63ea5324bab833358a7e405fbac710d2db573d37f22caf6f78a6778efeb959e1

Analysis

max time kernel
149s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Size 6.8MB
Sample261102-249e1szy2n
SHA256 63ea5324bab833358a7e405fbac710d2db573d37f22caf6f78a6778efeb959e1
MD5 c61aca3754012be315cd1226ea82aa68
SHA1 ebc834024b4f4508b766137702b010933862451e
SHA512 10f5c3e05f23ae0b40220a564f2d29deef3e39c8e8609b4008ee888a22b4e0d073960d4291a363805919d0d856cac303a7a3c59b336dab49de2c5c4847f3a210
SSDEEP 196608:Aif9xzEGqT9MvRtibFtft6N8NCDVY4zN4LtvF9:Ao9RqT9GUFf6N8Q4Lz9
TLSH
T18A767C32AEE4407AE17332706E3CF7969CA9FA310871C4DF62A8594D1DB3982F555B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2792	elevation_service.exe
5864	elevation_service.exe
3492	maintenanceservice.exe
5796	OSE.EXE
5900	PerceptionSimulationService.exe
3000	perfhost.exe
5996	ReFsDedupSvc.exe
4944	SensorDataService.exe
2700	ssh-agent.exe
1776	AgentService.exe
2192	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a5912a0d227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ba3b9481f6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bce606491f6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ad7184b1f6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f519f5871f6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a86be9871f6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a1f02491f6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2792	elevation_service.exe
2792	elevation_service.exe
2792	elevation_service.exe
2792	elevation_service.exe
2792	elevation_service.exe
2792	elevation_service.exe
2792	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4264	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1776	AgentService.exe
Token: 33	2192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2192	SearchIndexer.exe
Token: SeDebugPrivilege	2792	elevation_service.exe
Token: SeDebugPrivilege	5864	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5904	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5904	4264	2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe	90
PID 2192 wrote to memory of 2912	2192	SearchIndexer.exe	103
PID 2192 wrote to memory of 4976	2192	SearchIndexer.exe	104
PID 2192 wrote to memory of 5976	2192	SearchIndexer.exe	105
PID 2192 wrote to memory of 600	2192	SearchIndexer.exe	106
PID 2192 wrote to memory of 4320	2192	SearchIndexer.exe	108
PID 2192 wrote to memory of 5780	2192	SearchIndexer.exe	109
PID 2192 wrote to memory of 3068	2192	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe
  2026-11-02_c61aca3754012be315cd1226ea82aa68_amadey_darkgate_elex_glassworm_magniber.exe RELAUNCHED
  2⤵
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4944

