Analysis
- max time kernel
124s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 20:13
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe
- Size 6.3MB
- Sample260708-yzsd6ahs3v
- SHA256 ded468d63429f6cf7347e2a064e60712f85b65becb8606700fc00d2cd5326e34
- MD5 99514794a18555b962f7b78b7b16444a
- SHA1 e500a9683aa80a4f495cc5b571636015e7f9d3a8
- SHA512 9c5d6964577150ddfc2e713ba95609fb25800296a3d2dfa7897702826baf4ecdbb52021d4479ff5d3250ba7b7b2d0de32277cd31fa3e660cf65d866bf332f743
- SSDEEP 98304:6+/mEfM78Z4CjoCCPaP4Vhc18frP3wbzWFimaI7dloOYIt2sEE5:a01Z4DV7gbzWFimaI7dlRYIt
- TLSH T12C66AE51BF8C817AC95A1531072DAF2A402ABC98773465D3B2743E7EEC753C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
resource yara_rule behavioral2/memory/2440-5-0x0000000000400000-0x0000000000A5F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/2440-76-0x0000000000400000-0x0000000000A5F000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
resource yara_rule behavioral2/memory/2440-5-0x0000000000400000-0x0000000000A5F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/2440-76-0x0000000000400000-0x0000000000A5F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 2876 elevation_service.exe 5348 elevation_service.exe 5048 maintenanceservice.exe 3048 OSE.EXE 3512 PerceptionSimulationService.exe 3504 perfhost.exe 2996 ReFsDedupSvc.exe 2904 SensorDataService.exe 3000 ssh-agent.exe 912 AgentService.exe 4528 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b930f0523cd8d80a.bin elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112921\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112921\javaw.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e828c754160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eedb0758160fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000581d1255160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f6ced55160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9b2ad55160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000241bca55160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000466b555160fdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddaf1c56160fdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe - Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{7C431AAF-A65D-46B7-9AE7-E8A44A5657E1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{72D2BBDD-C123-4E41-8D11-78D34325FF10} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4916 explorer.exe 4916 explorer.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2876 elevation_service.exe 2876 elevation_service.exe 2876 elevation_service.exe 2876 elevation_service.exe 2876 elevation_service.exe 2876 elevation_service.exe 2876 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeRestorePrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeAssignPrimaryTokenPrivilege 912 AgentService.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: SeBackupPrivilege 2996 ReFsDedupSvc.exe Token: SeRestorePrivilege 2996 ReFsDedupSvc.exe Token: 33 4528 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4528 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4528 SearchIndexer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeDebugPrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeShutdownPrivilege 4916 explorer.exe Token: SeCreatePagefilePrivilege 4916 explorer.exe Token: SeDebugPrivilege 2876 elevation_service.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1880 sihost.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe 4916 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 2908 StartMenuExperienceHost.exe 4916 explorer.exe 5412 SearchHost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4528 wrote to memory of 6100 4528 SearchIndexer.exe 99 PID 4528 wrote to memory of 3712 4528 SearchIndexer.exe 104 PID 2440 wrote to memory of 3396 2440 2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe 105 PID 1880 wrote to memory of 4916 1880 sihost.exe 106 PID 4528 wrote to memory of 1092 4528 SearchIndexer.exe 113 PID 4528 wrote to memory of 2204 4528 SearchIndexer.exe 114 PID 4528 wrote to memory of 1400 4528 SearchIndexer.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_99514794a18555b962f7b78b7b16444a_darkgate_elex_glassworm_remcos_stop.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5348
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5048
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3048
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3512
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3504
