316a6313ad928f2bc7ac55c6dad258e34203fa98db173c35238d425799a6a1af

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
Size 2.0MB
Sample261102-2zdsjsxvdy
SHA256 316a6313ad928f2bc7ac55c6dad258e34203fa98db173c35238d425799a6a1af
MD5 c75f1c2380931229782493fdfde67b17
SHA1 6dd98b834b5707e887c704799889960bce8a945c
SHA512 aa2072138684edc2c68330c850c5902a579cf34f65a49db6c474fae56194cd2f39e7b8f8b9fa432f5e345b09e3b4a1a08ba744ac942f6868d7454bdcc831d2c5
SSDEEP 24576:jHAo3AdBheQgOjYTx7BzCTPkBzWk0NYI7ZlWRl/ERGiArdCN/j2GLl3iFSE33b9:jg57iSTPWz50NYI1MRlpizN/j2U4FH
TLSH
T1E4A5D090EE8D816DFE731171CD639B3D17216DF347E191B3A9803B5A7A3E090696BE02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1300	elevation_service.exe
1480	elevation_service.exe
4660	maintenanceservice.exe
4148	OSE.EXE
1268	PerceptionSimulationService.exe
4432	perfhost.exe
2412	ReFsDedupSvc.exe
5936	SensorDataService.exe
1120	ssh-agent.exe
5000	AgentService.exe
1240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7b141c50b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000760af34c1e6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1300	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe
1480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1300	elevation_service.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5000	AgentService.exe
Token: 33	1240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1240	SearchIndexer.exe
Token: SeDebugPrivilege	1300	elevation_service.exe
Token: SeDebugPrivilege	1480	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4520	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
4520	2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4740	1240	SearchIndexer.exe	99
PID 1240 wrote to memory of 5640	1240	SearchIndexer.exe	100
PID 1240 wrote to memory of 988	1240	SearchIndexer.exe	101
PID 1240 wrote to memory of 1448	1240	SearchIndexer.exe	102
PID 1240 wrote to memory of 2244	1240	SearchIndexer.exe	106
PID 1240 wrote to memory of 4492	1240	SearchIndexer.exe	107
PID 1240 wrote to memory of 4864	1240	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c75f1c2380931229782493fdfde67b17_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f4b903bcae8797aed80de5af4aa599d20045507c07a40a3dc30f837b80e65857
MD5 251fb20d9dbf3cb443ca1c7efa9dd813
SHA1 3d4982d9df9aec5e52e5eff0c5f3a1a8da742803
SHA512 2809e775deb4258c15b571f38fc2ea326dfcf06daa72e6e566a2da61384ba03ce84e8a14c2c54685dee803ebb66d5ad1fed2170a7bbce1a674e0a38cd7857df2
SSDEEP 49152:Nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTN/j2U4FH:T3q6sjB0j2jF
TLSH
T1AED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 71706734d559f610e8511470598993639348e53ec9ba61133d4a434a62cdfd0c
MD5 1e2606ce95805f34f809a8ca7a8e7ce4
SHA1 751d4abfa0a0cd30ece32757de9268624afe352b
SHA512 415bbf5d07132833392bf2dbae49b01bd4f3b802d6b60bbee169cab3da44516ba4925dc95ba7e2ff5af0a877008ca00880b945b30d5ea8e1e1864f42bfd7d5bf
SSDEEP 12288:m1XLsswWkxy2lRq2czAXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EXYfDtczA3dCN/j2GLl3iFSE33b9
TLSH
T19965F128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d86a31bbb8e775b89002e6c0b976b9b3f90fbbfb3e6fcc04dcd0f4b41d90b6f5
MD5 a64835fcbe5b495703f4d75a91d19d05
SHA1 d5985d8fe3032ba9b93876468bd825932a0317ce
SHA512 ba86d6b03e63f709963efc1b2915aca92418de397ddce4977d358985c11f4e44c7e07230fad74727ad3bbcfb316401e9f0ce573c383618f48f0b6a6c76fd0c9b
SSDEEP 24576:20Le5ji0hmxxrMwdCN/j2GLl3iFSE33b9:2Pji0AjuN/j2U4FH
TLSH
T10285AE26F6748335D073C0B9C5D2A69AEA7130855B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2753e0f3bf8163f11e48279568157ead191e4c16f95329068b6f9a2c9ab07e5d
MD5 d8c00f0e4bb58cf43abbf282e5eec7b4
SHA1 b646f6a56da62aecdad65eda3ad3b51111dcd108
SHA512 5a2cf184ee713232f0c004b2d8d1c82fcc54d6cf68490c0761d0ea43cca4ef27c7a28ba7afbd681cc07f36446bb397f2a61f4e6b2e6655e04a2e6bbc63a68952
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuWdCN/j2GLl3iFSE33b9:W/ezSC6vUzPveHjy6N/j2U4FH
TLSH
T1DD755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c5887e942cbdf33953f084ea46289ba2ac4c026ab78848da805cc6d0377b098a
MD5 326124bb759fc16a946244b107cb92ce
SHA1 fdc43e6fe7b1aba569ee909dbcda02befb16b3f1