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 787543814307c3df9b8e5be11c49de66039f8568ce32f700772369de3aa328a2
MD5 206a8c21855bdbb52ef09c23074b4e9b
SHA1 2a8fb4c0c8b89755b3d62d642d012f19ed0070ca
SHA512 8631a1daa9d25359df2de3a25d0c5e19bce48a448b73b8e37dbd86df73305442ebccffbb7929516313f7d16d3c5c2bfcbe64ae72b53aa1c79f242f4b2963f50e
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3LNiXicJFFRGNzj3:q3q6mjBI7wRGpj3
TLSH
T1F8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6ad034317a2a4e748a8669c44c90a606a1c229cd20ffcbed99512c1faf420d93
MD5 f56b36ca921c257d8097a40c177d92f2
SHA1 0f16964cfb32d8aa75b59541f0b7c0bd05d7481f
SHA512 e23d8aa647eecb0fb0b5b4943d7714bdea28afc96144adbb54e0e77e048d09b398ec8a68a93b878451410bb5d19f98994ce2c3bae5d19ecb8969b8697c354b79
SSDEEP 24576:WXYfDtczA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VtcdLNiXicJFFRGNzj3
TLSH
T1F475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3bff52154eb7c351bcd32cf43027b8c97a25402d7b3438a80b2b6f3278996064
MD5 dc7cfd3054ae1c9e7f2e79b5fe8d263f
SHA1 8433150fb6af370c3442fd5903539dba0fec0de5
SHA512 bec80f28529936a682c1d2199d6c163bfedc103a2dfb28f53e7576d852685f482430eb643e21777813bec37df2d9a0c06dc07509d5db511e51134b2fb8c1d10a
SSDEEP 24576:S0Le5ji0hmxhrMf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SPji0AzeLNiXicJFFRGNzj3
TLSH
T13F859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2fbf0cb19c04d65a3f5aa9201fc1604800f1817eb5ed82e71ab603f6e706aa3f
MD5 289c07693f3d6294f105c19a9fe312ac
SHA1 3c6ac082c7722bcab894dd9eeb00dc39a0c6ab89
SHA512 6febbd62f52b6c28ad1a4c44609795ef08f1762a336ff1f4d4d9a60f729e3c77f73e057bb69b9c7c3e0fb484d5dafad30d82d2df76639c08cdf3596be29a352a
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b/ezSC6vUzPv+HjyCLNiXicJFFRGNzj3
TLSH
T128756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1b716de55a9e95ff2130ec5efabc74f70dfb3b959c3fae54184b8cfb4cecde35
MD5 47063d98457b9338003c0c4652f4aa14
SHA1 884d330136f49e79d2cdc329eb1feb57b689eafe
SHA512 2102dd307aa9430e0751e8083039cfe4bb54fa207cebf8c2c5757daf7e4c4171b285980d7c2cab3e0804390fba82109a39855e0e8ca6b4a2ebfc22735ecf3b21
SSDEEP 24576:+VbqPb88hv/l+BY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+VO88hXl++LNiXicJFFRGNzj3
TLSH
T1E5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f0afb73988864e831b8f7b2af22c6bfe25ed6fe3f9379c685f07e3cc037f38c1
MD5 d9981e59a291090b14043d4868b629e2
SHA1 f1d22f92bde026311579c9661faa11aa93f51a6c
SHA512 3edad955f20858ec6c72cb0eab25e4ebfd37b564039ab0ebe51a90f2845cbe6f6d1575d9c821300794e505c46568bb4df226cb095bd22bbef23792f5c0b2c7f3
SSDEEP 24576:uGr/TwSfVcYG3K/cJHlnFR+IGNe8j3IzzN:ZLNiXicJFFRGNzj3S
TLSH
T15C5523D3468854B1FBFD003A867A5828B5845E2C8A5A5DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a1f8615611f2983db5e9ee5d7c65368604ef080888e432090f29e13ecc8e1a33
MD5 20aef79ea3a23bcb94805d930a8f7182
SHA1 54df5f2c2bd122134fe88880468f9b223261ca2d
SHA512 6b2e781ed4e29ca43b29cab3b7e83e73737cddf61212abc26b9be32a03947590a116a4e67af79caf946c1a2614017e9a77224466bbb91593f7fb44829ed896bf
SSDEEP 24576:nJIUg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nJIUgLNiXicJFFRGNzj3
TLSH
T1E575CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b1342b3069e1e0f5c7c3db9b5acdbd490fe025d37115aa2547293713229160f6
MD5 d7c0d8015332a00182c1b047fca29dfc
SHA1 50d5a5c605ee2ac52e4596385593632c019ff9b6
SHA512 976bf0870a886bc7da2d0d73c1c57f479b46b43d5a9363e519029027b16019617e8ed3fcd01ba2b34c3b653262440f89e788191ca59238cf53a91a7d8128eb3b
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THO:RQvGAdlCEL8c/WRNw5C97wRGpj3
TLSH
T10A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9512893862ceea99b55cd268215c5a7c17bad3933a5b32b9f379ae7c53cec8b1
MD5 7555372461e35654e7e6f41732a8194c
SHA1 ac4dbaa0fc7dac813478f6a630fbf7cb69137173
SHA512 29d53c34fbb3b7a4bf92866c0f63768759f5641e37a4048901c11f8992519cc7ee1ba8b54c55c1adc73e76be8d06c44a83e5f6d19bf68ab4c7eb3518474f6969
SSDEEP 24576:9fewsAju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz1:BljuLNiXicJFFRGNzj3
TLSH
T17E75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 97977cb03c32485ad1b5ce9b598fcf778e293a4d28fa5416b7689efe94d26995
MD5 be3fddd9be26133d59505aab0edb6f18
SHA1 6c5cf4d2bd8e1f770f9fa6b1d7f6d3bb306a6494
SHA512 1044eda91dfcd235c76259a20c9cb97396a07fb5c34894867e47e2a650bc68f7a4f6316a418732f08de6f6426ab4b7153885185f6f9316c2716958bfcc8dcf96
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHKF9:YUEtQevvqc2W1cpV20I32u9
TLSH