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2904
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3000
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:912
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6100
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3712
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2860 2840 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1092
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2940 2928 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2204
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:1400
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2940 2928 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3984
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2860 2840 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1932
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4916
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2908
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5412
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4e813b924ac94c0a63c10583d65e9aefd2976230f52b34d260b3b9f43dff3d4a
- MD5 c0083faa334fa0152b54c017aa3f548a
- SHA1 5a5de52a95863dee133908a1db9bd15ff144a268
- SHA512 b6e8f8340d1a33d25ff8f8eac6c61559eca282e69388385834c028eceb8b0e6624df37506748ebece2d7b9090441c27f2cd7d7dae59a4a8b24ff0c340caa9f43
- SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnXt2r4PRSEk1ul:W3q6sjBst2sEE5
- TLSH T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 4553b49dd3e298882d4c0d6a062909124ecd4a42fe28a9587636e5db812d0f2c
- MD5 306c7846d760651b9e6a347263675297
- SHA1 f68112b8b2284e692860a5f69bd0e44a4ad66c06
- SHA512 7105081f8cb1f25f8036b98ef4f48f2b515cb6f0e0ad00844e552d6ea050fd88355d7bfd2618aea059148ea31425d225a386e32ab8c2c4d3092f1892d5f81654
- SSDEEP 12288:+1XLsswWkxy2lRq2czAYUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7f:MXYfDtczAYt2rR8FfBhRJUEbDk1ulUg
- TLSH T14105F129B3E408F9ED67827CC8A2C511E6337C4547A0EB8B07A499351F336D85E7EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 8d240d5a3ca8f57023a03b479823364bb5254ef97d7a344967c637c4a647cce7
- MD5 f232d2962dcffa875eb05121e79ebe10
- SHA1 05fec11732826c12f3b4a391c06ef81e47455218
- SHA512 3e18b7d00e886064c644551636c708ce2ba3c79d97a0c2a4d988797ad9a2bf4a907e57f57e0a7785d95089709293fa98870c7a21925fc10acc9a98129aa2bb74
- SSDEEP 24576:d0Le5ji0hmxxrMft2rR8FfBhRJUEbDk1ulUf:dPji0Ajit2r4PRSEk1ul
- TLSH T153359F16F6748731D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1ad0998d52dbf680729650256fcecefadc530ef0f6d1738a8ad22a3f78189f65
- MD5 0e0c73170f8dd24cb202fdfd9745b4d7
- SHA1 0f67ef88b99883b899fca4118918477ce59a9554
- SHA512 5302cb999c9cc78f23e9b82d535ba4d88a5420d1839f1deb392cb4e25f7cc8c22af65abf159507ba9468299d9a266335ae641db16c2f0e5dad9141019edf7311
- SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyult2rR8FfBhRJUEbDk1ulUK:0/ezSC6vUzPveHjy+t2r4PRSEk1ul
- TLSH T114755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 15274bb76812af522d6a92fe09798b2d6341de84edb876e04fcd7abbc7d8997b
- MD5 55574ed092e953a72eb3129e5b200a4c
- SHA1 03e32b020cd76496c384a3a2df670d1b2310ecb4
- SHA512 96a9e004e5a028b750a7796503f5eed2b21f296c14a8057260ff6c21c1b0c3b8e38e6f77a1863b82bc695e83cf04cdb8e7795a852d5928d4a5ef5bf9ca2d65ac
- SSDEEP 24576:LVbqPb88hv/l+Yct2rR8FfBhRJUEbDk1ulUc:LVO88hXl+9t2r4PRSEk1ul
- TLSH T198559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 d076fe78e2c8b20b33800da8ff4f72c5b34454c02046082d816b1c27ce3d64a8
- MD5 fc8d10ce76a7cbbca65163a621e4de95
- SHA1 6adcebdd66929499eda59645fb2403093b7d41dc
- SHA512 b30b5a7fbecedea73d43b3fcdad6e3637f0930b28976dc63b19eed28c72bf631ac58a30a29ea31ad9866320572e210c2b8c71988d160ebe825d11ff891d6e980
- SSDEEP 12288:SLjUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3j:SLjt2rR8FfBhRJUEbDk1ulUz
- TLSH T14FC42312F3A848A2F3A74A7478F9D72114122C893FF5EF021D60693D25389E5F5FA6D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 9dd5db4810a0c7077e2eb9c73a593336c99b3d788bc101b5661b9fc64b23bfd5
- MD5 abc5b92df505491eb58b8186066c814a
- SHA1 39c610b0dea5807aeb28800533d99b6b6348fb54
- SHA512 457f32db010e64a62abb47669205078c20399dcf39a1398485473dcb45999e45e3156e463fc6c29a732dc035b125adfdcbfc2a9daa940a24520d39bab3b89b1a
- SSDEEP 12288:YeBNUbTVO86UkUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3J:YJIUkt2rR8FfBhRJUEbDk1ulU5
- TLSH T13005CF3BEE28FCE2C27A8D785A91C700D77278704F62A3CBD165821E9E235E15D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 99474b9c295ad65ee1d235f18a7ccfbc14db085f1ea5485233e36143a53e8380