SHA512 9221530de8d8df267437f18484187a9455938a14cf09398808de85e482d6f0b03e9e0b8d030db872d3858996392380baa5ca05844bcab7f5845ff255d304f406
SSDEEP 24576:bVbqPb88hv/l+YbdCN/j2GLl3iFSE33b9:bVO88hXl+RN/j2U4FH
TLSH
T1E4559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ae58d1e55dba423c436ff5959e97b01c889178a65878060ec84e1efcb3cccb7e
MD5 3b560a088cc361ba4c31ec2f998111fb
SHA1 dc81e3b7e0f44067a8addbba5e9dff09003e576e
SHA512 dced0850be544a336a69e20ad1ae275e25096e8f02ba31ed458ef3b37976206dada8050f996673067daaa706858e4c2091d06832f47f2f19e000732dec1b9a2c
SSDEEP 12288:vLsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vLEdCN/j2GLl3iFSE33b9
TLSH
T10B452360DAA5F565F26F837903ADEE615200FEE8E925884785917BEB117CFECC032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b4f3b3812faa013a7a8e43a329617a0a0a2e1d4764768fcbfd32e95c1a68e6ae
MD5 e69dab1e005fc5999fb2e567094857bc
SHA1 5ccb148b56b3dd7dba52d3d8b53c50e34189e1e0
SHA512 0051f7d4b84b438de7f5b703ee512fa3d1e9170895d83d6be40f871c07809f5585d2d5d1cffd49fe825c7df270400ff4d52673dd1e1a28b95024ef5fd8ae9514
SSDEEP 12288:qeBNUbTVO86UbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qJIUDdCN/j2GLl3iFSE33b9
TLSH
T11165CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b92b11e76cfaf47d87e21ec0447f5b4a6049fc228b8ff140e7cdd347c32a023
MD5 6967d7e5b0906f57c890b22ba7adbc19
SHA1 d8a51e2cdca7e6fc0716655215d87e6e45c19036
SHA512 ec5e14756c1b5f92d7254943e034f45538d2408b6e9b62a8c87a36e303a8db040e47f493ac5623403121107e4185bec043ed1116426f1c3740e0aae94cba0e6c
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:fQvGAdlCEL8c/DRNw5CHj2jF
TLSH
T1E0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 00001766a738e84db4d62eac813b171d12b7e14c426e3c190a61bdec052dac3e
MD5 c0c4c40ea3203ec6e2d515282d92d222
SHA1 89785d628b8fd83ca485251f8d8abea2ac5c5726
SHA512 4a10103cc4fc47382a31d1e14e64a08f85a31eba10fe7ba4d21caa524e34b67c34c467693694f2bc8fb24df9b0b60998d01d8e443c256db03de65b59954adec9
SSDEEP 12288:TAwSfxL/2Dc3RDLLmt0LDQewsAjdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:M0ewsAjJdCN/j2GLl3iFSE33b9
TLSH
T1C975E031FE74E036C27F0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6ff6dd9ebb6b0afa17a42777b36b60899ff0684e99f1275d7d09553c1bfb8797
MD5 f667976594c1f43f639f24bbb46818b4
SHA1 e973f7c0df648a7d248e0a6231ff8954f604c345
SHA512 0acd8a1658b9cf78d3ac23bc79b3130c9ea3b37feefee5392cb4eaa0b68ea32edd1e52a48338466a472c05fb1a32fd24795261fa8eeefc770231c79359689242
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHO8F:fUEtQevvqc2W1cpV2tI32O
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 62735644de7894056a6e4cac633b451e22f175e79ddf060bd24849f7c3b99fa1
MD5 7ea1d6ff1a612b367f8a3d6d0f480691
SHA1 726938c22c4ebe18ff37ff7901fac9fdc63d3f88
SHA512 fa929374722e8b10ef8930a93284b4add122000595270222d1865a4e994359b46b97cbd1d08ff0f2cc8ab11eb16ba9aa7c7d4008ec12771d09289c8393415d1c
SSDEEP 49152:8CbRquA/m2yL5zTfFiV+XenmE3/z+N/j2U4FH:1oquVjnmLj2jF
TLSH
T1AFD58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77c74029a7bbad34d79a982821730f8f1f601f9cdac66988b6b955bc75dd4b5b
MD5 90bacee75914d4a6023272c3c424a500
SHA1 b17e22f511c2acd0110724c2e1dd4cd927bf6ead
SHA512 1b304ad36655e48db1731e577c5bb9fd4e437d0759f61024f46b598d2255dab10d6e67b5f396b7cee785ef7d6380a97537055d9969e7ecdfebcfd010776fe3a4
SSDEEP 24576:eAhGL3IFoiwtA5l7S53CdCN/j2GLl3iFSE33b9:eAMUFoiq5VN/j2U4FH
TLSH
T1F735AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7a6eb1927d800fdb32f1d5c5bb25e7c76e6b4fa2be765cdef627da89911566fb
MD5 c0eb5264319ecfe7a5c5a3c86f8e3cef
SHA1 b1f51da7d8a243882212760d4f5fd9705fb63f4d
SHA512 c91678c9870866a40b58f154c8173a765e50f80790a8b50ecf894f9d2d97df688237b6f627a308bfbf720e4eaf21d80b676601672214a9b0293d4d40ed9431fa
SSDEEP 12288:dmw5HEjsChNVBFgl0WDm+CKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Ywu4OWldCN/j2GLl3iFSE33b9
TLSH
T17B65F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e3d832d6710547c689386d37fbb84c196663e54c8040f3287a4bb54dfd121988
MD5 e205ea539acd82b7bd7bedae06cda7e2
SHA1 f564494154bdf3d364ee8e8d06049afb04a4e9ba
SHA512 6664531e9a99c24ecc44aea9d8e6be68d89ef780ebfeebe61d3a83d1c77af25ded3b0f5c2e18a583be8a8981b5dc41799e1cb37987bd936b83d1f11d88d025d1