T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 04bfed8b33d9c00625727658708b162134ce15befd975283a061abfda5217a29
MD5 ffd20af3600970cb2fa7639567144594
SHA1 f9249bb10585fbcede0b43975188c3df86fac72c
SHA512 c9457ecf189d49da6501da5ee7e196954c625d86d43eba0f0d95792d42f9d4d09837a7f8a247a93cbe12e1e9985b2f4ed5826c69a187a9c4d86dc64aa6ad4748
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zOLNiXicJFFRGNzj3:uoq2Vjnmx7wRGpj3
TLSH
T1A7D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 738e6ec4ce7cd016898ba4a8dcaee4c957cdfc042822ec33cc821e225a7672dc
MD5 8394d6a820e06655257ef049f5c33445
SHA1 dfff62a2bd8ba974665d3165b6d251b417f323e8
SHA512 f9aa38e1c5643bc5643d9bfeb94b1b24c6df2ddd096c34c44afeed937ae4e2bcd4f4ff7d73caf8e5819fb0f75c7b4e90ffb1bd3b5f1ce322a188154a9687be8a
SSDEEP 24576:DAhGL6IFoiwtA5l7S53R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DAM5Foiq5BLNiXicJFFRGNzj3
TLSH
T185359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C24F2150911F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4023ff92b04c1238ddf2f9a9c61be5448fc66cba47a685c4a899935d1108fdf5
MD5 ff9232669e06088d2d63594be2abd287
SHA1 5128f05529f408be60081d05d178505cbbc7556c
SHA512 fc8c9545fd83579fdc6e9809e207fd370b5000dad27ebbaedb29335cb64280d548fcc58354a4877a907bdd830a44cdd6ae4d2fbe5da4c89a4526783da7698b7c
SSDEEP 24576:9wuROWi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9wSOVLNiXicJFFRGNzj3
TLSH
T1FB65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e5dbbd896fb71df1600a2d87a3a7f30706140c8e7ccf0d6f9ad7f8b5efb2f43d
MD5 a5dc74c6403731336b031813b44b0021
SHA1 bacb770fede2e4842467135492fb76e1c36228f1
SHA512 694900340a8046c884210165cba51cd96af189f869a434071c350d04413660d525c53a41b9bb335896476fb59e934f7cdb19fc6ede6392bc10675d8e650e220e
SSDEEP 24576:oZuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VLNiXicJFFRGNzj3
TLSH
T1BE55129622D820F5E6BB003DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8ac7c0ecae7177bf6a08a335d77ea5b79367e028d98fa37a51ded78bc5ee99cd
MD5 6e6cca8a66d0849d63d31912753fedbf
SHA1 ffc0d9cd26ba4522434afdc21fc3b92f83621645
SHA512 deb56145fbe4eb2c4f51107d71cc593bcc758f1b648e33ac6cc6aeaf88fe9ca6981c8ea7d4bd4207c894a7acc1506d5e501f903f6d671fdff508ea12b87f1f72
SSDEEP 98304:gQRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:3QyiKanX+PNgF9
TLSH
T10A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 521533d5f01914b1dbf02a0298344dceff92290aa5d729d644bf619c96268eea
MD5 5447d7944f7617e93002175d940366c1
SHA1 3aa5ea93bcbd6d32b90b80432ac3058b62b85e2e
SHA512 fc15970a2a7e87d423746367f910e1d2bb5a84d1eae00610f84d50ebfc7ac5017e03b57d31072b0e078efe909f537b63b6ecac37f0bb7b7e8479441eea6c678f
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:CQyiKanX+PNgF9
TLSH
T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 13a8b8fabfa679ec74b269a7279f65c1fa0de327ab4067255a8c432420ef060e
MD5 2d96d4727c23fc097475494144a758d1
SHA1 412df5cc01af12c8b471345c6d0dd521591b935d
SHA512 846d472744cf7b650145a03f2345434ec1b194869741300cc94826240a32e0204ac79f4beb8c2de4fcaf7b61fb8321f557e03b6a3990459999e9b24c1f9ee7e8
SSDEEP 49152:c68Qg55nhkeWu7PNU3/eLNiXicJFFRGNzj3:WthTRc/e7wRGpj3
TLSH
T14FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 df7585733049a005074615423fc1fe34301e55e3654c65f1090ee898bcb126da
MD5 94f5bfa6740d0e56f3701974cad27806
SHA1 c04a2ce5abfed1d569dfb4d08dc250adecd6e0c8
SHA512 9d4b2c8faa71a9cb467fd28d02b9fdb107ac5de9138a0475cb0dd3865e8954f7040cc55107849a26ee8dace4d9605560e0924f09b52cb66e8ba97b856ecfce01
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZr7wRGpj3:/LIHRWh9F9
TLSH
T1EA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 52f856407e9f05e98ef6d31839a03ad95decc60a8702988c833b06a7ed7d8bc8
MD5 ea4f10ebf6231431abaaf773972aaa77
SHA1 c61d2859475a3bec193dcf69bee3ccc9d7b28be7
SHA512 8ce2a199163b17040f8e0514624f399e212b4c0812ae729554504e2c6e16ff7a01f82a0c5549771912e9148d4526ce5be4ccdc8bbeea201df1fe8d81e610b995
SSDEEP 49152:8B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:Wu6JmIxd2ds7wRGpj3
TLSH
T106D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6de43d435e937fdca68e40dcccd62d33564fc656720273bef6c34aebaa5dc7a9
MD5 c30f666019d1974c6e085387fe6506ae
SHA1 23bb6ca6618b280ebbb988be177021c6dc88b405
SHA512 3ceb0d493ce6e6f86568903dcd209440637d8167936b17b2e3c22b1f4b300175e7b1d3c791ab2e1aca5ab9fc1ea4095765c969ec5efe7c2f995e5da7ddb54c17
SSDEEP 49152:d1hpsNoJpF1A67U44CwH7R4xALNiXicJFFRGNzj3:dmifPqRx7wRGpj3
TLSH
T1DDB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3f03afa1f989438693f4890b1ef2599798f8b46b0cc4345f7a3150a69f8d422