- MD5 f45e68d68aa9f3280e19db3b84672da2
- SHA1 9296925a1eca2fd2259238ab2542892fa0bad4ff
- SHA512 f4091b5d3c22eea0e1b71946a0f1c57eb98cfc4947a29e5e692a3c203a08c138cfc0366d541ccbb966d8d4d8da55c8a2fa489ebf959c765928826d01ed1b5674
- SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:YQvGAdlCEL8c/DRNw5CVt2sEE5
- TLSH T1DA267C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 667af81f217f27ca67ef907351a3468867391e2d06b9eca1f86c3333df0e31f9
- MD5 cbc5751c5749ffa7161ac001683ef4e2
- SHA1 3eb3a617cfcd0472240e3c884a9cafb7a02f7410
- SHA512 e063f7d4a64e58cca987b7589f5dbf65456b5c0b9e532167382e51491a859dd90c4bfbce39e9b91b1c8b2c9e8b86da0f5d4bdb19b5ed0f4ce34aaf857299bec9
- SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAjSUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7m:10ewsAjSt2rR8FfBhRJUEbDk1ulUt
- TLSH T14E15E031FA74E432D3BB0DB62B76C716142D79204FA11AC3E3E88D9E59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 187f2a6f77bd41af925ba405b7bf323ff51e4f53a3d8ff156b8e07084e6c96da
- MD5 05bc5b0c6ec054e4806f251998918c55
- SHA1 4d75c687c787b4d1ae847391610d3bc89d7493f6
- SHA512 4ff236f6930c5b0b7039d8a6e8f8d5de6eb82feb79ef4b2d9040a570656698f84439d4d77d08c7bf6366046eb1c89b52a8704ea68d97fc53b00ecafb97b6dbd6
- SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHqt:4UEtQevvqc2W1cpV2tI32
- TLSH T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 988c015d422799ec0fb70969c217d72f20a0920c4a212f0186a6c94f93417926
- MD5 aecad1647d10eee1076823c9bf2945ff
- SHA1 335b6cfa3f9dadd7f8bee1314f2558ff155ba297
- SHA512 9f7bc7841f023cb01950c6018ca959a09c29caabab5d2171435a994006653697995cd3abc1c7ddbc89e306499073c1f8caacd92820e30c82fde15d6249e6ff24
- SSDEEP 49152:kCbRquA/m2yL5zifFiV+XenmE3/zyt2r4PRSEk1ul:toqHVjnmht2sEE5
- TLSH T146D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 72e05cc86d575dbbff095b7052aa2100297f957e64b11a5c2e8c0528faecabb1
- MD5 6d9b9862c437c1333cb7d7c077127372
- SHA1 a96f839b431ca4a7da318100566cf4bb490d49ee
- SHA512 8fdc46e1ba5c4187889b7b59f98889390f306aca8c3d29c41e7f0cea668c0d3f674bb107d7671787780dff82f22cbe630c61027488712d80d09704fc511c6931
- SSDEEP 24576:rAhGL3IFoiwtA5l7S53Bt2rR8FfBhRJUEbDk1ulU0:rAMUFoiq5Rt2r4PRSEk1ul
- TLSH T1C835AD81E7F945D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F1E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 54d0db4bf2e4637bac6065790d3a99565893b1b42d0bac5e117a5e577d1b6c4a
- MD5 06729a98e7e05c8566a256e5cacf113c
- SHA1 acb61c8018894cd5bb2ebfda76047ab9051df619
- SHA512 21f1fe1eee330c6f07a488da59b730d717a003c34d573d43667be8ae4a5badfa0a5f16462e6d988f253f233c59eaa5465597aa4bc825dcc57493962d7df72677
- SSDEEP 12288:xmw5HEjsChNVBFgl0WDm+CFUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1r5:swu4OWet2rR8FfBhRJUEbDk1ulUZ
- TLSH T19A05F14673A40CF9E56786388597C136E7B2BC062B61DB1F1760C62B2F37261BD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 8534bd0b8871c0e8342cdce2d1e1b3c95178ca8a80946f16dfeb228ed71a53b5
- MD5 a7c87a04f65a9332bdc4a593b43d05ef
- SHA1 ba9685489750a1e4eb93681b2bfdeb2b62b12ffa
- SHA512 3ce88abda3d1e35fdfaa7be14a02340c945ba4b790e09f58419b83634777995f4fd842fb34c59a6adf2598b7542926e8a4755a03a05c0311abd2796bef831a62
- SSDEEP 12288:xeZ1IyCUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U34:kZuHt2rR8FfBhRJUEbDk1ulUo
- TLSH T145E4125633E860F6E2A34638D8F58705D3327C462B7297CF1A60463A2F32ED56D39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 97354b89635a855aeeddc1b8ef4e210c2dc48b118c046f0f720e35bd64119af2
- MD5 0cb8d1f8e8dd5290ca3a7f44cdaec813
- SHA1 e54390096e63ef394e6edf53c5b95b036b48dd76
- SHA512 87f0e8498c486566a312492fa8a54d6670d130e7af9a59cf3b3b674102d32a6c7adc8ff344bc453486db9af269ae31fc594dbe0b21c49ecd23bae2936268c08c
- SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:UQRQyi36YOcPbLvw2gAf+PN3At2sEE5
- TLSH T1B9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b90dbcd101480d45eeabc24382b32c35b32853ad36b6f5d89e09fba5c39e8eee
- MD5 52a81bd353547eaae0f15192eaefe8f8
- SHA1 591d0403900644dbff474325434d0977955b14c9
- SHA512 783063f70c27e6cc707c33f4667bb47015f86abb5d00f6094817002fc7680019a2696f9f94e86e6bc4b08fb688a9dc3440f101563ad898e644b2d95fca030f90
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:yQRQyi36YOcPbLvw2gAf+PN3At2sEE5
- TLSH T158666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f53464c852e4f0794de5ea8a994a9bccf12ecfd5891fc2ebc63b249e780b48e3
- MD5 d92e6cef7069adaf5bf25a614ad84b6a
- SHA1 bd0a5b4758b1ec5a90918a52d27cc80b56a78cee