SSDEEP 12288:LeZ1IytJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qZuYdCN/j2GLl3iFSE33b9
TLSH
T13355125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7f94a20887011c6fec2023cc4067071772846a3bd344112e7927689df984206e
MD5 24dfd64bd2a6e5294065ddf35bb475ef
SHA1 cbb98b87412d8307af257148d78d603947493977
SHA512 a21bbd906369cf582c7de87dc1b51c7056bd816d0ab4773b1d524ece60bbebaaf70da631a61e9f6722c6e7d78dffaee7b38ceec668aacc6e9795bbfc57cf6bae
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:VQRQyi36YOcPbLvw2gAf+PN3gj2jF
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e5893176e1d5f236c14e0579fbdee1e2aefd00308d35e2f426f6dd4e9720d1b
MD5 e2290c63a6e89a94a7dacaeb4dcee864
SHA1 08bf0754ff4c5c47bf92d8d634eb566bea96c022
SHA512 608592f693833c8c620985e3be6e848db9fddba2e746d6b53ff70e2ea66b19c6a405fe9035addadd95c215d5efab7ebbd63666c4ccf01096b088f99c88627eb9
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:TQRQyi36YOcPbLvw2gAf+PN3gj2jF
TLSH
T1E4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 72c9488b2995263cafa5ac37963bb9007a7883ee85c3ebe34325df05ba1885b3
MD5 eccb0c216544156ed9045be4c1b6de8b
SHA1 19c426bbbb8c70383fa946b82308e118d86379c4
SHA512 63a93812ce61f737ceefb11ab37a86a6f3d1121cebb918ec802880cf12256b67a8a7bd064ae372a50ae9968ebe762793762502a695fac2ec1cf8a2a388cb9f1b
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0odCN/j2GLl3iFS+:k68Qg55nhceWu7PNU3/uN/j2U4FH
TLSH
T165B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 031329bfb138f3b93ef3cf8a45d27c7fdbf7c56b734878072dd1cc364eed64e4
MD5 f0d01924194726c3368b566f659bbcc6
SHA1 356c0728374794b6973cf885ed29873bfcf3d81e
SHA512 555dfd4114a95c215602b2b774d5f0f9d2e8a2da7ea32955278d775c38018fd6bd02a341db417fd9152b80fba935646365688174c1dfe7396aef9058fd72e1cb
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:sy5112gYy5azzVvt69nLKnhZxj2jF
TLSH
T1DE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a5c42ca8f6fdb0fcc2ddccc4e5dbee9ddadcbeaa8f76b7ab32f561c01cb37fe4
MD5 fc3c7065454917cbe740749c86d31822
SHA1 f1ec584be6d526e790316accb12ff81eae15f8e6
SHA512 16e462e436ad40a4ea1de209535555b859c5a730c4cf265e0c951341ffbc1a8af99620146462dd81b18e4346ad133669c6cf086685bf5d2dff68d062d1799dfc
SSDEEP 49152:0B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliN/j2U4FH:uu6Jmdxd2dyj2jF
TLSH
T1EDD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6b2df1e538386d51c221408f84e57b6c6841bac6bd1d601333e3a5c20e8975d5
MD5 7b6400de2fe026d6b93c6c508cfae28f
SHA1 8b3ee83a34d2ede7d02cd7a7d1e781726006847e
SHA512 e3a7203724fee230ce3868a57ac024098ee95d492ecc2c79dd4e6afcb7b310a60df363460484b2f2845d09f397b50e9db2219e7cf01c3917606356f5a77c90e6
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xgN/j2U4FH:ImifPWRLj2jF
TLSH
T135B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8603a5aa90b786c1ea0009c4888ed904c309b179c0eea4ae8f597ed98bedc8f
MD5 59e7143b4d337560669efd313ad86d01
SHA1 9ed95ca03b8927c401ec8ecc511782994a52507b
SHA512 d6b71fad6a9b761b56c8edd52f17672ce1a2a998adcb6d7e1897b627fa4fd46d97392c1a9e597a04958c30b61c3fc0ff3f2848bd7b488c6894e80d776bc4a462
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqDN/j2U4FH:H5dKii61Nj2jF
TLSH
T158C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7d0f03701f5b7760cfc402b4af02a61e15272b9e575fcc1431697637277371b4
MD5 834a914f019d51b22ecff45566a27ecf
SHA1 4d9df469cce87d9635b272226797c1167d2f59ed
SHA512 58d48f85db7c3c4db66d2d6434174c5c8d7b5e45d4c1d4f10e1977c6189c2e5e9156d97d7a824a1b561ba95fe04ffc16dc728246cc1cc682f1f97813bad31a0c
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5wkN/j2U4FH:1X2imphvj2jF
TLSH
T14795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 014b87d9134265d4030a08da47bd01d50128f404e471f1749d44ed543ccea7e1
MD5 9024a4d80f3640c112e4ad93bcf9a224
SHA1 15adc9169cb97119bba7b4c1406d5dab209bf3ca
SHA512 678828924312b4cc66efbabf86102a62294b7675bd2d69991c427e694df8600546437046952aff06eaedff6cfb36d50b66061addee0e5ac2cd7871d1c6356095
SSDEEP 12288:okJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oMdCN/j2GLl3iFSE33b9
TLSH
T17E452364E9F6F669F15AC37D43A99B555200FEFCF6264447828116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e568cac1fbc319709d432e2b6cea063646f867aca1df90bb53023ba535140b8c
