b817f8731a672750a9b
MD5 d962f22871ec7d1ba084392f1274e133
SHA1 ce858c39d6b4abecfba5afdde1085a36fedc5383
SHA512 c16553a96461114d53ad11117f65913bc19b129e7a83ceea92cba528fa0196314c9b0262a3cdd1777ca6c89da390abddabbcc81cdee452ff70b8339af34c4ec5
SSDEEP 12288:eW7V5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:dTjukUenjhVjV
TLSH
T1AC752354A3AE2485FB3722F08077C824F11BDF2E9B1127A3E525F2942E7E6BC6479107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6ac88023c05a75b1ff33106fd14494f8c74294f390d10e46edd5b566db3f7e66
MD5 13431e2f1a396bb71d5df57ef3a2f97c
SHA1 c4345b9b37531f5c009946d5c70f9f6ba55c285e
SHA512 94713a3dc88b5375c259932c00438c1017c951df5fa00b45a126d31e224641146d161ca28aa82fd0d7f48fbb671342be07eb3fcffa8065267634e0b4f1dabccd
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY1jukUenjhVjV:dgb4mBIBhGFSuij3
TLSH
T1D865AE1E22EC02F5E1FAE2B8CDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 69cefb283d999130056839ef43a582b4f371f61b338afc4f10aab3a7dbb354e5
MD5 f6d7f1e4162265dbd4dc1d5ccaa5f76f
SHA1 9e6a9a8ad4b44f56328eb692ec167bfd237ee542
SHA512 9a2ba21c7a4cce3cbadde5bf8b478af2d4f9dfc102b7d06c7ffc3cf486c0ba04a20443af10fcb67615ce4a7e89a39870075d41c50e7be98f67df94aebb128597
SSDEEP 24576:7G88u8FpJqH1Ezria7/msjukUenjhVjV:a7ZFPqVTa7/tuij3
TLSH
T1B6A5F16577E501F0D477D13889928A63F6B2B8250360EFDF07A88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8ab63b9e68e8cc88221083aaeba4988786f27905f08fc167e6a5527e16f38d05
MD5 ee935df33b005eab75d828ab05d33b35
SHA1 1fcef990af38c8cb9e063cbb3d59a2335bd050e7
SHA512 540b8e92b977525edc482d128a7f5a4bb755ead61d5ec1e388e8ace374195c34c245f2ce8af7a6452033899488fc5e80a972296abee15592acc3b4a8145a74ce
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGuij3:eG05lO43bSij
TLSH
T153D5CF6E62EC11F9D1BBD17CC9C68A0BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c05b57b41b5b7855136329462a4cc9249177e6adddae377692c86c563a854867
MD5 0f9b57e918ee67b138c0580e8317d425
SHA1 1605b78cd3f04a39ad9f0eed7599e3a0137743d7
SHA512 2e0710812b7aa4947395a9812bb2ecbb2a66eccb17ad873b33bd0db65622057e74a3906f1d4f108e6fb27f4a638bcd705d73f0ec6a14edfa763239dd26457aab
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnijukUenjhVjV:Sa5POZ3BJt2pasx2+m+uij3
TLSH
T15C65AF5EA6FC01D5D579D17CC5838A1AF5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c861acdef8409914e4a1eea5ffede037af0ac4648d5ae139cb06c6c31be8b9a1
MD5 30929dc663824c7667cbf6a98016612b
SHA1 7450c1e314ce68a670d26148a21a0f76b0ac2867
SHA512 485a1cc41f5fed5beeaa804569a69816da64f9b730585bf3752242d6945a75cc2bcf61ffed7327d415b6be1fc63db83cbcb35c8e9d817d54539bc0a67f95d18a
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkkjukUenjhVjV:1Nc/zEOVHFNuij3
TLSH
T141857C1623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7d43d28c960986ef77efddb09e887bef529600588bd7f07fff591d1d5bb7631d
MD5 a3b8d3cea63cff38817ac793ef2152e8
SHA1 7b9f4029ba899af03c3c1cc616fd9e7e4e7aee0f
SHA512 535e4e90c66fa11af4b7e0f7adf354430485e98def665531e420535f224f113b002b210d739fbe3e3c12aced1b9aa0b66a60913eaab8fa96957577ed9ee6405b
SSDEEP 12288:JQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17H5Ht5X6dk9zOfeZ:JTkNvNnaFeYhJNtmZBmzjukUenjhVjV
TLSH
T13455AF6EB6B806E4E1FEC6B4CD238512F6727861173253CB9290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4001deb90c02f7512d96305313e13d6f4fc8817c09eee9c02d415cab43d8c054
MD5 c19893944ff90160632a8995cc8c6224
SHA1 03c09df601487b1c0f2adaf9edddc0ee102d7c34
SHA512 4cfb2a941ae63372dd81cd66ac737756787e7f64369ede451b21ee91666c582f75484d1c9dbe3f10308277d94b4ffefb971215d839460e236324840686fbd28e
SSDEEP 12288:2HvUrBFrEjwaQS5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:2PUr+NQgjukUenjhVjV
TLSH
T13385F21F22AD18E5F677A17C85928609F772B866131293DF02A0817E1F67EE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 4cafde16049f64eecac7b76458eba85e9b1f48550f4861b44c5a61869f973052
MD5 8c1548f86278e79ba30eb32f0ef3e840
SHA1 9cf07fae2f2126f534b5149aa0cd2df70fb417ca
SHA512 3c805d364ba20a1e5d7c0d552950df00fc3e528815ff4f4843f685b5569ce3d79150babfeef50cf6d7a2f46e031d07cb9cfce24a8b15661afbfd4aae2d2b8450
SSDEEP 12288:/QcMxWDXN1Dp/fshBItT1IQgAZ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:HD3FHshBIYQgA/jukUenjhVjV
TLSH
T1B995E17DE69C04E4E57BD1BCC6638A06E77178AD032266DB0294C1B91F6BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/820-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/820-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/820-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-77-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2376-311-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2376-69-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/2376-71-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2432-318-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2432-117-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2432-125-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2432-123-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2564-1-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Download

memory/2564-56-0x0000000000400000-0x00000000006F8000-memory.dmp

Download

memory/2564-8-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Download

memory/2564-0-0x0000000000400000-0x00000000006F8000-memory.dmp

Download

memory/3964-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3964-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3964-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3964-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4504-57-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4504-300-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4504-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4504-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4752-82-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4752-312-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/4752-81-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/4752-87-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4872-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4872-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4872-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4872-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4872-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5556-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5556-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5556-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5556-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5556-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5556-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5756-138-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5756-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5756-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5756-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5756-130-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5872-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5872-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5872-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5872-331-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5872-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5872-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6020-48-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/6020-38-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/6020-39-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/6020-46-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/6020-50-0x0000000140000000-0x00000001401C3000-memory.dmp

Download