- SHA512 80bf078ed04d3f3bf85c9be5b90ddf63ae673eb1293a7c96e8310c8bb9a208a9b44616a7f59b25f36879f9bdf3b40861b6b4af9761fff750f9c2179b07e77ff7
- SSDEEP 49152:A68Qg55nhceWu7PNU3/it2r4PRSEk1ul:6thLRc/it2sEE5
- TLSH T134B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 19244d69c69424a3988b5aa04815a906f85ca4530ac1983213babea07ae4545a
- MD5 b910cc91ed11125356534d4447c8512a
- SHA1 db42df6c8f33ef71a87b80fabe2e096e9d1eade3
- SHA512 534722b5eae01e134c5f49e83c8e9b9532ca3a771c5b02104ea0cf8a23e4b0360cdf71dd79ee02f5861f5cd6850b4b47d267a28504c084742573b26f5b2551e4
- SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:my5112gYy5azzVvt69nLKnhZjt2sEE5
- TLSH T1C5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 65fde5f6b8de1f541010acf4d296a35bce0448ccd29d1ba14feebf5f7805608c
- MD5 624a8ac334824042dc101540f27d1f8d
- SHA1 820fdb9b9a4e5863f93ca766a226800c26acc17f
- SHA512 e44c0d8dbe5a11edbe3aeccf23359775c9d9532f52eb6d47ff87b2d97f0222133378ed04b339715dd3b0851ee741f19068352c1b457f146832b2438c5cdec446
- SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glot2r4PRSEk1ul:7u6Jmdxd2dot2sEE5
- TLSH T10ED59D13F2D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 fbbd9c744496c476dcb9e8e12c4eecaa06f53d7b2661e7131c26f10f719285a6
- MD5 38720180ead63dca74c111dfb39fa09a
- SHA1 c6c11930fc56eee0cffc21905e774eed45282d54
- SHA512 195eef67c55319513b3fd153cb89707d0f68aa8ba52fbce7a29542ab24d9385ebf23073cb6bcca01d0b5d27eda119e0fc32b4f19e55e6e3649dd9e79585e6ef5
- SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4xEt2r4PRSEk1ul:1mifPWRht2sEE5
- TLSH T1ACB5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 3b279504bce5af9457778740abc5264908c0257e5a1b2f19cab80cc5b32fb937
- MD5 6979e6cc1bbf019cd3f6bc4da877789f
- SHA1 e6fb951088e19efaf55716e240a9d0dc24ca957c
- SHA512 4b2b8f7a8a098bf193500f1d04523acb0ef71773baa26208437f17595a17ced4f2ec972bb3b4c2705c2e49cdd1d850af2e5fdd623f6f2749922699fdf949f1eb
- SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqHt2r4PRSEk1ul:I5dKii61Ht2sEE5
- TLSH T197C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 f929bc1bc666c15b22ab27bb835f73497283e2c5d32d53ec361d553b204fa683
- MD5 3098d794829e8f134c45e309356efb73
- SHA1 7d7ff82e44bdf5b136b792272298c0f79db2349e
- SHA512 e4c2899b51edd5cae2a8d4bdf7b5e18f032d2ebe26c923f92251832282d6a2e1731b50a6a82254fd9b39b8cb942efb8efea09fcee1dbff88dc4f3f3a8c95c437
- SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wYt2r4PRSEk1ul:zX2imphtt2sEE5
- TLSH T15595BE13F2D900E8D05ED178C7568632E962BC060B35BAEF0A90B6561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 e491258360f4b17f71622916ee761566e898d2015037ce6a778a2ce0b598448d
- MD5 df6278167c65e4270dc988840f226288
- SHA1 81facdae66f8e2592b90097900047c297119ed9a
- SHA512 c1e7bab28bf248ccb3f3d05fa14f4b9062397c6e4499af2fb8aea59e8baca6516575175f98ee40df46d859f11da5f9d19ac5ac96bdcc9311662f17f2628fd50b
- SSDEEP 12288:dLUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3O:dLt2rR8FfBhRJUEbDk1ulU+
- TLSH T1AEC42312F3A888A3F2578A74B8F5C32154122C8E7FF6AB032E54183A3635DE575F96D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 c29d14f8cfb637f0b666b8277f071ab32936ae2eaad36bbaecc4ecec2739bf54
- MD5 50fa3896d9e2c80fcd6747b56439ac2c
- SHA1 6c02a20cd37c8ef96ea8c12e4959fb3691ab52a1
- SHA512 e1b2b5610259ce4c9239c2660fc2f62115316689a59004e9c5aa41caaf1d468e560dcf8e3e67db410f5818227ebdf806cd7021fb5fd3d518431db9a2d8eacc22
- SSDEEP 12288:0WUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3R:0Wt2rR8FfBhRJUEbDk1ulUB
- TLSH T1CCC42312F2A848A3F2578A74B8F5C32154122C8F7FF2AB032E54583A3635DE575F9AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 2654779a1b8fb7d141fbce5801d01298b242ae2e8afe6c4c0594d240cfaaa1fa
- MD5 2d9384cf8676c49d13c9c719da7b4777
- SHA1 a4fdcae51e810487646c6b30ae01e7cad8216560
- SHA512 20f857efb0af4301875a25f579dec6b7f102f2d05479e97458285cd6b24047490612a963f677160dadedc118dfdc6a1b9acfe460117b4078731c6457a42897a1
- SSDEEP 12288:fsUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3R:fst2rR8FfBhRJUEbDk1ulUB
- TLSH T1E8C42312F2A888A3F2578A74B8F6C32154122C8F7FF6AB032E55183936359E575F96D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 6f1ac68d2e537f9667a9af244706d1436c796691b0990fc1956991807bb0a7b3
- MD5 a133376e11dfad2cfa2b89850e128e22
- SHA1 61e685ed282e2edb356dbf09c478ff8b7b48d77a
- SHA512 b6f5f278c01a7ba45058f0ffc7780ef125b932a1e70f147072d3ec6eaf7f7dc43809204d83e5a645a5b6ae332b1cd5869751efd462f594efc27a3504dc212740
- SSDEEP 12288:HVhUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3a:7t2rR8FfBhRJUEbDk1ulUq