MD5 67d0077cc9861370e7e629e8a130d4fe
SHA1 84e4471b3798c9d5ce097877bcd74a57bf9c696c
SHA512 bbca780da5cc17587a211dafb9b922014b0e9865a5b311e14df8aed2234ac29ac024fcfbbb77625b3da0110993306c71953cf99ea1f0dd0f332a4b7cec5ba440
SSDEEP 12288:z5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zddCN/j2GLl3iFSE33b9
TLSH
T127452364E9F6F665F11AC37943A99B555200FEF8F6224487868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 85acd0a3ae9cdc7104220bf4ce979c1831fe152424060b10b59bed7fb01e1621
MD5 cb57d906f678836ffa8605b035fd7e65
SHA1 ecdf65718b0516e91be725ad8daedd648d3abe05
SHA512 596c6a0b8078e5e43239ed3b4d75315e2309faaaeffdb99ab9a3da4af2815b4d742ea0ed14d965adb3d784cdc8d977cc1afb0cdf209efd94c54d0b0b13e733a7
SSDEEP 12288:YTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YrdCN/j2GLl3iFSE33b9
TLSH
T11C452364E9F6F669F15EC37D43A99B555200FEE8F6264447868116EB233CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 33964c88208e52149100bc40d67d07202231fbd304b5048a41974786e6eade56
MD5 abb20e8786cc69cbff5fbd1397378a25
SHA1 16d21dc667eb74d0678f0760dd592086df7fdccb
SHA512 9dc84e51b0620211b3b10affc3651102d5efd15124092907e9fb1aefdf9695e56fbe112ddbfcf76d7fc08eeafa7f655095a5ad74bea52c6e684b6e6784334138
SSDEEP 12288:YVOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7dCN/j2GLl3iFSE33b9
TLSH
T191452360ABF5A1D5E06BC37C83B59A11E320FDE8E73245CF87411AEB1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e91f38c683d49bce0e308ffb60e61d51fb09f1edb2bf6aeb30e82b1215b7aaa2
MD5 c64d6814a16291479b2665d13b5d8760
SHA1 d785a30574e69896586670a66efa77a780550146
SHA512 4dd59bd78663a102e0baae173038504285fbe5544ef4d8d47ae735cf1e74b58bdda5005023a049875c9726dfcaf65059dc43826e5005c708ac4b50175835cac3
SSDEEP 12288:zWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zadCN/j2GLl3iFSE33b9
TLSH
T1F1452364E9F6F665F15EC37D43A99B555200FEE8F6264487868116EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ebf247dcdb8454e89868bc0f9656dc18d3bd1ee89909e06381c57e13b4fab711
MD5 44cf2c2271ff4bd7d332d289ce442219
SHA1 cfbf3894f66413a1fc7cecac6f401f52af8645b9
SHA512 5236cd550c6bc62a338f915e0c1e0fa9c783a4443f2495dd3bb3dda54561b9d79bda44efa8859fbf9cf4002b6ca4e896a0953697372dbb457447dd45d45d6ffa
SSDEEP 12288:yVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yxdCN/j2GLl3iFSE33b9
TLSH
T132452364E9F5F665F11EC37943A99B555200FEF8F6224487868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bbdb6c3edfab8144c40c67d6be1fcbc5af12fc47b83134494a15be0852be3b17
MD5 75cb1ea2b2a5e2d40d3f76e7bc1e4634
SHA1 107c22b92a4b5e5abb30874b28fb106ee3ec92ca
SHA512 4d3df300d376d90f0d6e05f45df3f172c4a37d4da9f6d352ee63280fe2429773e971fda9a39141fec040fcc9849dd14c2c2e0d352077d4ac4bf338dabd00f47d
SSDEEP 12288:FBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:F1dCN/j2GLl3iFSE33b9
TLSH
T118452364E9F6F669F12AC37D43A89B555200FEF8F6254447868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 aeb5fd7dd758a248f3aebcdf3772908ddb5be2c7f6b48ddf61d103e2998757ee
MD5 daea72f6e2191061b1979e3019be20b4
SHA1 1e909fa4471ba41e97032c72498cbcf140728f6b
SHA512 d3efa38670908beb9f0a5236a107a9810879f2d180f1747433855374d5a8704eb80afe04317066660b6b223b77b717f6e2a9499b31a62b01b7d8d15eb5688444
SSDEEP 12288:OiZwbVzzFEoS2cPvyZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xZMRzFVSO9dCN/j2GLl3iFSE33b9
TLSH
T1716502A4B3A058F8EC67823EC9658906D271BC594770C60F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 916f7524f3595ebfeae7f83d066a5bea336ccb28aeb623275192d902355bbac5
MD5 40349c5849f5882223df9a7cddd419b3
SHA1 c4421e8fedb5dea5fcf6cd523d6a0aeb1e8fbbe3
SHA512 5caac334196832860a4468a840bcbb5e4bde47e236ec81cbcc7bbde1c603b8a58c68eb1bdde82a4644adc610700598066f366071a819cb8282a84b4b20248d6e
SSDEEP 12288:OoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OIdCN/j2GLl3iFSE33b9
TLSH
T1B1452364E9F5F669F15AC37D43A99B555200FEECF6264487868156EB233CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a1e3447c0ed034895ef193f591974935ee5d5f41948c3bf39527bb29952fcb00
MD5 e449f9753598e42d8c019661f554b1e8
SHA1 dc52ebe3412e07b5243d0731b3caf77dc13caf9d