MD5 9e249638bdef3ab845b8188beba668bf
SHA1 b644be370380cb6c5788eb6577ce266c9e0f6303
SHA512 d26c8dbbff64135940e04f7caf294afe0d80f0dc3c87ef5048eb50c94ea059a3196cd66b08d408b8a863746c7515d1e2ccc76002cd217e07b08b0a5d857721f9
SSDEEP 49152:bSuZQIY0Be2KkRVtOnks6NMHqHLNiXicJFFRGNzj3:J5dKqi61H7wRGpj3
TLSH
T128C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 40eb48c180d9d91a3d790d7b22164504f2053f29379cc16f94e9386275642a1f
MD5 000633253528d337d85edc297b7a8d87
SHA1 80f85a94bec801e08340be135527093320ef43e9
SHA512 84e6ddcb85a6c5a46ce055d1d38c97fc456d943891857122b950d7a20c9c99bb22ac6fb0cf42d4e1cb12c8d0b1a649948538812cfab04f35c85a1d9e4b5ca148
SSDEEP 49152:AhtSn8EApI0figjgiDn0AP5w8LNiXicJFFRGNzj3:RX2iWph17wRGpj3
TLSH
T14C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 58d0181195686025cfab370ec57a5248eb7a58cc01bda0838db60d371f01741a
MD5 e4ede33fefa82e12ceada72c48624bd5
SHA1 28d455684a4b3dbb7e9e298452eabe31515a1e36
SHA512 092f7c2310bc0ae2e13fc585fe8efad2b921749919a40a18ba23df2fe9ff7f447e0ee9a6e25751cc8c0fd981b163f5a1084186c91215136fe5a112d6938bdd8d
SSDEEP 12288:NHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3558955B1FABC003AC6754428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7d1b1544e5eb322669439711e9f8ed627bec6741233db5ed1c45cdb3ffb4c024
MD5 365f15f34be749bf6753b84983c18a45
SHA1 cb9c29942216cffe8dafa36efce13f4ded36a7ec
SHA512 7d4482408fa3f247fc06cbfa0a7dff6c3c41c718249d5c4972d421495efbcd2a8e8fd217cae3505e42d04ccfe19f3ab7f90b30d249cbc0c9581a988527d20bfd
SSDEEP 12288:eoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ea/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3558955B1EBBC0039C6754428F5882E2DDB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 73cde1983c86a2b466b3efeaa8e9eb3034f59b68a56d40bf74e92f34699ea3fe
MD5 cdad2a1ad8dd7e419b4d2e2333d680f4
SHA1 b8453f3f07b5815ff0e5200b8fbf1754228c7069
SHA512 7096028762dc133f94ec60790abcb841ad59730cd8f3b22c792012bee14a139700b9d73b13918b7ac7265d254dab0ef8092db269bede26ec3dc0c60ef7b0943a
SSDEEP 12288:D+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D3558955B1EAFC003AC6764428F5881E2DEB5619E3E3483D1EA238FDBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 94afdd29e9ba5fe58a25ce38754d9bd96df2a7070551463977c899e26864376b
MD5 487fa7d668102c420bad391c8504cb08
SHA1 b8b877b9a231e3eb7b3108d6efc3b23ee5f7047f
SHA512 6a4b35300e65d50e720e998b1eb8f4b51a6f6d74368872bde947dbc3681811568cc8e672493b830708f874e3106efeb78b8d86ab0fda214e0a77722d73e48d12
SSDEEP 12288:cVtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE552393168901F1E9BD8039CA764424F2947D6CDB325AEBD3003D1E5A35FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 febc42a1b7549c6afd853cd78fb785f0770889ab69baeaf89323b92433a01a0e
MD5 2b9660a59bfad593de3d5c39f0c02509
SHA1 01d9adf01bd9e33dc51f7a79e5a81bf51c3e27b6
SHA512 9bc89588f3d556c4e8c4fa0ea499478a29f4f7e798a6ebb293f3c80ed3f85e875d06e1f19a58b22dff0b4299c8f744e6b4a69659f006feab31c52bb4c4724a86
SSDEEP 12288:IliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ip/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3558955B1FABC0039C6764428F5881E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 959f3e9405e3bbbe41fed9590f9da67b636450d8d1c5b9386ed850520d11e6a9
MD5 e920277ff7a9f8032779cd5d725f5008
SHA1 7790fd07ea88fbb3c90333811c4b8a7ff70fe937
SHA512 28b16c35d05b7b5751da500bbb12cf76ae40c99f8c404cd67767975b0ccc1af5ec46d7860807c7b32270ef63af33db0781988f91de87a1b487aacf2b743ae232
SSDEEP 12288:rMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ac7fab4746947f4b284739ff88508b41bcc6b873eff6c8fcfa5525cc47daee7a
MD5 1019ba691263c6c6a00eefd69bccb253
SHA1 d9805facab29c5b278e83b21dffe80d2d7728116
SHA512 dbe7689e95c41878ba2d4848a21cc814568eb27cabc32b3db96a906620efc0668bd30eea2667b41edaceda42479e00b8c636034c344140cdfcd3796e1d6a65a6
SSDEEP 12288:xAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3558955B1EBBC0039C6354428F5882E2DDB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0289d82267c5e0e9879036aba01f8968a94fcb0e2e9f969619af0ad4d88096f5
MD5 eb4672bdd845fdaa9ff53b00eae173f9
SHA1 df86c7fa59294583211d5e09e83dd735015440ee
SHA512 386d2bed8e713bba878dbb39af9c97764e1942c0af973855f7f3c37dd0ccd9461d5786a94be559f680c852818c659def1e5011e6f6c95bdaf2206d7d296ff447
SSDEEP 24576:kZM3zFVSO6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kZM3zfGLNiXicJFFRGNzj3
TLSH
T1CB750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8e1b3387a5250aed9f85c146f03a8f51b64853d2200b99fba24d23f3bcd0bbb1
MD5 97baf69f309d78f06c31ac1a82d5638e