- TLSH T185D42312B3A844D3F567D674E8F6C31191227C8A7F72AB4B1E50083E2E31AE479B5BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 c1368bdd3eb62e9df49a2c0b5965d35b4b70d4263d28f6f0cced152769343ba0
- MD5 3f98a100a2079130473c03ed9bd4e2d7
- SHA1 d9dbaacee7ce8906b0b749bedfb43187fc0d4227
- SHA512 4184003fffac130766dca3d9cd09aa919ee8e72fe7ba1a46b730c7941cef0410e8aea4ccb09fcdd07289153db9531c687b2d23ae2f7a98b26e455a3df59fbfab
- SSDEEP 12288:EZUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3o:EZt2rR8FfBhRJUEbDk1ulUY
- TLSH T199C42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB432E54183936359E575F9AD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 984f58d024f8d6198dccb0078314dfe230242401862e6695814cdbef2955af1f
- MD5 6f0538f9ae53b14d4e86989c3f0bc100
- SHA1 aad87ef793285dbac65a05c0142dcbea049f9b0e
- SHA512 e900fd660d2919e90421f0c95e7da53861bc5768ec136e51f6f2c483856644adecbebfde73b5f0154a44163516b944d277aff2897f49c24fce444f2382d0d1e9
- SSDEEP 12288:taUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3o:tat2rR8FfBhRJUEbDk1ulUY
- TLSH T1BFC42312F3A848A3F2578A74B8F5C32154122C8F7FF2AB032E54583A36359E575F9AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 1530547ed6d2ca818ec92877b327dbf22ff7307ab8c38d618abbe2e45c35eca3
- MD5 582d53846642220d17e31810ab17896e
- SHA1 e9c3673f978c404a8ae1932709a10d1277a5579f
- SHA512 dab070b481f3398242d91b8b310206e85ba057d14c74ed5f0b0eef4d38c3dd4ea58c380b9c6c654782bfb6f9bd4f0eda3fe2c2be1c6003c11a578da95a4d3acd
- SSDEEP 12288:TuUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3g:Tut2rR8FfBhRJUEbDk1ulUw
- TLSH T1A8C42312F3A848A3F2578A74B8F5C32044122C8F7FF6AB032E64583936359E575F9AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 78f76cc3e4e55f48847ccf14787c3c0d3dd57349a782d2e4cf8550faa6d9d8a0
- MD5 d69474bb0fa7785f8787d368f8fa5fb8
- SHA1 8aa37d9a68917864e983eb86b5e6efc02b297174
- SHA512 70599b7e6eb14c86287ba5a754b25a5a8d86c406578eb2803dcfd9373328645d5c7cf860811c07dfdd4512c63a3b5a7ada6d0eaf074759fd6717eed6d815b596
- SSDEEP 12288:ZiZwbVzzFEoS2cPvy2UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3Y:cZMRzFVSO2t2rR8FfBhRJUEbDk1ulUo
- TLSH T184050195B39018F5ED67823EC8658916D2B27C5A1BB0CB0F17A4362B1F337A11C3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 e27059776631e266a1c95b5b809c7a6883cdbd79df9c22126540d29b09d830bb
- MD5 66bb747065bf51fe49dec52ef8c837b5
- SHA1 6df22199a50463edc18d043fbb03318a723c7c47
- SHA512 864c628c15dfcc2a03e42a03418e27b2328a5177bfc69b46ceed633727852d0c6b3e0e472dffb28458af4ddff479fc9193e3961235d243fc3c12b28b1d572802
- SSDEEP 12288:g3UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3y:g3t2rR8FfBhRJUEbDk1ulUC
- TLSH T117C42312F2A848A3F2578A74B8F6C32144122C8F7FF2AB432E6558393635DE575F96D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 5235e5d6acee2e2cc24b0d48283642df5e29f3c110f53b12f1224c31c59ffea5
- MD5 eb20511dedb1756f88954de20a218c9e
- SHA1 1ccc9c31111ee308196163b5be5b0629585f52d1
- SHA512 694f3abac2d5f7ea22f3baf32eba3f458fbbcea0384e6949e292adfbbac5632f521d2112009413f64af783832bbd6836628e69dea85b6046be4d602381443dc9
- SSDEEP 12288:BTUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3y:BTt2rR8FfBhRJUEbDk1ulUC
- TLSH T1FAC42312F3A848A3F2578A74B8F5C32144122C8F7FF2AB432E64583A36359E575F96D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 d7ff6ae7cb329e83654e2beebd557291d7a9c7f29f2c9ca118e93e220d624586
- MD5 3acd74373faba1d294b054be6596efb6
- SHA1 4717679bc52a59fa43df8f95e2a096b3675646d3
- SHA512 b011402fa3a38c95a345ec49f84369ecd57344ca212deab8721a0b248812d4ae1bc72b3c1315114beb4f00fa30ebb02b8b7aec55486b341a9a785cc9d7d8fad5
- SSDEEP 12288:AyPz5L8CUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3H:xzyCt2rR8FfBhRJUEbDk1ulUX
- TLSH T154F4021773A420F9E1678234D8A25A11F3727C761B709F9F1764063A2F376E0AD7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 2500be274b9aa56acaa73113e853625be7096bab9ee76e555f61d4c001594bb9
- MD5 3dfc9a0d440411742a0eeeb3936243a9
- SHA1 7f2bc2db870357d6e7cfb24e80c88c173a53f24c
- SHA512 858f6138506a4e6faacfbb81ddbf5adfbb016ed1a9151300d41bcf4362246b287279ec85262a497616fe60517a38aedfbdf06ef64ea36ee0683149c7d6499739
- SSDEEP 12288:73UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3R:73t2rR8FfBhRJUEbDk1ulUB
- TLSH T1F7C42312F2A848A3F2578A74B8F6C32144122C8F7FF2AB432E5558393635DE575FA6D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 fa8f415d39cb3476773a6b080cba906936e41f2b70f0264a6f82e96bc1de209e
- MD5 92d99c71f6d37e78366a3c0e3689cf43
- SHA1 5807fe94435118c85b6d4d0ed1475f5dd408983e