SHA512 232298664512bfd6a23076ecc5b084d0b48ee2befd69a7790bec8e571e634b01bca6f2c666a93adb201892b79e7a33cd9c2c4f9a33e35802eb752248f0aae8fc
SSDEEP 12288:G8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:G0dCN/j2GLl3iFSE33b9
TLSH
T18E452364E9F5F669F12AC37D43A99B555200FFE8F6264487868156EB233CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 191a2ae44fe1332262ffcdab7b082348393893a48e6f19820d5a50abeb8b0ce5
MD5 0e1586035288d0632b180a847f70a765
SHA1 4b13db2c227a50f17d07508dc6ee64abb379f866
SHA512 a57fcd8804f9e194a0a30562bb1dd0e7d0f0637a33ec3fa9e690eb072be8e37a025dfe10f1a642fd4dfa23bd831af0e371bdba4f4270ea1cecfe86dbcc95f495
SSDEEP 12288:jyPz5L8tJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Ozy5dCN/j2GLl3iFSE33b9
TLSH
T166550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5d6aba315a125c5918edc18593ffde57831590cc657d2d0fd43c9b15f4ec2e48
MD5 acd80318ce45382e42e7655be7de3f63
SHA1 f8682063ccfdaecd03fd1a06e024c559164b4379
SHA512 18e36547b7ffbb7595aa8d96cc1703a347d187724a33c35134c2985348ab37801cd7d2288ce8179c8c81bdd9f9a903880dbe834fbb3c06f718cee5dff611050a
SSDEEP 12288:RoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RIdCN/j2GLl3iFSE33b9
TLSH
T144452364E9F5F669F15AC37D43A99B555200FEFCF6264487868156EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 35f2d691bb28709cf3a5f171dfe5e777e78cb98394e6c10aff8ebccc3f6b2d79
MD5 478d82ea63875aec4cdbaa461915b37b
SHA1 4be55e991d93bb9b1bd2abe9375959f3726b8a0a
SHA512 c20bfc4aa19d8d67cb6afa7bbc74b65e67246fd7163aa8f99567fd42e2cc55137380c855d791cb93b128960f6711eeadb35d2c79802691b06ca31ff6e96f43a7
SSDEEP 12288:9oJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9IdCN/j2GLl3iFSE33b9
TLSH
T15A452364E9F5F669F15AC37D43A99B555200FEFCF6264487868156EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 60c754e44ed43a7c7c0c63df43d339a5b0192dd56acf062164850c8700dc0ec0
MD5 d350e82e8bed01058fd734600016cd49
SHA1 9ba4c0dba4915d118f53946be24e97750fd12ce3
SHA512 ebade9770364f4a78abea50a91c3ad5c6e86bc1050c250a1556e9d33c375f0d6a021849b94c79ca2ed7f69c5dec7f0315158bfa03f4463cfb51978c665c33920
SSDEEP 12288:qyPz5L8tJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3zy5dCN/j2GLl3iFSE33b9
TLSH
T103550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 87fad366fdf191af88ffe8a56d981101f0712d0e99791c956a2e5de403de9409
MD5 ebd7b27b4aee89586818a08a8cac3e0b
SHA1 83b3fa7c2925566a29f661a650372df571338397
SHA512 cc13727bdaa9055e17baa4d612f273abe38fee2b4d2dd9ee03e3cd3171cb3fb80acfee35330b23e52b8d0c68c903aa8198645765b8db9326d211dc9b55c6c905
SSDEEP 12288:BCd9CWYoaLHF3z0z04PDvhDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8TDaLl3z0zD7dCN/j2GLl3iFSE33b9
TLSH
T1826502A4B39058F8EC67823EC9558916D2B1BC694770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1c08c048e5e02d855da6ae048cbf88b65a12aff2e73468665d912d194b2d1835
MD5 b4e2ef0e85b687a5c2c60fbb0a7ccbac
SHA1 adc2715822dcdcad36d9a25cc97ab2607f89bd4c
SHA512 fe1b6f2be8d68fbb34279f98d62af513cead4384bacae130aef1d1dc6c644c048eed868c1c8e4dfb4c26c430b5b34d9065d2a341219342d82474699258d48969
SSDEEP 12288:Hi4e7KRdTfgwCHKy7GLbbdIvyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:H3vd9CHKy7GZ/dCN/j2GLl3iFSE33b9
TLSH
T19075CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 093f801fafe59e64166cb088b2a907d9d7aae21dee15544cd8b43ac7ae9fec05
MD5 24f81a91067e0a9044507562a45dd829
SHA1 fa65b681957bb7f31639d03513f11e25ff56d793
SHA512 8493fb8fbffb254854c8640961b68e1b9878170c992109947e51ef9168de613131f2381f1039ddbeae135b9f523b9381f7f2fb8720fb107e8008a440943dd8e1
SSDEEP 12288:PzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PLdCN/j2GLl3iFSE33b9
TLSH
T1C7452364E9F5F669F15EC37D43A99B555200FEF8F6224487868116EB233CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0b289f71aa7e561bfce19c6a772dcd5811c3332d3991e04aaab6c6788fbdc2a1
MD5 fd17b41fe2d900f8ca2985ae3143c666
SHA1 988e51f1cf9e2ba17c28cf10d6ef7f36f6eeb3a7
SHA512 5acf63c198de2b03df5476557acf70b62931db30eb72fe68fd1a817070e8a6b0b4338a7fea59f2a597bad4bfc09b7c20b5219b221f518a02a6d8667e9009f55d
SSDEEP 12288:1NJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1ZdCN/j2GLl3iFSE33b9
TLSH
T187452364E9F5F669F16EC3BD43A99B515200FEE8F6264487868156EB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f316a0e8aae7913f7f5eb94efde507ee135792e0a87fb914fcb88d0a48994ba0
MD5 55f2861382a4ccef43ec7786b5bcce8d
SHA1 fea6fa3d781e807f78f0901009e7b5cbd66e484c
SHA512 793982aeb178c3975e85733d7552182f0589c805f93564aa3cd733d669e3f6818e1aaaa456dda32d61870bce2069f60cabee04e1d5a4fdbc4a59a56b652ce25d
SSDEEP 12288:PyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PudCN/j2GLl3iFSE33b9
TLSH
T1D9452364E9F5F669F15AC37D43A99B555200FEECF6224487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f3b129d13e72a8afd5f88c622739f895dfa52bbd2e0daecb691411d62807d384
MD5 3df493ac05882571a777a65df30adc5a
SHA1 2bbbe6c9b2e183a364775c963eff292fb0793d62
SHA512 534cb6c36ae8fdd21afa5445e02730c8ce9387b8381ce161dee1f1108401b41bc69b2af1a3f7943cfbb4877abc4f249582acb6b40d8204d8ba5f9f30f358a3a1
SSDEEP 12288:KoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KIdCN/j2GLl3iFSE33b9
TLSH
T18E452364E9F5F669F15AC37D43A99B555200FEECF6264487868156EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 aae81353ee94ac868f2ec9eec1994adc4f731bbbd3c5d6917437a1cb261e10c7
MD5 5c05f0dc257a276768d1f0d00b5ec3f3
SHA1 a9eea8f7d8eef6e2d04b56286443ada36a4ebcf8
SHA512 ad918ddb80962fa413ba20910ae7b958d8bcc03a959fb4fe52c384d941c0edc4eb2a62d96cb49bc8a62f6fdf1263d9a57eae4f642ccd81c102a07a3ea24994b6
SSDEEP 12288:WzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WLdCN/j2GLl3iFSE33b9
TLSH
T15E452364E9F5F665F15EC37D43A99B555200FEF8F6264487868116EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2f3683bb5bcf5569064aa5abf1df36a934ecf97bd9ef07986e4e9ccd849c6f4c
MD5 caf2f33cd7f9ab6e96cbb4cbce6abf30
SHA1 c3f101ca7dc063fd77bcb32596b5bfc1a62fc5a0
SHA512 f0a1e53fb75781126813a3b968cf2d6b80d05868c6f93b4a3be14348a0d6d0677643501d7fcbc8856ce551f1dbe4f47bd97d3fe32848a166d4d03b8de9d7ad14
SSDEEP 12288:KwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KAdCN/j2GLl3iFSE33b9
TLSH
T1E0452364E9F5F669F15AC3BD43A99B515200FEF8F6264487868156EB233CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c003cd3cf3d0ac36c82be4ebcc84d825685b19eaa7faf0cf3924b46659a346b3
MD5 bafe8b9944c1740095cce52f64b1b75a
SHA1 d992562c0c4f4b687e6f1fb766e6fd45a19f7be0
SHA512 8d1cc97664c0dc1d02d2c233369f34df972e1cc4831d22d628161531320d9f5201d494935a09aeaa8000b985a80334077db21b670d87b5e817a74dc158bb590f
SSDEEP 12288:RWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RadCN/j2GLl3iFSE33b9
TLSH
T1A6452364E9F5F669F15AC37D43A99B555200FEF8F6264487868156EB233CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 02157d16e9c9fc0be647d66ec5e2d95bf0e2200cce990b40ea52e26b3f66026d
MD5 20fb5dade38980b11129c307dbfc5aae
SHA1 d37c79b9508f1effcc9343f7af775e8d93faa552
SHA512 504de0b2d795196e99170b2231a0da57b23a6ab176a3a493bc71839993c16a5bcbadfbfe71086eb064eb81b35e7cfd7cf0560be3a49ff0e901b40d8f27fbf937
SSDEEP 24576:vfwvUk9RX6wkyAIkdCN/j2GLl3iFSE33b9:9MnYIPN/j2U4FH
TLSH
T14885D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 044c6ed624f54a385eec835a74e35c871677e03b713711d0a6c4d6b2be0d3893
MD5 395f3e9df89d580d94c8d138d9c8aa31
SHA1 e9f423ed539fa32f9e02be7f51f4045f3a7afae5
SHA512 8d416b4f7f1891eac11d76ac30afe46515f1508a31b33c03d3dbc2fcc5c4532760e6c436d8cab442215495562b2aba8d713bf3d8140cc39d01418ad8c700edf6
SSDEEP 49152:AYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EN/j2U4FH:HySzPAj2jF
TLSH
T173067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6174a7c4f96064590a6c8f1ef1b35b182cf416bd80cd3a5a559b273c3ca9690d
MD5 820ecbd4cb0adade69268c2037735a06
SHA1 8689e34b5986b4162aeb4cfc9791717d4a102dc6
SHA512 a60a028debd9cc5ca1e7353f1dc3dd1301c774ecde0d047afd49e5962f1ffdb894371f629b8c27066b6531b88e60b4d2ac42f5e23974bcddecb8286388c22100
SSDEEP 24576:X47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYtdCN/j2GLl3iFSE33b9:X47JUQjTirIhCnDHUPfF/0N/j2U4FH
TLSH
T1E565AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bbe2f49f05dff802239f794f5632b062cd1b0d867044cabd18f370bfc8468a07
MD5 e8ef382d8a2055513e75409f7030b085
SHA1 6ec5c92fb97bbd21fadfbd6562241c27881d149c
SHA512 4936682cd9185f1ec91f37b9526ea4e4e86413fd58a98a84651629af63451fb252477c9b65b810627bec1ec0732996343597c90822aa4ced8309ae40f80cb1de