SHA1 ce1b3f1f56643fde66897d6129670c76f05c6cd8
SHA512 5cde4919f140c4771bd36a5b61bceec55f1e854d4ebdf6dbe36494940561649244eefdb3606f6d19cc4e0c0253db5648046b8a7ea00e871a2fdf8c5244b6b801
SSDEEP 12288:djiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1735523D3558955B1EBBC0039C6764428F5881E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 91b9222b3fb543caa56128472480947db32da20a66837bb041e0a6c076d6c540
MD5 c963c51548029a4f9b413c3b9e98e18f
SHA1 108c5a85945dc46117d69485ed6f15f751647786
SHA512 89fc88524fe71a8458113c4bc521571d5eaa85fe3aca1110c47c553dd5c0b1ab3d6268df3af201a0cd2f08c0fcbafd65d2cae2c4da869958076fe111ef3f3d4e
SSDEEP 12288:uPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 134449cde87b1b9c5f7ad5376eb439a0310b0204e0ee64d61388249ea07fc249
MD5 7917b64fe0634c7a9a0e32eab36b7a93
SHA1 a1fd24821d89d96a5618afd9f95982816638b87b
SHA512 84694c1ccad53303d4bddcdcff2c3ab7944fb3b722fc4acd8b4c807a7574d19c5ab0c11cd04942585966b3513eaa19821c0e518a693f30d1caf8ddffd8db6ee4
SSDEEP 24576:Tzy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T1LNiXicJFFRGNzj3
TLSH
T1ED650257629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 021b7a953fe5067126a7356b98030db4e8979debf0c5f6a69b65219cf50e77a1
MD5 0b9075a33a40f7f215d18289066321d9
SHA1 bb11ff8d33d13069342d01ab0ceff61accfe5ba4
SHA512 d0b59a0e00efc1e94a62dba82a7937da1d534062d62702e9bc980a13e19ec7493e582fac25052c240eccc22140958fe0ea886183bc42026774c3d9e36ac6460b
SSDEEP 12288:xjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 acf2fcfd9ff72eb2f97d07373f198b3f77aa878a7666d004884f24e210c619b3
MD5 3d440dd332ef38ed53062cb06145d80a
SHA1 35088e6b794a86fac382a785c23a096ea4809d29
SHA512 141eb5b36497f4dffc33d154174a0f16f7796d98cd8f2806aa920b572a2b35e6aa7faf9af79cd560b94f0d08f61c37c7db0c8d050ec2b21cd9b68ef9f4c8421e
SSDEEP 12288:kjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fa8ca7755c2ba6aa069ab4d3fc86c491676c8ffdd94c85def66f8a7133c5f88a
MD5 35c49165e1124ade62488d43531c4f7a
SHA1 8551b4a52fa4d6ffc6440cf1483fca21e61ff413
SHA512 96a32de6f2df8094f82115d56fde1d5b54e73edcf5c7cce00fb4bf2c677e590af9fb239ad2d014630faba4465c843ead7b90b86f456b8ac3d7819cfb69eb5a30
SSDEEP 24576:2zy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:21LNiXicJFFRGNzj3
TLSH
T14A650257629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3b2ba14b0501bba3dfcd166dfb366bdc1e061f666dbcbbdbcb9e56194c3cce74
MD5 b05f77c5622b6c863b3d706576ec50e3
SHA1 be17c097471b6a3abb2c4c573b551c342b71bfc3
SHA512 345cc0994222f8a2fa1dadebf87875513eabca1a25d3c9d88bdff0aa75f82422cd7eeebddcac21cbb3f04a487b01f3e9a10625b228c02b69c394dc0d482f7c58
SSDEEP 24576:HT8aLl3z0zD4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HT7LljtLNiXicJFFRGNzj3
TLSH
T14F7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2bb3963fbcc5ca036ff2cbce08313b27875b94fbc237e8523cdbc3226933ea76
MD5 46b1d7ece8d6c472213a3e1186d2b634
SHA1 165a104494701b7013e36ab5bec8836702e380c8
SHA512 5775152ae8e342c0473f158a8e76075bd9dc357268b52819b8f6345be26aae795b3502091ad8302db9b5dd8182d99271bbf2f274b89184b9cbb94a14b23da424
SSDEEP 24576:v3rd9CHKy7GZk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/rd9CHKyaGLNiXicJFFRGNzj3
TLSH
T1D685CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 35c2e1240434a1ac4d20996c24b47973b474d6cf2b01488b5c253c93c6cc117b
MD5 efafa3c3f671ff6ed15dabea20337eeb
SHA1 edbfe31125e4cdc6ac3c94d9ae7c3aff0a163bf0
SHA512 3efc1ae2d33816a62593749f6cd573c316d80fa352cf9833add05f100c29657864e1564cedcdfac582c5ee6e89a8b340ed151bf81494b538f8eb1e5222d8f170
SSDEEP 12288:weiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D45523D3558955B1EBBC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 52b474aff2b8c547a1fc76a26078a9795c5fbd615ecb61747f0a79c3273d1f3b
MD5 4155262cee64a3fb44697300e5e2e735
SHA1 07b6f11ff8e0b6e196e2229a0747933b2e87f76a
SHA512 2fb4b5dc9682a69ad153d315eb753201954d9611668842aceffc233e4878d5fe7ccfc57add50ca53504f17086eb614710f8931eed4308730216017cf09b10e75
SSDEEP 12288:j0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:je/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D2558955B1FABC0039867A4428F5882E2DDB5619E3E3483D1EA27CFDBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5f641da433219cd0a67efce2d1f73fa6e46037538a708e1cc5acc5f1991381e7
MD5 8211b6d98e37f85d4110291dbf6d072c
SHA1 508453382435f55e7ee991344be755e039854984
SHA512 d6c3a8d32144a2731688698123ae55e5acb0793e8bd9a396ba04facfd97cfb96cc96da47d929c94c4c1024a169609e2bbb9222c68218063923c13a48eb6107dd
SSDEEP 12288:SZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3558955B1EAFC0039C6754428F5882E2DEB5619E3E3483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8c83e46992e9c5d259e5d9446a1073ed5c7e1a6f8fb4c001fe8e2dacc3b00ab1
MD5 d261ac843e4ffa8ca89adce5397910b3
SHA1 cec669c015effa7b7cdab94ba050edafae5feffc
SHA512 72224b47bb4d1c8a5d312103c377e85277f4cb4a1ff0a1f03961410fd7b3795bc89a98ddfa54eae8616165e22d7ba0cc6f84efb5bd50facbc4f3482ec3955c19
SSDEEP 12288:PjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3558955B1EBBC003AC6754428F5881E2DEB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7be122e212a6c7a75eac68a21e9d4393da22a3989be2422324bcf85328c83a35
MD5 bb660ae977a7fcb48cb4ef755b8835bf
SHA1 99b0458e5397bc97974c0f430711bb6089040386
SHA512 3eefbdcca0b3f589cfd36e33eb0ad9faa65fc893019ddd152ec288fba1f2e3dbfc6386a37b6442e14ee198169bd04b5ef4467f106b0879a2872e35451e762834
SSDEEP 12288:FeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523D3558955B1EABC0039C6764428F5881E2DDB5619E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a4c32beee764b1c8f0d0289da3a41616852cc6a008d8d148062cce5574196e8e
MD5 b4bf25f1e068400404ed2ff0e1d7a4a3
SHA1 6b80f92dafb3b027718606c08017c2e01cea040e
SHA512 82058a5d202ac204dc927e6ccd7b3ad77ca1c34f10d7e4aadb0c5f19a8d629e925c4a8aafdb4112531eabdf1bd34899f8bcbb2af70067d15869d56e0b3392b3a
SSDEEP 12288:/biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3558955B1EBBC003AC6754428F5881E2DEB5659E3E3483D1EE238FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7c9beccae10ffaf622eedcb4a31e75cbc781d6b50734aa6e9581b9aa18ea7964
MD5 d0353148edec1bae1c7251bc07ff5efd
SHA1 033f9bc1fc7ea021fdd11ac54749ab0e671cdb0c
SHA512 d1d1d055cdffac5ebd27c85892d6e58468daa4640a1dfc0cd81f22c4980304d4e42a08443725cc2a89727a1e2f2b01311cd3fd9bb15b7fe2296e94e4d75f669d
SSDEEP 12288:WliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D3558955B1EAFC0039C6764428F5881E2DEB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ea8311415c429e4506668b29ec177e45874f85636aab29b873bcdefdb91f8bfe
MD5 d12456f590e691b5a23c1c31150cd222
SHA1 1ed7965f3acbce04d41e4ca061f4084ab3c9c3b6
SHA512 f7b695ad821a6b30d3bb5d3d508c209ac4cca4809d7560a4851513a1b8d5c68078cbd5aa7c8064ad1eae31034fa7a2427941beea2403363794ad077666d3f151
SSDEEP 12288:PGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3558955B1EBBC003AC6754428F5881E2DEB5619E3E3483D1EA238FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 dcb2d84a778bf02d58b2ee35bc2ee8d8fb5dc5c68f63d7b0cd9faf35b5c9a38b
MD5 272cfd0f9e9a09eb6e46a7270f1603e1
SHA1 ab53a882624fb849d1d2cc06b04009fa3071bfe2
SHA512 b793918df2993570c951cea53a3d73471c7942f82fd4b2d2b3d626c07922eb1de254676a0c536f46a238b4ff3464f13017d36f0afb74822cff8fecde5f367d60
SSDEEP 12288:FliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3558955B1EABC0039C6764428F5881E2DEB5619E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 723b5073f7bb308902bdfb023b5b067bcfb974f1881233e077af24a6281ee74c
MD5 6ed77f6c836d7a8233194efbe0fb5828
SHA1 d545578d75058d05bf9b3615be15d81415a112ac
SHA512 50a38cb9e79796b660d96e4f34f09ec5aeb2642cee5ae4be4079976a1d97ccd00ec1621937b30c8ae6abc7fab8d0510d6063d8a23357212aa7df977d317633c0
SSDEEP 24576:hfwvzk9RX6wkyAIL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AMnYILLNiXicJFFRGNzj3
TLSH
T10185DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 098f7400dd4734845acf413ad4600bd3d32f1125647c19a4c5f556c82547f602
MD5 243765d0172c654fdfe6a4425fe05d3d
SHA1 2b81b661d4efc57afcf10e8f2349560e456a6ca7
SHA512 929e95281bf5b338cc2b643daa3694a1f22c9ef18a4a1acaa4fa9a314ba42a9809197e4633e1e835b2bb3f59b56e1c7cc5e0f27767de9d148fc920f2fc88d159
SSDEEP 49152:hYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cLNiXicJFFRGN:4ySzPk7wRGpj3
TLSH
T174066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 87a07a98323508597dfd860b731c2b20ffacff557a7eef2e7a592d39a318d275
MD5 8c66074efe4cae6dad91417dd0cac4fd
SHA1 f3f0d3b6aa1cfcbac193d28baa76d42ad058e41e
SHA512 21b507774d08da5d7c25320af24599d1ddbee86752263d5b1a92890db82aa8b306d39f34f426d75d0a178cd46f031c6980c85eec6eaf5451dde6254822b82c99
SSDEEP 24576:f47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T13F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ac0aeb98e873df8f3042fd364f50b08f72e7de67a83e7be26deddd089ac7fbf3
MD5 a12536859f10865c13d76b3cd2f1a0c3
SHA1 9fee38b36a899ee46f99f78127f1e84c10979cee
SHA512 d6cae3a4f6f14da07ccb96005c58e9b72e1693bed23db1288713e7635c52be0cc6d8811a99357e19e27906f1106a27076bbda4e357131d8b69d70b3a1e7ab9db
SSDEEP 12288:apsfziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB53D0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a863250a566157673cfd27127cd15a32bb8ee81556968346c2cb2ce06f607c4c
MD5 74fe81d3a2cf147bd8419a2817bf063f
SHA1 70f3211479e0f97e74e29bd9c6d5d936a3ccdb82
SHA512 db8a6702f88c235e431b62664049eea19c470f3e0576c8d5a1397335d1c217b69c556f2ff203cdc0001e3cb4e1ec9916d2c0e89e374af0d8c29b218329d35852
SSDEEP 24576:RZsaDUPw3sfKn4pshG0QadRMjop0srDX:/DUYcfwKV0RdRMjoCsrr
TLSH
T1CF4528017626DB4FC6A940325E36D6CCA7707D42EE44AF0373C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 0b78d7f048bc9eecec517ea6c9f7e03c0662fb341400267d7f43e14f6b299749
MD5 7348f8125db7aab3d1b94cc060deeca8
SHA1 542b8085457719419fb4e2d33bcee06dca68bc32
SHA512 1d7b1cf6caba85a6bb1bdda464ffaf2885ca742233e45691d1b67bb2d4f58ed7216c75d036da837aad61a098794634001daf08cd6007f704b647e4c415649204
SSDEEP 3:OlH/lIbdzGTV4yl/VVjCUC/ll5l3y8jK63mCllltGlslslslslslsl69EQl//:KatGTV4yt7CvX7VKcmCtEEEEEEENQl/
TLSH
T16E8192D4474107A0CE95A131690847BC0322D44DE4E2ABDB02061262AC312649C1AF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7531bc104feb4360f931841dd845b36fee2f96b0e244fdae409db82747a0cca6
MD5 a370375ee766b0a48cf3e232d0b53305
SHA1 024b3bd1ab8e7262a3efb4e12ce1bb5ffc94ba56
SHA512 3f5deebe934a0ba18a046c6a6625d9ab1d573c9d10ff624bc3b55fd0f5f35c8889aa2be934e39cf518819862144c04bf32ad2bce39935793c4c86bfbbe759eef
SSDEEP 12288:IomsMNSkZNvyyg4w0KMxkU4/iw/0WrFazCbQ59m09xrf9dTk+NUEjIG6Iy2LTPWU:hmsQZNUU4/iAdhunm0jlrjpyiMy
TLSH
T1AE65080165A7EB4FC97A8037463296CDABB85C03FB453F057345893C98A696FB5E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a2caea013b404bc615c4e3827bfb19c4991f56124742db1b487600eb45d2b108
MD5 f8d65d4307533f1a96917b3667199ce7
SHA1 ba79484e191aabe09f01cb82a73589efcf46fd4b
SHA512 8b6a4829ce21b682abb40f395261d2df92e59134460226b037427299cee4ca5bd8d523c0f78774e7095afdc57745813a01be570bc2d7057c89ee107ed52528d9
SSDEEP 24576:L//TwSfVcYG3K/cJHlnFR+IGNe8j3IzQ:L/LNiXicJFFRGNzj3
TLSH
T1A25523A3428959B1FAFD1039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 de344319a581fb19060df9dace1833544be6d909669af4ad2b11d332a087ebef
MD5 8167a62eb8e0645314d95554350cb602
SHA1 113bba8f9948dcd713785e56f01a64fb6167c6a2
SHA512 578fc5c16e4fba702a86b8b5d293554d5389694309549040b58b7d38b3789cce2202feb2eb844a6a93ae13b9e67b3f3947eaced9081dc9938785c9b5e4ca1516
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ngb4mBIBhGFKLNiXicJFFRGNzj3
TLSH
T12A65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 748c4bae0d8be432b8189ccc5bd1f99b89552ee514e9e000b35f5a2b164127fd
MD5 bf048b3f8e03af5b4f9f8ffe136a2acc
SHA1 f9cb9e49fedb61601144fb1c8cca207660e541e3
SHA512 0a61a091e045e5ec6121f006eed38f29ee0ad65649b4034f2ca6f4dde2a44d2b379a5704ad3a2d79bc9b45d8504587b147e6ce4056c4f322c8a43cfad28fbc10
SSDEEP 24576:9G88u8FpJqH1vzria7/m6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q7ZFPqVya7/lLNiXicJFFRGNzj3
TLSH
T11A85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cde3df671136a5a4de3b9ebd2ecc6b4537dd8a12dceb6c81b15f6288a5c93f2f
MD5 5b26b6faaf9ba48fe66ddb007630e47d
SHA1 e4e211ef0cc86b0b8de1d200696f1c2b7b963719
SHA512 5d6d1e731b23f38cc56c8495542e9883ee2a112e3a7323ba6e912e897d9967268c230212d5c5bd54b7f2c9782feb623dfba6f44cbe776d9e89494ae4e02c2cf0
SSDEEP 24576:5PUr+NQG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JQGLNiXicJFFRGNzj3
TLSH
T1DD65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 11cf56a79dff0f74371932397226896af94d1cc9091aecde7d85a0d1eeb823a3
MD5 809a2043b0cb26623781312ec62231e4
SHA1 b738f48078a5a695ba4ee2a4232ca665aaf8636a
SHA512 c15d44dc804c5ad489da6b638a9c048c023d76f6cbf64357f8e0f78e7bc08d81c41475521eaf263a9e5485c0c6b267881dfff473366ab30b05d11ebfab6304ea
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2LNiXicJFFRGNzj3:VG05lO43bD7wRGpj3
TLSH
T127D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f0d6e3b236df465b9f57424fb53e72db43f2fa6bd0c2e49494b01c94dff6f39
MD5 e1f353570127c0d26eba081e4833601b
SHA1 49875776cf467033e028337f9bd528979f00199e
SHA512 4f545f483bad01a0ff7135ae3ee4f876fee971370e72a61d0c73b322e4405bae4f5a94b4539fb0f133023b8e41f67cd4d441e8d23fc2c6c565604022f0382b53
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidnc/TwSfVcYG3K/cJHlnFR+IGNe8jg:qa5POZ3lJt2pasx2+meLNiXicJFFRGNf
TLSH
T1E965BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 89f2b77117863cf4c6dd5e843c413e7edbdf30e3f017f65f804c1c82306551a9
MD5 c4bb0fce6514d2851ef9467a0fa89fb4
SHA1 48195b85b9e15d81ec989d516ef48eeb3da8b6b8
SHA512 c6cbcfaf0c6d4749b59c48933568a8b72ed5457322901d1a80361a71743251f8c226d4e5b68560e2a07b1c936115c6000a3d1ba9d2a0f1b93ecef24cb487ca79
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GNc/zEOVHFFLNiXicJFFRGNzj3
TLSH
T164858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1539873b0c82ed34ee6df4fd355fc962517b52f14bd2183bd02a64f18f3600db
MD5 b556dff6a9f713ef8100ca2ac35a7cd0
SHA1 a0f18be3edd484d23deee87959b45ad26ab50897
SHA512 b800a1b8ea80d6f202bcc6fc3bf0786d75022062ab1bf962f099f66338d967fd40b5f9276ae96f2ffd2214e7600f05108589e3a6ad331719724919eeb9e2ab8f
SSDEEP 24576:uzkNvNnaFeYhJNtmZBmw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uzMwBtOmwLNiXicJFFRGNzj3
TLSH
T1DD55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 652f27778aeeba6fde11c1a39e4d97da03b8bf42c362a3580c895223b2826fe0
MD5 1198d74d04b05ddaed292ae7d3d97b44
SHA1 ab96a9ba3c5958819a1a979eab051e105dcc33f1
SHA512 e57dabf7b0ca890bff67ec9ef2777a871b96b076445dd836b44113a5709d852d24a4651ad959bd15dc89c9a95f3acc11c3b3cf659fe5e4c12e59dc106d125d36
SSDEEP 24576:KD3FHshBIYQgAT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KDVHeBIAATLNiXicJFFRGNzj3
TLSH
T1F675E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1776-140-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1776-146-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1776-148-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1776-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2192-394-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2192-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2192-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2192-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2700-393-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2700-132-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2700-126-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2700-124-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2792-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2792-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2792-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2792-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3000-360-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3000-89-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3000-95-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/3000-90-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/3492-46-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3492-59-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3492-47-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/3492-53-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/3492-57-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4264-0-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/4264-6-0x0000000001190000-0x00000000011F6000-memory.dmp

Download

memory/4264-7-0x0000000001190000-0x00000000011F6000-memory.dmp

Download

memory/4264-1-0x0000000001190000-0x00000000011F6000-memory.dmp

Download

memory/4264-75-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/4264-244-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/4944-113-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4944-391-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-392-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-119-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4944-389-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5796-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5796-61-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5796-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5796-358-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5864-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5864-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5900-84-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5900-83-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5900-359-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5904-13-0x0000000001040000-0x00000000010A6000-memory.dmp

Download

memory/5904-19-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/5904-17-0x0000000001040000-0x00000000010A6000-memory.dmp

Download

memory/5904-227-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/5904-88-0x0000000000400000-0x0000000000ADC000-memory.dmp

Download

memory/5996-106-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-100-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-405-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5996-407-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download