- SHA512 7979f24eb44e4acc74495832ff4e7eb632065bd16d945e99c9d7d20da7176fc422cbc0e16a569165c81f85c9d30e9b5534d5c4d07ec181aa969fe70c12294d21
- SSDEEP 12288:d3UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3N:d3t2rR8FfBhRJUEbDk1ulU9
- TLSH T16CC42312F2A848A3F2578A74B8F6C32144122C8F7FF6AB432E6518393635DE575F96D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 0169c71f5dd06552a5b2941b90ee3bbe6466e81fa8c8e9ffc17d8e4852a9b8be
- MD5 0c2b6fa0b9412bc1088e794ef6193d47
- SHA1 067d3f0797afa9f98819e552fa0c8a7e1374a2d0
- SHA512 83477d1577cd79e1d322a706475bb2fd690408f2a93347bad37141cade9b400bc7689d23baf019266f826624a45a7b43c552306810ac338b435c6ab01464fa26
- SSDEEP 12288:oyPz5L8CUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3H:pzyCt2rR8FfBhRJUEbDk1ulUX
- TLSH T12EF4021773A420F9E1678234C8A25A11F3727C761B719F9F1764063A2F376E0AD7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 51ce9dc0d0ab43ca63c82d20dbd670c18b31ef736437d99cda68bdd72a281357
- MD5 b5915d7094138cdb1afee1241b5c5263
- SHA1 1573880e9ff35f3ddcee0193903ba6568f39b417
- SHA512 49dabfdea3e40b39c141d8c81c8cbcb6d246d073646378170e06bcaf70e37e5028a4fbed6e0438e9f99d9bfc1fcdab254b0cf019f6d1dbc20c710523045d7c35
- SSDEEP 24576:OTDaLl3z0zD8t2rR8FfBhRJUEbDk1ulUZ:OTuLljlt2r4PRSEk1ul
- TLSH T10C050195B39018F5ED67823EC8658916D2B27C5A1BB0CB1F07A4362B1F333A11C3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 5748e6d8848e2b5a09fd314db78432ec9b8d5f0a446d13148ad0502325e8a49d
- MD5 ae133c0066a6642d175b5bf19916c7ac
- SHA1 d636341eaec7fa7398278081c187004bd3b77286
- SHA512 0d75f4e012940638f61024448f5df1861e39facbf4100f62d41c845cd1d5de4f02b27c534e7666262cbc49bea481c5cf3ce4b649e955ba83c1b794e2033ba714
- SSDEEP 24576:d3vd9CHKy7GZgt2rR8FfBhRJUEbDk1ulUn:9vd9CHKyaKt2r4PRSEk1ul
- TLSH T19325CF90F3E414E4F1B78A358D768511DA767C9A1B71DE8F03A4262A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 07c049af3f30abbd7de57bb491c402a31290f318097b51714fe44ab2e7eb1388
- MD5 14facd5bd3bda5f97e29c295ff34f878
- SHA1 5e1456cd7e09222f35a6e991c790410d4d996010
- SHA512 bb70aedaee383ef366afbac2378bee229aba676aaeb74df9a839161bfc0a6e32601a3d98823a8f67b0b28981b4d93570532a923e20944cf897347326797ede5d
- SSDEEP 12288:JMUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U37:JMt2rR8FfBhRJUEbDk1ulUL
- TLSH T1E4C42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB032E5518393635DE575F9AD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 1d229e7a29a4162c2a44d935904404594fd960a5522078db9aeb0bdb8135fde6
- MD5 5651d68d0c6d60f819a94c2ec374bb97
- SHA1 e63ec0173fd1238c7caf29d9da3371b2e089d89c
- SHA512 863c6957cc104d1a9c25b99dfd9fed56d4a7ac919a651aa998dad5721a6c939176df0f966fcc9ab8de6a0be1b2befbcdaac0a42667badbd8063bec00d7c7e67c
- SSDEEP 12288:ZiUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3S:Zit2rR8FfBhRJUEbDk1ulUC
- TLSH T17FC42312F3A848A3F2578A74B8F6C32154122C8E7FF2AB032E55183A3635DE575F96D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 fb2d6710a1ca17a52062d54ddb87d7a04560297fffb0345d75cf809881fe36d4
- MD5 1fed5a375eb4a3f5cc3914c4e016e639
- SHA1 971059df699383a690214c17d3716d9e0dedb283
- SHA512 d1e49205ef6ea834a96ce5ae2d200ee21c344396d1ead3528068e83ace250e57da1908fd45bb42ac891d9bf002d409c49a51766ec698276d5442edb7d6350d79
- SSDEEP 12288:QdUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3m:Qdt2rR8FfBhRJUEbDk1ulUW
- TLSH T108C42312F2A848A3F2578A74B8F6C32144122C8F7FF2AB032E5558393635DE575F96D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 274c5ee4390e1112f4b000478ce51d63f615154cf0a77b3a6c5b03bce5c79c00
- MD5 8116b7a65768453bd1326f789c0adbaa
- SHA1 9912f170de17aea711702977e9a6ce2e7e0842da
- SHA512 8dee09f21c1e07a92e4b1550e0f7b2fe2ece153aa39ed14c2f45cdf15536aa24e817013ba4205c0a9b6193be501e402244998751e79cd3eb43e5a77166c0c808
- SSDEEP 12288:H3UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3O:H3t2rR8FfBhRJUEbDk1ulUe
- TLSH T1F5C42312F2A848A3F2578A74B8F6C32144122C8F7FF2AB432E65583936359E575F96D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 eb1479bff9d74a554290deb8cf75dbf4faf5ebd2c6664447596e58b1cdfc9e39
- MD5 125a69eff6b254c4c0b8c0d091019a4d
- SHA1 1fbf71e2346d87e2bbe80a6e1387656e9e63454c
- SHA512 49d27beab23d99296631d542661d1d01d8009f4df33c7442136db583af01657f320b5ffd0e5118b4bc01cd8c06c3d6a375ff91af46f86fd022f33abbae8fc4c3
- SSDEEP 12288:oMUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3i:oMt2rR8FfBhRJUEbDk1ulUS
- TLSH T1CBC42312F3A848A3F2578A74B8F6C32154122C8F7FF2AB032E55583936359E575F9AD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 9b2e76fdc22be3239be4a5f6f318a9860c3a2560b7cd217853d6c4470eeb5748