SSDEEP 12288:ybsfYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pYdCN/j2GLl3iFSE33b9
TLSH
T179550119D2A452E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b5e12f1fc9b22b01676da1def162e829662dc9abb0d21294f02160d1fd58b3af
MD5 0fc638c012221c9e6dcd029909ecf443
SHA1 9c4980e8b1ef549d7e306b81dab5faf641b94a18
SHA512 9e17da238904c3335d07a3099247a8dcdc89ef56377d70a9cafa9f8f843eca7fcccc7074dc1ef46b3932cff782d35191a2a7a629c4b0e8bdbf55d2cd2ed05554
SSDEEP 12288:wkAdYvRuWM9rlkzWMMpFf+neDzX/K26Upl:wbiRIJlkzWlp0nMzX/76
TLSH
T1A03528017666CA8FC66940326E33C1CCAB707D41EE44AF0773C9973F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 8ed4693272e14acd9236e6ae3d5b2348df3de6fdd700c5aba17362a9c6dd0ef0
MD5 0bb4249aba823ab10a85cb8d8606d1f5
SHA1 6e9bc3a9d8927dc2508fe160ebbac62e0d78d6f9
SHA512 7240aac8407aecf38c26acd7507a9beac5345b22c476f4814f54824e60f9d23f8a1bd3597aebd29c90e6263cfb176cb60240257af142ba85aad52a8b680fd32c
SSDEEP 6144:p91T1ivZ+6D06045Sg5Z2kXokDkIk4N9m4CJnLkrrHpeftMxAcp61wKcftMxA3Xi:TRovZsGfRQIk4NtrrHphp61wKVQOcWSu
TLSH
T19F6509415437A68FD1BB5032072A5B8CBBB4DC16B7096F26B3C9443ED82AB51A0F97D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0c3e566bb191c26ae0cb587b46683bb8bd749c8f66cab5b680d7682286d38d63
MD5 2c1ec170f2e59bf7dc288d2f2bf856fb
SHA1 da6caa37bb589e13c3b90e94e73ba9839b5140c8
SHA512 3eea0a08d2c2d25e25da086aae4422b3a703d89d9bf3d7aacf44e95bd5b48bfb22b3685526f954a9035518b612a45af4b0b3453a1c98f4ccdde89ccef8ffcb36
SSDEEP 12288:M07gJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xQdCN/j2GLl3iFSE33b9
TLSH
T111452361DBE5FA55F07E837802ADDA216200FEF8EB1184C7C54166EB6278FD8C932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1186ef53aec57815d7865f936040fd223a040c85522360bb0bc10a3931de75ed
MD5 a821a519423954d13fa9b7358673e529
SHA1 f3e4281903a92a0ac8bdfdcad614641ff1012585
SHA512 c6e8ffae18d3245c6a12639d7cda9eb5f7981b01bb63a4220ffd906272e31bc3f217ddccee5fd0b78a225abdff111bdd9ccf8eb6456c061734c2ed4ad6d1db89
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYWdCN/j2GLl3iFSE33b9:Ngb4mBIBhGFCN/j2U4FH
TLSH
T1A465AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 49af0fcc11c433593f121614014d89c6d8709f4871e801c6bc16f7917ae3cd6b
MD5 07c52faa343592b2aef3940a36c37557
SHA1 ee2edaf9cefa77c8bee21415665c9c539c24207e
SHA512 d535b4bc6194c0012e36f9e49d8db94cb3939afc1ac419ca82a637874484362f366464d71ac43e8436ed64d4a235e4386f1b4408ac4eaf88e7400070d1e94147
SSDEEP 24576:wG88u8FpJqH1bzria7/m9dCN/j2GLl3iFSE33b9:j7ZFPqVea7/RN/j2U4FH
TLSH
T1CF85F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5fa3d36e53a0791f2d1610b1c758ac5c570fba250cc3686981613f4fb94f4dc4
MD5 d0a04760938052de23de18d88d564d2c
SHA1 c43e4bbea99477038befaf1772f5c8874d148869
SHA512 aa5a53c8f449e7d3d68cd11ba5ef91cf6bb4ff3721190ceeec848bae81a393717d4588f2437d464c28da3722fbc7225e413fb6556701a89ee85dfb6e5f3a5864
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGN/j2U4FH:MG05lO43b5j2jF
TLSH
T1AFD5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d4fbdf4bf710a26fb945f1cc15275755b0fe4cac416fbdcc8a1cc544a38bbfda
MD5 0538ec293d0b614f650fa7a845036ead
SHA1 5219b22a29ea69bd4614003ac041ff9e2f787e40
SHA512 2b44425ac5bb56ff3a3464a9b44852e4b1b071bd675e61323c3b0bdcab60dcba87acb732c5ad055f4b64db2691398a655c228e38e093ffcfffd5dfe2fc2d0596
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXdCN/j2GLl3iFSE33b9:ta5POZ3BJt2pasx2+muN/j2U4FH
TLSH
T14565BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dab7d069640e3eae95b5faf8a4d6c5fed0927cae259090db3d99bd7750171a26
MD5 bcde2dd6599b380177245eebcb72c58a
SHA1 3ef4660d1e4083b409f4967306830cad942f57fe
SHA512 5b7795eea66a443f962a78087ec6782d62ac67873f1a221e47c1045e3ce3ba2f2cc9e4d0cca7d306db8858c72e126f6e37a6c9e6334d0a3b9ac3036c6790b101
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkFdCN/j2GLl3iFSE33b9:TNc/zEOVHFxN/j2U4FH
TLSH
T182857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 54af466dc9fe6955a33dc606363d52a922b98c2bfe3e182e692726a73a73fa54
MD5 aa6d638055a11b94c0c8cf37e99cd343
SHA1 27abd41cdab7bcf945fb62067cedf1716bc27880
SHA512 a3d1fae4dc12f0febaea6c0aa249fedf60bfe5764eb80ef453f08de11b266eb74542432a4bf49916741336fe1a0624e709ecaa1c120858b4c7117959287f0cd2
SSDEEP 24576:+TkNvNnaFeYhJNtmZBm/BdCN/j2GLl3iFSE33b9:+TMwBtOmON/j2U4FH
TLSH
T1E555AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bf24e2004736a81da6bb1d55395e88b2996aad980571b3ff08aa5edae934f5c2
MD5 23d9e235ecbdcbcdabe331752e43a8dd
SHA1 ae9f962a457d86b611d465063009a57411230b61
SHA512 0e35acbdc252ee0e3f971e1fb51357cbb5c3ccef8e738dba742def31d787daef8204ccefb5e7efe6cc87584e5e95a3ef35d1a710e410897381dd9b8c45915558
SSDEEP 12288:UHvUrBFrEjwaQlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UPUr+NQhdCN/j2GLl3iFSE33b9
TLSH
T17065F22E66E818E5E67AD17D86868719F731B8615312D2CF02D0817F4F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5a3cd2c4fa31b8c3e239aad75607abe4508af4e283ccc9bf83078466d4d0e48f
MD5 466bf971d1e7fbb0ea3c551ef75100b9
SHA1 c0a0b276df2d9dd22033042a8c8aad8eaca8a5b3
SHA512 16248170e1fbe395ac7fdfaf33b0d6c79eec2bfef0cbe15949d35f546a7d20a8a5f509b05d53966d48fbf6cdffb94af2e0b9b3d7fe31d565f83544a9eb6c4c0b
SSDEEP 24576:WD3FHshBIYQgAsdCN/j2GLl3iFSE33b9:WDVHeBIAAXN/j2U4FH
TLSH
T13875E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1120-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1120-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1120-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1240-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1240-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1240-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1240-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1268-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1268-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1268-70-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1268-76-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1300-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1300-24-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1300-17-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1300-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1300-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1480-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1480-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1480-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1480-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1480-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2412-323-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2412-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2412-84-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4148-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4148-302-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4148-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4148-58-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4432-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4432-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4520-0-0x0000000000400000-0x000000000060D000-memory.dmp

Download

memory/4520-6-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4520-14-0x0000000000400000-0x000000000060D000-memory.dmp

Download

memory/4520-1-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4520-7-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4660-43-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4660-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4660-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4660-53-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4660-49-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/5000-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5000-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5000-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5000-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5000-121-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5936-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5936-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5936-308-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5936-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5936-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5936-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download