- MD5 7eed058af02f1ee515de8524671acc34
- SHA1 7df402b5bf69a414a74fea15e62f31f223d2db7e
- SHA512 96b8aff73bd6f977bff61ff23f6b7408424c6953acd62ed15c9e4da5d1d0f560d6e21615a0163dbbe967acc1c05661f816e94d4ae8041e9161aa7ec7d38cf4a1
- SSDEEP 12288:NvUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3O:Nvt2rR8FfBhRJUEbDk1ulUe
- TLSH T1FCC42312F3A848A3F2578A74B8F5C32144162C8E7FF2AB032E55583A3635DE575F9AD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 1eb4b1c8fe472c54d024bbc8e134eddd964ffb0e04a34b5516d4bfbbdb3dabf4
- MD5 5f125569fcda506d488c241679dbc661
- SHA1 579d6d368b0c9306186e307ecaafb61198d0c3f3
- SHA512 07380e69eacbfa32aeb8554ed9ef131896a19a892d710e9aff532fa9e5386e8675fb4006d1eed43de7c55bdf94472e1cc56df824e85c06f900f7424ef61d8c04
- SSDEEP 12288:KZUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3e:KZt2rR8FfBhRJUEbDk1ulUu
- TLSH T19DC42312F2A848A3F2578A74B8F6C32154122C8F7FF6AB032E9518393635DE575F96D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\firefox.exe
- Size 1.2MB
- SHA256 9d78239f42d387d57d7ddee7205704278185116eaaf545fd5a2018e03c292c4f
- MD5 2e26040aa6a6535e00b29a1849d4d886
- SHA1 ab07c60b01ec0aa482c03226384b8150ba2ec77d
- SHA512 797ca63cfa853ad920887d6d6e2c75345c7841c9d52927ab8e91e5d11e6efe5526fcd091a2b2f0557bf9b26c812f60918b2c3eb8297f723801fe1f45bd5c5e17
- SSDEEP 24576:4OvG1kQqoNxaqIn4SwpemIwpelzGt2rR8FfBhRJUEbDk1ulUt:tvG1knoNxaqIn4Zpeapel6t2r4PRSEkI
- TLSH T13845D103F38516F8E08AD5749A56D233A5723C880B51A1CB1BE93F3A3E31AD15B7976C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 c23d64b2d8ef03d75a537114f71a2fe390c4327c94126d9a7c29ae127def80b8
- MD5 4a26411b49c4ae37c62698d90a69bc6a
- SHA1 f09c428109712905dc98590f01196ce2cb56dbd2
- SHA512 0509767541f5fa0ebff47f94c729f9b5e83e34f94a3172aecab95e5a0db83896aea71976e96f32aa1204ad5cd5b3b623fccad6bd0fb39803e97199d80da8b1e9
- SSDEEP 24576:bfwvUk9RX6wkyAIDt2rR8FfBhRJUEbDk1ulUV:xMnYIDt2r4PRSEk1ul
- TLSH T10835DF29EBDC44E1E1B7923C99B7460AF2B178591B31C6CF029A536D0E37ED46D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 0f0d502955be11b97052f11e6ae8c3c334a59776d367bb5c4b87f1ea6ce8417f
- MD5 6819b0d4062401925f2c3e35fb8be4fe
- SHA1 d606c29133dc3ca8ec8d6f985019871b60fd32da
- SHA512 ec50bb4debc6ef8f705544a22c71a2b1a8492d17c96b74da5462611ba2474b9ddf5889ca57a4692c61d4bb4812e98be434a8de23c55f451a7014d3accb153d92
- SSDEEP 49152:nYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04t2r4PRSEk1ul:CySzPgt2sEE5
- TLSH T121066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556931F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 a188f9f84d1637f494ea42b0be99f05230a67d3cb477b688f1c3b303c0d73976
- MD5 1550a2203d44751eba203caf1f05949a
- SHA1 51645ab35c8f2c7bbc07198cf5a8ecb22fc08806
- SHA512 6703c54494ffcf4daa4a29b5e1ac7762b21d366b33058de8feebed9db99c9bec5dba5029d7db850fbb00534daa9540610afc08eb910c43c1ca3ca9c4fab14dd4
- SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmt2rR8FfBhRJUEbDk1ulUZ:Z47JUQjTirIhCnDHUPfF/ot2r4PRSEkI
- TLSH T1BD65AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 b9489fad15b5d6673112f972143ffdd7786fce07e3159619bb5bae496aa45c71
- MD5 32490ece0aa7e6607da4d335a36416fe
- SHA1 3a00b8bd68f5de6fccadc499c7915a6984f0f98f
- SHA512 ae555f15087b5f298bbad24dbd3838a95e016f095356f9b50924a298f2a58d2c2bb92f2683641cbb30e0bb037eda0f6372470dd1b1dd41e7fd8afc4f9cfe3731
- SSDEEP 12288:/bsfHUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3J:SHt2rR8FfBhRJUEbDk1ulUZ
- TLSH T15DE4F11AE29801E9D06E5274DBA68601B3233C5957F1D7CB16D0F43E1F36690ADFAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.0MB
- SHA256 c59d19fb8e802951280dc6899d16d5ff7d01e23d63492066779da706d2b1e7a9
- MD5 e254c10cd49f430d116a08690f41aa66
- SHA1 ffa473a7cef179afba4141ee6305053888fdeccf
- SHA512 f587a9f15677d4f9fbdc48d643b9487aae495a55000bdd1a33ad990c5fe26c46a2dd293d1b797698799fc18bd9aea4785d3f665188e634c71c1af2c8bd1d8eac
- SSDEEP 12288:avCndXU3fNC4B+BfNg4acDZUQQlaRM/OR0xwTi:av6xUP4B1Xxa3laRM/00xwO
- TLSH T191353710B626C75FC6AD40721E32C1CCAB707D02EE45AB0772C9973FC576659BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 c471be676da5f7095ba910db25feeb2e1351fb206f65348f307acc2f647f0674
- MD5 57f2c0a506ca1ee571225709b1eaaa9b
- SHA1 af3247cc1e65f836f9dcc06b62f17043e0574947
- SHA512 c5597ed03f2c9ce541beec261049e999d65168c79dcc63e9957888d35501991f9278a7693ebbe619c5d52ec7c15433db1c3b47944c458468cebbe062178e1dde
- SSDEEP 12288:IOj0cnQoTS0efsAaYDfnl83oMkUVRnvSPKVeW5v:IOjnTShsAaYDfnl83oMkUVRnvSPKVN5v
- TLSH T16A65E840A537E38FD2FA60B1172A5B4C6B64AC0373456F27A3C8557ED86A725B0F83C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 f12a57e79d63b16f023d76813bc26f5fb60cd2ea72243ace768717d548f385d7
- MD5 c44d4cd67af9c058b0f62eb546a7fe80
- SHA1 a51c7fcad8c6ed8e285c96a37054e99fbc13d4a7
- SHA512 e679855cf039e66ca3f17ad57a5b1f2ef27092f4cc13b37ff544a2072770a39c8bc94416547117a2ff930382e7ad8722f05202b6ab97ac6003c4d69378c17f08
- SSDEEP 12288:yz7/UBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3f:Q/t2rR8FfBhRJUEbDk1ulUv
- TLSH T19ED42312F3A88863F2B75A7468FAC33011167C8A2FA1EBC32D5415393534DE4ADF5AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 461ed89e76b13a4a1ade357b3eebcd2776fd956689d592d62f0233783666e450
- MD5 1944930fe1dd1b7da5fc1b5937432086
- SHA1 8e6db924a85f9480df910d8e72dd360811ed15d6
- SHA512 345479388abde1534e74bea5784d817c2c58ca8feb114d3c05268acebaa5663d591a4a9dee8833526d98276d222fa18e84e2878cba70a3fb8fa66ebf3dd055d0
- SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYlt2rR8FfBhRJUEbDk1ulUT:ogb4mBIBhGFmt2r4PRSEk1ul
- TLSH T15165AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 fb47bcdbc5140527f919925a440ccd1e4c0ca098c3ec8574b05d942f0b485ce3
- MD5 a86a5daec47abfca69a87d1bfc2f56ce
- SHA1 7f37c7ae09b64ee543efa1999c4bc15a4fb5da87
- SHA512 715c7459e967ee66c49486169a36352767994a60e6edcaa858bd3f6468c32053d037c06b26ade4fa968922a7387103e6a757aaefed938fa41d34fcc1cfdb9d35
- SSDEEP 24576:5G88u8FpJqH1bzria7/m2t2rR8FfBhRJUEbDk1ulUe:s7ZFPqVea7/9t2r4PRSEk1ul
- TLSH T12D350165B3E001F1D477D13889924663F6B2B8151370EFDF0BA88A651F23AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 0824704586d436b2212dc9ca528cd652e1db00716aec81661853b85bb963f617
- MD5 c96ed0c91e7db63e9c08bc036e96f631
- SHA1 0665f797d6c706745d30bb5b82cb5dbed552dbdc
- SHA512 cfb0bd0dd591dc7750584fc9300edfcdd52fc9e82656c8353197448d3c3e37b88eeb57b52c240ed50ef4d829857cf045abf6c37ab5b4b63e3febafc0ab7a5870
- SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjat2r4PRSEk1ul:/G05lO43b7t2sEE5
- TLSH T182D5C06A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ba0ec5defceae3a14e0e4af1a37a4c4f72a5724f6820495a4cd537dd86d27c70
- MD5 d7273075529300e18ab45887516e29d6
- SHA1 589dfb686caf66a1d0d5d466b803590aff88e4f6
- SHA512 147cd54416475e01c9913b3ead357f52ff0326443ee8364bc1e25aff658814664a4aced6a4abe69235d2182c8117064280fe5144593c1a9c675c7d6f76a90c53
- SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4t2rR8FfBhRJUEbDk1ulUu:Da5POZ3BJt2pasx2+mit2r4PRSEk1ul
- TLSH T1ED65AF5EA3FC01D5D179D17DC583861AE5B1342653329BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6e1b3fce1783171410fff7c9ae2cfa73f7ca782411e73a9f54f9155a1cf0fc10
- MD5 63b3bc98fbb46705b1f4f02334e936d0
- SHA1 c89f83114a82c16790b81586bb382a46f11f896d
- SHA512 d218dd0cc642964bec3ab76831331faf95f137fd91e02742d59d59fc165b6c8a9c7d4ecb1dfb91fed0e2d026b2c200cfb93872fe572efa817b63bf0d3f76f5b9
- SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fk+t2rR8FfBhRJUEbDk1ulUy:zNc/zEOVHFdt2r4PRSEk1ul
- TLSH T1EF857B1623E901E4F1BBE1BE89779546FA71786917308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 795f13e3fe57cc54089ccb657f153391e31ce11f97c8864fa0a347eb1fad973f
- MD5 a162fd70de0165b1a4effb2eb8973c75
- SHA1 eb02e46d6ae68a715dd7d26287280e446c7f8dcb
- SHA512 deb1e50d2dc99b1e8b34fae2e072862b643e4e0600cd7d4e7d5bb5a301e5217084123184aa0369107d0c1164df9f7e8b6437715398e923a83e3d5bd6d4b752db
- SSDEEP 24576:JTkNvNnaFeYhJNtmZBmUt2rR8FfBhRJUEbDk1ulUZ:JTMwBtOmUt2r4PRSEk1ul
- TLSH T12D55AF2EB6F846E4E1FAC6B4CD238512E6727851173293CB5290C13F1E279D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 3593c8db8000545a5796a7f79ef7f6998e5a32894f32e9243d59080d04710449
- MD5 62c3c98cc1cb811d5cd0526a8a278717
- SHA1 2e62894a9e532a42a05d93d7784697efa95f4cc7
- SHA512 2dfd0abe41e0ca7c02cf5186b5143a907f7380cbee9e84731ac8fe99371c8ae42654d64dbabfc2d28965aefefa0398c9d8e6d9cc034f71252059bafca3a3f7dd
- SSDEEP 12288:FHvUrBFrEjwaQKUBL8252uui8FbECP7BhdfswdJ0NXdU8ZWH7DEP1rCJ7U3B:FPUr+NQKt2rR8FfBhRJUEbDk1ulUx
- TLSH T1F705E12F62AC18E5E676E17C89928719E77278561712D6CF02E0813E1F27DE8BC3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 cac1f890e384e16d3a9e93833ec037678336b88a8950bba501e38a42faffa0bd
- MD5 f83a76b6cc1444bc5d810aba1ddf0648
- SHA1 a6efb00c39062ea970855c5a906afb635fdd90d7
- SHA512 79b193bd6ef62069416e666d820c0f7040a966e777a0e93cd763c81eda3eea531648684a47b12f61f5d3bedf00bac18bc41eadbb4a9379b8717351d3a96ba006
- SSDEEP 24576:qD3FHshBIYQgArt2rR8FfBhRJUEbDk1ulU6:qDVHeBIAArt2r4PRSEk1ul
- TLSH T18F25E13EE79C04E4E57BC1BCD9638606E67138A9073266CB0694817A1F2BEE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH