d3f383dc83c741c2a65de6e716c6897e4a01bb042421fd79a37bd04b59d583cc

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Size 4.2MB
Sample260711-gftdnsew6s
SHA256 d3f383dc83c741c2a65de6e716c6897e4a01bb042421fd79a37bd04b59d583cc
MD5 c8ec7cd937750aca2e85b7e70543d6ac
SHA1 2264e2f2bf631dd3240badbfb5942df8216fb564
SHA512 7ea2422875b14311377edf752932470bb6a57a3c392accea2cdc9187bc881bc97f589c570537cc6a7bcacd15507235998b8242891b4ca3afca400a3b38acb96e
SSDEEP 98304:uBeT+vnGgSDM4iiuSweb/jiVZiVHTvhrqLgrExHC:uByIGglSnbdrqLgQH
TLSH
T10F26DF12BA828076F5930272547EAB7E48BDFA30073981D7E7E81A5E5D306D2373A747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4544	elevation_service.exe
5132	elevation_service.exe
2480	maintenanceservice.exe
1196	OSE.EXE
4396	PerceptionSimulationService.exe
4612	perfhost.exe
548	ReFsDedupSvc.exe
5732	SensorDataService.exe
5772	ssh-agent.exe
2824	AgentService.exe
5152	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fb7c133f24febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004134e77df810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d23aa7df810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043b86980f810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc08dcc2f810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2824	AgentService.exe
Token: 33	5152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5152	SearchIndexer.exe
Token: SeDebugPrivilege	4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	4892	2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	4544	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 5688	5152	SearchIndexer.exe	98
PID 5152 wrote to memory of 5392	5152	SearchIndexer.exe	99
PID 5152 wrote to memory of 1192	5152	SearchIndexer.exe	100
PID 5152 wrote to memory of 5504	5152	SearchIndexer.exe	101
PID 5152 wrote to memory of 1348	5152	SearchIndexer.exe	103
PID 5152 wrote to memory of 3864	5152	SearchIndexer.exe	104
PID 5152 wrote to memory of 3152	5152	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_c8ec7cd937750aca2e85b7e70543d6ac_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5132

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1f6fff25b30280deb2dc396a972178cfab7c04f862265853fde6e04154e3d089
MD5 918e4207632f85db8c3ed695252fbf0e
SHA1 7b06624040c8fe026e57e5c847d93dade916d3d5
SHA512 398377b3205d368711a9535819cd7b2c72310ac6340cab8961225af07d91b8fa0a9ba4689b33a2c1784e2ef3ecd63a0411c339c636816cf02cb0aa95697e17af
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnrxHfJvYrPs9HHC:K3q6sjBKgrExHC
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b16fda9c16052113e8b17316330e448ddadf0847c8197aa20e85fe90e16e566f
MD5 15ffe8c261b9aa1cd55935f37f3215d4
SHA1 458bc40887651dea94e7c22935b377892bea9aa4
SHA512 65b840ffb02c1ec59498ee9e5f1df49d9bf8e3cd58d6d3036e58bf8be9943b310953b17b10b7c84cd92e231faed16c7cdf1c16e49063dce1b44747ab1da08e6a
SSDEEP 24576:JXYfDtczAmxHfJaMJWTTXPPC1X9qSH9Y6VyP:stcJxHfJvYrPs9HHC
TLSH
T1A2750228B7E509F9ED27827DCCA28111DA337C5547A0E78B03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e4b593b9284caf009df807219218f62f087758022427c38e6a4c38a26430ce28
MD5 8eed3a7188a528ef17f14b7a2598c5ab
SHA1 bec95534047ec456bb8e73e136feb4fbdcf755bd
SHA512 42eb6aa2aff5236d5f02968bc70dae2b1bd40cc91f7b17db9ccc294f0626c72baa7d9d3e629531b97ba43d4177ee6cda0d164547d319e6d07c5b4b18c6ef2c1f
SSDEEP 24576:f0Le5ji0hmxxrMjxHfJaMJWTTXPPC1X9qSH9Y6VyP:fPji0AjQxHfJvYrPs9HHC
TLSH
T15C859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0b55fbb397d14471f73835438034d4978e3fb16228746394e6ec60a6cb6cd9f3
MD5 c58d1cd7ee7599f5ff696871f200e181
SHA1 18562de9445b44f539ee4573b2ef211387580384
SHA512 b3a2599fba905e2d80bf59c4a0babde5c3a434bc96b17f495bd38263ce0b311a989fc2b273418ff7d2fc816e897b67630efb211faddd28acb97ffb84e32cb6a6
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyuZxHfJaMJWTTXPPC1X9qSH9Y6VyP:c/ezSC6vUzPveHjysxHfJvYrPs9HHC
TLSH
T1EE755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9e322465b73dd9471f58ed1438381ad58dd8966e96c14164bc2bfcb1143ebd6f
MD5 eec444ed80b5de0aac44a21a733d2e0d
SHA1 f234c0e19e479e6d02cc6dbcf6b644598ac9861a
SHA512 b37d849dcb9329d0d4bd2ed554710f9858c9bf752647c8863215c5dc2ce0a7a244478ea85bc87971e60414c4003f24722bda380531ed6aef6e7f071bf663b6e1
SSDEEP 24576:tVbqPb88hv/l+YaxHfJaMJWTTXPPC1X9qSH9Y6VyP:tVO88hXl+hxHfJvYrPs9HHC
TLSH
T13D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3845101e16718ff37e9b8457888c1658e8bbc8beb5d1fd0eb8a0940b058ca312
MD5 dfa1cf0998fa6f6e81401584769baec9
SHA1 585461bee86f75dd72d68c9acd94b8efb9ee2221
SHA512 3d9000a490548022f3321a7fad0ce529c64f65a1321100fa4e753ab2690c0662d2a4a9b8de06fdd80cf34bbff1e95fbb40aa1ccecdeb23bc95c2005cec15e250
SSDEEP 12288:DLnxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:DLnxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B8552352DEEE9375EF22037605D762580852BD6DABC7990A1003BCCF253ABA4D00F8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4dfd1719b243172cf1cb74434e949bad464cc23543d9547a62103486be1c9235
MD5 68c5ac9d05cf18b4bcde44a491bbf208
SHA1 7998b5e34f0b03ce6c72912085498d71e43481a0
SHA512 0b502d647ec3db48fcd6ec886684bf084b3547d536a3f83034c6f196c265f2bda95409d663aea98202da940583dafe482034eec26f80f9bc7d7925a8b1aa0f4c
SSDEEP 12288:/eBNUbTVO86USxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:/JIUSxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10D75C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 db8c0286a1bf0238153f9bd6350e9b337d2226c16c1fe6887b34f862d3fb140e
MD5 cceee2f6f2ce0567e96cc361d71b254d
SHA1 f0af4c8a33cf6c7c71ec92686319437a9f397d82
SHA512 66ffa34bc5a34e42173a20a84af04afb574a4a23093e7944bdaf9cc7dc6241c48a499d925da15ea0b8c4406ef214cc971b71f77ea6fcd4defdc2dc1ff71a39aa
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:eQvGAdlCEL8c/DRNw5CpgrExHC
TLSH
T1B4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7f66cb4b7f74fb77ffb893e1c6a21d08a3ace7fe2d8c42c41125c0f21901e080
MD5 73e66a85f8777d29a8bf880a059ad639
SHA1 e11960ed5ab3667e258ecea758fa37e7b5dca837
SHA512 4db4180eef97b847acb7e81fca9b48c50bd06561e17431af54fb6b9930a9ad6563f24e3029cd3bff22c9ec66d4fee8fb2a79436477e3f911eb5474962f8c821b
SSDEEP 24576:K0ewsAjgxHfJaMJWTTXPPC1X9qSH9Y6VyP:LljgxHfJvYrPs9HHC
TLSH
T17275E031FE75E036C77B0DB61B26C716146DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f36f3eeb3effd33188a96094241afd7f885dcc9d45824b9a344b1d103b2bab64
MD5 565a738aefcc5f5bc1969da4ed0e0ce4
SHA1 8145b846decf39ab4ab7ac029f10e68dc7b28e59
SHA512 bd79c711527f7f86e299c88510d49329ac42c76219cedfa5173622e12bd9bd4bd6e1e32d4f9db42b35791abff8ce500db5f50d596a5ebac3a6ace1af6d9c2b54
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHogQH:uUEtQevvqc2W1cpV2tI32Zy
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e6bd09a7f2cc82707d7e2c19b736765004640bac4d0cc4af35fa86ab15fe5c58
MD5 7a03b6e8a1849f12eed469d3e5fee91f
SHA1 8753f1524061ff4dc56cc33190f0d8af9674c409
SHA512 c0dd3674fecf2592ea268d2049b7f1575a99543e1744d13e478758c3e4e448648f562ed7a124d6804532e7a0b2f87d04a9c2c03beb6233205802b8aab79438c3
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zAxHfJvYrPs9HHC:Hoq2Vjnm1grExHC
TLSH
T15CD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b28779febc02bd8c76313673e60aac974ac0941fc9948b3ee24e10a1ae26fe6
MD5 a2a539383a3773b26a7ace744b8244c9
SHA1 2c23879259a6c4a2ee56a8b73e9a3ffa422eded3
SHA512 54834f74de7f57d449e8133d9b59c71d6ebe6a0937c1f32a56642a307ff48a2cbf096d3a0a91a878d2817f597db494c5fb8d6f6c3960f7f7abe6371e0b56df07
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53VxHfJaMJWTTXPPC1X9qSH9Y6VyP:ZAMUFoiq5FxHfJvYrPs9HHC
TLSH
T1D035AE81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 46cf2f0d9d9f40a32ecf1dd27559e37a6b8fbc9816187ec88f6520cb3f8f5976
MD5 44c1942ecac0341b3f89e67c35c7b951
SHA1 5a46fa0a7289fec03894f7bf55fc5d8dc9af4b88
SHA512 3f1d3ee89cb6f14d07ab7c0c01f2c4d2b67d978520c9a43b288479c5b1f298d3c636afedb9fbe1ba62022f65709521c7d42ba13447118b726fef5b2291e2f2f7
SSDEEP 24576:fwu4OWMxHfJaMJWTTXPPC1X9qSH9Y6VyP:fwvORxHfJvYrPs9HHC
TLSH
T16465F14676E90CF9E96342398597C135E7F2BC062A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5d976c8031edf7f3ed93f85bc8550dfa1c66814cbcab824c37cef4efd8396a7d
MD5 2084f33cdf322a17d85d5a871c6966c6
SHA1 cd8c92be4c3081a180839bcc72fc64e0e03368fe
SHA512 77553775713e9f180b9bf74ca15dd67ef6ba6df937105c1946faf40727d66566560b6ac4d4d6986099c92a256cc407761695a4d13efa91eed0f4187ab1681168
SSDEEP 12288:9eZ1IywxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:4Zu7xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1EF55125A36E861F9E663427D88E252048772786A67B343CF1111A68B2F33BD15D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8cdda8e043df13da2d04f59a1df31f1699647135e84205cf260473038200fd5f
MD5 f4221856f5896f32559c19005836e1c0
SHA1 25d53fbd9357274b1b661be4febe4941146e569e
SHA512 788553ae5178eee2afb0e42c1e57944ddfbfd21c9236540fa391c0c0d93e730244ffbd4ae2154636984bc34b2a842822509c2346ea0767a8cd198b0c68af3d53
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:4QRQyi36YOcPbLvw2gAf+PN3+grExHC
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 12bff23dbc3fabc5c7fac42599fe371ae0683ccc2fdc21250217b0a2a356d25f
MD5 4c731d1ea13bc57dbe3c6d9c10573308
SHA1 de5857c1e254cab2d5bc5a29188c4192b47bc154
SHA512 8553efedaad32f043c096628fc6100385e6226b9a0a5ee4a0b3c68d1ec663d6fa9363ed55459f4c8bd6d84cfc1e321e60c2194869c856f0945731b058afeb93f
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:GQRQyi36YOcPbLvw2gAf+PN3+grExHC
TLSH
T1CE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 137db5569814a407755a2c8aa91a07cccb7129f0cc4e2326a8e7d275b2d69446
MD5 0845205ebdb54eeb5cd3704e7cbe2c48
SHA1 bc4fcd76c9c23c29d86368d8d4ae86aa3e352d19
SHA512 9d1f9b2b11edc9832584e537823fc07c95edb8c18678f1b5b04923cf292a2d322c9fbc1df291f419be6f8c244b818e73ee6b384dd603182ffa1ddd41f7dcc70a
SSDEEP 49152:s68Qg55nhceWu7PNU3/QxHfJvYrPs9HHC:mthLRc/QgrExHC
TLSH
T130B54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3489f0f04aa5e13dce8c33a1a548130c52c1da6a0c8f524c20598b7537b4d5f1
MD5 70c89c0e905c0bb8d4717817ef70180a
SHA1 89eded3d01deaf3fec3c52185b9b1ea1954915e6
SHA512 3c2453a32ba65454c8734d7caaee2f60a8792b08b17434d1f178021e8f5ee1c2cc47c1b1f224190b026d417ec388fdadb8af8a3936ab6f12f89b21fb27391a93
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:/y5112gYy5azzVvt69nLKnhZngrExHC
TLSH
T12B167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f980a9c990dc77143ab05b36360fd01129ef0c347eaff1b1c824aaed8fad8124
MD5 21cced250510e6ecf8e87c394fc619f9
SHA1 4d3edf1ad883282ac72e3780635df582fe8fba55
SHA512 08ed86f090e3b47847d06adccd8519090fb6f92e813b5dfdf0e5578d7b037635f5a2aa83711b9241e6c0ce398f5e548842b74cd722631aa167710b1ad3f6f425
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWxHfJvYrPs9HHC:Ju6Jmdxd2dWgrExHC
TLSH
T166D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bc88bb0dc3d0cc522f051e36a00875970dc9f28b47a7b922be92bfebce03ca26
MD5 b5849a482f4911cc3a81de89137140ad
SHA1 51a9104b8bbfd3f70105b175616d92756a53cc05
SHA512 cf83ec74b8369951fd7f2101fe88ce610def7ac81bcaf438bea420b173e4041841947207060586f0dcc248c8f35e8810ac4a931fa57ddfda8bebda5ce5f8cb6c
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xyxHfJvYrPs9HHC:vmifPWR1grExHC
TLSH
T140B5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7ef331df887c93ff8ea2d3b4d3513cbf3175488d4f643a332204cdaa18e06d0b
MD5 af5ba45b73a04afeaa3c2b433853aba4
SHA1 2b1b5ebfad94bf9a23c2884efd8337610444a1e9
SHA512 928628d0829ccc9df033ecd3a4f0714a747783f37209a9590a23cda2cd810ceb17ac23a9a8296066947185980d74e8d93063badcb2a41a60ce4001f14add9654
SSDEEP 49152:XSuZQIY0Be2KcRVtOnks6NMHq7xHfJvYrPs9HHC:N5dKii617grExHC
TLSH
T122C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7a904c91d177c842f87bf91fd05b77a01e38649082792f88f2ecdc98db6478b2
MD5 392d833120045da8f56c3f07d3e66d5b
SHA1 e3237734a5ceb66f9b7e66f9293ef9d718698528
SHA512 3c29e6db5b73894104370bf3c0e833165be88adb6156821c493880710cdd168e87bfba54fde33e2d403531290ac8b6bc5c6ab70b33d7a77078f6e36a4b496bb0
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5wmxHfJvYrPs9HHC:/X2imphxgrExHC
TLSH
T18295BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a4a95f9a53354b50ff7cefb679d15b269dc294386db4a7947e9d4d2ec79ed88c
MD5 b59e187582546dc1418d37d87a111db6
SHA1 f6f97e739d45c7cf0ca435fe7b71c27f1a1c2cfb
SHA512 93a643a58fa44557f71c2cd27c918ff3062c300b4c3c20f1b7899c723a9714a89c5e3662c4db00d8f2d3a3b147faa8821e4600185344d2b12df8a8c566df08eb
SSDEEP 12288:QfxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:QfxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T175552316EDEF8379EA1103B6459353880856BE6EFBC3554A2107B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d1e33232106b6e37428ba3246f2dff266f74d4fa435c445ce64119e5909b29d0
MD5 258b69dda07732adc75e7eaecb9588f4
SHA1 fd8a24d4c63e98ed43c725068e74eb04e4250d22
SHA512 ce953c11df6be4e09dca465c6b57744a1d201643e1d0eb5f319335e8fa0d67b4cb95987d4e63a9e1e885186888567f6f4de79ac3e2b57fdeae2643cc31b69c37
SSDEEP 12288:oUxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:oUxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A4552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ccc417a09093260ed0e92c86ee0aed9c5d43d5a3322325505d114d9c0de55214
MD5 0cb283d1a984924536b3e74d061a98cb
SHA1 d6f5b3bfc8625e10edf2ec443ebdddd390eb1a6b
SHA512 049e66565a80fcfcd3dc3ae4f6d5dfd06da1f30f9923da8ca6bdc9ba76f5dc07453e6984898681d790091ecc72be5760b32d5b24c65371712e342580f1b228f0
SSDEEP 12288:XKxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:XKxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T188552315EDEF8379EA1103BA059353980856BE6EFBD3554A2007B84B367BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6e7bccd40df561a68708f11c8c7e23ac93a523b01cdc406dcf0ab48f03125f32
MD5 75877560d214efbb17cc6602c0a875a9
SHA1 9a170e5c266ea31d3ff9188d13fdec02e7b95624
SHA512 57f7497a6e4fcb3c28d5a27360dcd4ac27854d37ca53a25024fea0051622d64d4c52de44c8538209c7e8f08b787ca30ec0b4a80d321c13ae8b68117b52433f24
SSDEEP 12288:oV1xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1485523116EEF82E5ED22837989A352540572BD6DFBA3568F1102788B2F737E0540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9a2bae20adcba317fc887f6e819dbc3077050c671c294ab87352662a36530b11
MD5 3d6ae69c8761adf9459b3e5b82723894
SHA1 5d97e5bbbaba2db569522cc5c945358cfd8f884d
SHA512 5844b94828352965ea16d35f9a09700ff4d0a7d00bf8a3bce7189b3e2fd57332cc5068c67fe244f9e0fcf0b970cf45df714bf51e4413728a8784b2ca6a118871
SSDEEP 12288:x9xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:x9xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T123552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e1939d6d66d8ba5e0d45041dc80f6178dfc750cb15f6367485cb70c90def2d93
MD5 1eca1182a82cedcb85189406843ea3ed
SHA1 84a5372bdf96fc090f47a6fdf4c7b34087e719b5
SHA512 f347231b08de2b330db1ad818b0616f1ae7a47e50a55ca203089e2d4a8b3a41d021b2a346e3e61e2143ca38360b3e345f552617781a6a999d7920cb6bd275575
SSDEEP 12288:f4xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:f4xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T112552315EDEF8379EA1103B6059353980856BE6FFBD3554A3007B88B367ABA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 961ac8b0db0fc14dfb726e0c2abb486980198bb5485b010d75ed0cee2f51f40e
MD5 11a27628dc364f88fbf86de0a6cbb4ab
SHA1 154efa690e80549808acf9abafd99585167ec16a
SHA512 2d6fb3b1727e01083c94c492bc08d4e5fe6556a1ec2d0ca80ff8686f318a1fd5a65a393740c98f2552711abec199834314ba4419a1d2e2dd02f54d1ad7930f42
SSDEEP 12288:I8xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:I8xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T135552315EDEF8339EA1103B6059253980856BE6EFBD3554A3107B88B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 06b1023ad91f1d10abd67e482d741c4261e516a4008ceca17fa0770be0016852
MD5 79d1d599b9c0d628610b46a090bf0314
SHA1 381266866c0738c8c8497968c18360f9be31e3be
SHA512 5d202b2693d5a3f3526505ff33267890fb29b41d560af4686bb88635e1bd879b56b82e054cd1dbd1df6c2eb261afd8d4a3b3ffe0b89eef251413faa41c3e0186
SSDEEP 24576:OZMRzFVSO0xHfJaMJWTTXPPC1X9qSH9Y6VyP:OZMRzfIxHfJvYrPs9HHC
TLSH
T177750295B39018F8EC63823ECD568905D6B27C5A5BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7e8978aa1a3427cd0ce0942ac273c26ce0e7bdfe0afcbdad6bbc3e3d21f37dc2
MD5 e16928e0c27f36e56e240d1b9ef7d8d6
SHA1 4ef09ed866391badac0e1551e7cc77ddbc684cef
SHA512 8e4bc75687569fdfddb7b359ea6e58ab397b65a4ca147abdb08075b97432d4e18407e7cb330692abd12062477faf6d2942316bbaebf341bd57a7b8bec8c5dcc5
SSDEEP 12288:tLxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:tLxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T189552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d9dd54c28c22d94d7b644d89382fa3706160580a3353d42d4aec197cf26df085
MD5 95a556effc101e46effa9be8116a1e7d
SHA1 7405d848691c2e23e77563583cf4000a9b95ce7d
SHA512 3ac571e6a89b548351069a2c35baf1c780e334b2ad14237cce5487a963a022fd564b0fbb7c76fc151802267b1f625a62385bf8c423f65fb1d6faa1d261b1dea2
SSDEEP 12288:g3xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:g3xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T173552316EDEF8379EA1103B6059353980856BE6FFBC3554A2007B84B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5562f44279b3c89f38a0b0df13c62732255ea03c657f5fadc47b4b3b0d7d211a
MD5 8bad501b4ac856a71b83354a2c6e0e23
SHA1 b5da0821175247112d3f6f6bd18bdb7c18ea382b
SHA512 95b18d3798a7e48b51fb5822699f2554c1b5c378415ab1cf9214d2e2ff08ec158762cc0e9b541812f89e11771d7d23f069adceca62e773fcd7ea9c558d5225d9
SSDEEP 12288:JyPz5L8wxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:ozywxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T19865120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 be77c4a0cb0c71ecfd5664b18622e44d403865e743fdaf2eeaff61281587a588
MD5 33c0ee31836099b9e40754cdc91a9a0e
SHA1 3ad2be3f1fab514bfeb7ba0fc368efaf9b48de3a
SHA512 9ceb192a872e7a5c445aabad2a35df16001ba323aeb3f260d055fb37400dbea4f0562616fffae3f3191d1ba9f2d766729bf3101a28456b93fddcc1e04e02d49f
SSDEEP 12288:jLxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:jLxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1EF552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 90f2e3df473ab9dc52140c3d62a0d80adcb344f213f5a4e00e371c0c9b19ada8
MD5 6d27aa17ba4dc290607a94e3eb5144d1
SHA1 6277743001922594b4ffac78d4fc86c9ca737be6
SHA512 54c1814f26053b49e50f521e6139cef798f6e9a3b2d94bdfc36f060f925760008cda39e8bfd568a508ff80df8aadaa9a1f75c0f827b112fd36f4ef8f2109fcb8
SSDEEP 12288:ULxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:ULxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1D1552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a66e29680b4c0d1bf3e5546f715c0eb1adcfbf66195bba85f80a444ed08ad71d
MD5 c4dec5cdfabd7e0dbeb2abb786be041e
SHA1 2c0856dc656e2be37ea8da704ed024a8eb13140b
SHA512 749f3825adf57087e4564d61604dbe573040b46d900947692fb7349dbcd29e55e033fc5797787a851621e15a2b764601885d5a3381dc80b23222c8ca7c819b76
SSDEEP 12288:KyPz5L8wxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:XzywxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T19665120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 78484cf10d87097b35206c76b593d1421b2aea13eca500b3888cc9727af0f333
MD5 c2f4cc3e159262b75b7a2497e379c993
SHA1 cd272b311fa15dcf4075bb54e00847fb744caada
SHA512 a7fc7b18e20d5c3535ceb32fb383a41f9fdf92bd8b4eabd13a8f1c6730c5df7ec438c6cc5861d76661e0259d17cb1e06878c9edc2b20551d5519618ebf86cde3
SSDEEP 24576:gTDaLl3z0zD6xHfJaMJWTTXPPC1X9qSH9Y6VyP:gTuLljZxHfJvYrPs9HHC
TLSH
T1F87502A5B39058F8EC27823ECD568505D6B27C5A4BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 37f0225e9cb0e40989bab1428962ecb0a013522b9e5b975333bdeec23289dba4
MD5 61b6899fd44d0d205d7dfc8ce4bb831e
SHA1 f8c776f11b178c351c61333f4ea2f89a4dc71cc1
SHA512 2b49d4c6cfb4630143b43250ad9c5409a77878a7298048889c8a216aca3a7bcff4b665872ca7a27883e759d2dda071b83b54bff1ed6a534456865ef4dc1b7e11
SSDEEP 24576:13vd9CHKy7GZexHfJaMJWTTXPPC1X9qSH9Y6VyP:Vvd9CHKyaIxHfJvYrPs9HHC
TLSH
T16485CE90F3E810E8F0B38A3589764511DAB67C5A5B71DA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 32b9a5154cb143e475614350ac7edaea703c5718e58601288d65c12384816228
MD5 d45c421f2f51325b48a9202fba8ef6cd
SHA1 98710d4061ddab3d757548212a425ccfc76570fd
SHA512 cd4ec75e5c14e6bd501a94eed38139dcc4a26edec240175cb45bce47ba5fc62f7a4d6a5d3b088bcdc7d2b1c2a8d3b8adec23fa81991978a02956fbf3779ee464
SSDEEP 12288:ZqxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:ZqxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T163552315EDEF8379EA1103BA459353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d8330b7aa35dbd941445ddc141fb6141c72c92d57e000ef1468ed9b20d7e1924
MD5 aebd869372db45a4f449432e32a963a2
SHA1 5f9a791986f3289d4a7fd467f0a4a1dde934763e
SHA512 b1f31e04ff9681e20c12b4b02d341f04ed8bd51d8cc9a1393b1e235157f37e4c04f304fe9ac5795efdcf616fd00587a466c77b25d93954a84b8fcca8cce8a7cf
SSDEEP 12288:FQxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:FQxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T174552315EDEF8379EA2103B605D753880856BE6EFBD3554A2103B84B367BBA4500E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3c31afbab1eb77351457de571e5de547c5ff00c5f28ec58a707ebe95be734111
MD5 69d9666920ba7a877b9634ec4f746616
SHA1 4e17e26d3c9ff5749a304b7c0efbbca613efcc53
SHA512 ba5ecd20808357bcb69fed848b4a8e22ccb20f0bd35c074178ce690b4124cd87f638146a324c9806447333a3598670f4fea4625724e392f0cd8681cfa7f468f3
SSDEEP 12288:iBxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:iBxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T156552355EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ad3b59ab5103a41591f696341c00bb130f70cfe21cb1df8e12f6c2420aeaa9ff
MD5 ab67660265986c9380ea4a9a37782fe3
SHA1 6e28036ad1d63737291296631ce8b7f6e89d2ea0
SHA512 bb611b801bfb43f00d697b497c3a763c6b07cfdfb18810a7b4a33c22ec2bc86d44c93b3ff96c6a56ebf29c433c7091c4c3d2b51c4303b54100798ac63dc3e8d9
SSDEEP 12288:YLxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:YLxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T195552355EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b114dfb3067a59628df1aa57bdbdcebb6b7fe32a5cc32a823892775dd23d9ff5
MD5 ea0f96efab66bfe6f2a9353bef4f53e8
SHA1 0044cfb1b1e548f21ed32d82a923559b0fc7793c
SHA512 7b7291e5101af04b5a9e67a4477b0c60d012f7ad8d561a1c8bf45f176d3adae54a0e43ce775fc0e4aeffe019f456f355ae8b3412f74770611641c83d78e927eb
SSDEEP 12288:wqxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:wqxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C8552315EDEF8379EA1103BA059353980856BE6FFBD3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cc495a0b5b20f9cb1c8aa0790c68bb97970c42900e7cf644e4192c8b81298978
MD5 b300e04294a520be60011aea743f58fc
SHA1 a6b8f565279e321b453f8612db9279eaee3995a6
SHA512 4b10b747455ad23d6f3328361ed84c08d9f1c4dcd0575280e60741e44ceb2bda6c9059b801619d53048f781213bd18d02ed677d1e728f88b272440b3aeb1e897
SSDEEP 12288:KTxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KTxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1EB552315EDEF8379EA1103BA45D353980856BE6EFBC3554A2003B84B377BBA5500E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 8a7bb041a8024c54b467b08a4d66f69ea2fa93c19a85c5b3b5de5e83b16c9aae
MD5 3d89712e65f178fab1330183ddb267a2
SHA1 91d50627a90230d0eb1c782db34015568636515a
SHA512 2ad9d3932d842a0891ba41a7725a71d666ab5aa3f6b1766c70ba229e2cc8796c113730ae3c493d06bb1f37fecc81a67a99ebadf14e08d5a115b37660a217ee02
SSDEEP 24576:UfwvUk9RX6wkyAIHxHfJaMJWTTXPPC1X9qSH9Y6VyP:wMnYIHxHfJvYrPs9HHC
TLSH
T14385D029EBDC44E5E177823C89B3460AF6B178691B31C2CF125A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b3042b82c550f590834eae4b67f9bc1e7ef740f6f5dc729a96ca5662a0ab72f7
MD5 fe4b2b734524f7179d03794f69359a13
SHA1 11764447b176633d7d9ab80f2420a1ceea294515
SHA512 91e633db1a77ad9ca85bd76212aa68fca6e3b51743d50ec1927e723fdadd0c6e1ab9d2b0a3ac6582fc98d9f1916cd62662ba5db7e92e8ed3565187f1157a166d
SSDEEP 49152:yYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GxHfJvYrPs9Hi:pySzPegrExHC
TLSH
T181067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8969231065897c74f1c2de8fb762be991007c15f8f20f4c5e3be1315d7e6ee30
MD5 f1ebe2af986b7fe17a6b5a9714074d01
SHA1 eef2e1a4f711e22a553fb813e9c7239c47163ae5
SHA512 b07f15c0e8c8d091f3f547fe6bdb9dcaf3cb07c04527001b5f634004e12ce959bcb1ba574c3883d0a25466ad1d58c235704a7a11ae6a7a1be3ea39e5afcbb357
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYExHfJaMJWTTXPPC1X9qSH9Y6VyP:J47JUQjTirIhCnDHUPfF/WxHfJvYrPsI
TLSH
T18565AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9b733974127e46c8c08fc57befa39d5f194e8a1efb5193e15ac8a762a239c3a2
MD5 b110889d0550c1acad3b025ed6a750cd
SHA1 7921a82ee0cc9bc50e0b64b3b38af978ff3b291c
SHA512 1df222b8a0fa79ed196f76f24713dfdf49b47c5a478a12976c098d21a6c63114a453f04bee603037a3a465693f444576cc5a36389733e713b429325138be6a51
SSDEEP 12288:Jbsf7xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:k7xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A065011AD29842E8D02E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f166c27a6c2e2304f2572c96437f9c2af457fc8d7d71032ba7a58380974fca2b
MD5 bcd62cb76b271d3fa083b2004fe0a1b6
SHA1 8cfc40a68ece7ff8eed1f589999321074c93e607
SHA512 16491d20448a0ee96d1f5e62fc6b351c5cfc0355233b729889ffbb05cf835263c6526b1b953efe08603fd086c677ca25923a49fa2e966b93b9f1b763fcf762de
SSDEEP 12288:uu8JhvxU3fuQrmCb8KdUtEzSZhSWTF7Ou0osgkKtFBjAkSNhXh:uuoh5UPuQnAEzESATNgKfBjALPXh
TLSH
T177452741762AC75FC6A950321E36D6CCA770BC41FE449F0372C9873FD476668BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 29d50914d7ee72c1490248e3b5132a7d803b93e21d7688a729319d9cad428322
MD5 9db0b647beac5bd5f90742a015efee0b
SHA1 9d38a6e4c7e056ee6a60d4a895bd02a25be0d602
SHA512 473920edd31ceee84bb3efebb36c35d14c0e22174c05f01a02fecd07d4dcd020deabcb259f0c60997cdf261131b80a5bf49c681cd0a019cc20f8811583ae26cb
SSDEEP 12288:M2Ij0AynfpgrnxCJt2x2OPb5+6rNcKJxNeOSBX5v3M+aGDzxm/StcbA58hhK:zIYUxMA0wY6rNKMGDKAQGeK
TLSH
T1B6552A41A5B7E31FC9BE50374732868DBB746C06B7452B0173848A7C88676BEF5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 78KB
SHA256 cf42d5b750058d2fe19016db401ee26f6f2ec51a618f68ed231de88cc23cb50e
MD5 dccc58e47d693a626fe384b86f3ee094
SHA1 2debd41ee7cce88f1ba19768185328a1eed6e841
SHA512 f00d631c3c8c0d2b54a25aa05dc3b863278859c0a1b96293fd1702c6ac0e5aeb4c5daed4ca7378fc9ca5c8f5918b02a3ba19707fe991bf76766575f109fc6d4f
SSDEEP 1536:NPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVl7hxx:NPMSwvYLbmzINcydDVlV
TLSH
T135737C432A5544F2D2866231B5957B31A7F5EC620F9A06C3C3EF82EC2FB6787F561212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c1f70c1b869213a160e490dddc9158d22e28692dc5c41309fb79c1d0f019c99
MD5 79d2099dabddd326906ff0de19f532c0
SHA1 2014c8058886a2b3fd4ac1dd572abda7e4976095
SHA512 c37aede789384b5138cfb312c373a4064dae99596de42c6fd28d3e1a4920f6a8b85913191d5312afc67551cf6fd66f9416bef81410a852f2d1d17d0bf4338789
SSDEEP 12288:QF7DxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:0DxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T119552312EAEEC725FD3103B504979224141ABE6DAFC395CB3002B48B3636BD49D1E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0ce7ccb345a6ee25b7d7e3c097a4e070a83999678cd60c049ab25b44f7146507
MD5 924ddf237d47793c06351b2541ef64b9
SHA1 5f6d23e7caa3ec62e8f31d25083b39d3d01de2d5
SHA512 23734758a8d5b3195f27a42ca43c69d1b18d0c9614de52e933d9e284d1c1a8adbdb11f9e6bb628df2b716bdeb3ec1cc9b71153997dab63b12f76ca48fec3d1e8
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYZxHfJaMJWTTXPPC1X9qSH9Y6VyP:6gb4mBIBhGFExHfJvYrPs9HHC
TLSH
T11765AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 85efc1c8b92d8dabb560e62adfae6d8f3113180ae4bb4aef0433368697cb0a8c
MD5 38ba0016e73ec316ce603168910909e4
SHA1 f82c2066365b9c2ef22985f37df9ba2711f46558
SHA512 310758373dfaeec5827ed3ba85a48b3a2463780d1aa6d9b993547bea6f3678244dd474a151593bfbd4bfbc46e89871c026fdf727634c4f36d292c5f359c99b7d
SSDEEP 24576:wG88u8FpJqH1bzria7/m0xHfJaMJWTTXPPC1X9qSH9Y6VyP:j7ZFPqVea7/hxHfJvYrPs9HHC
TLSH
T1A585F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d873584baf8c2ac6d14297a7fe23c34c3566bcba9033b6181da86b09768bb7d0
MD5 540364d892169139e2dacb9d43b001a9
SHA1 7b1c89a377bc9ed6fb83718d5c928ed7f3b4db6f
SHA512 fe45430cd9e8b626a5295c84a742aea4d01991882593df09309bd5616fa9e821a9b3474567849996d32650d57b76b6c114f3d6e2d4405f0ac65b51e6f38cf3a0
SSDEEP 24576:NPUr+NQIxHfJaMJWTTXPPC1X9qSH9Y6VyP:NJQIxHfJvYrPs9HHC
TLSH
T12565F12F66ED18E5E636917D85828309E771B866171292CF0291817F1F37EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7219d92235b7813380313a62b982bb74174a8b5738f351a6235a716c5370ec2e
MD5 09b4762290c9fe6d6be5794984dba91a
SHA1 00c083df85443c2170424e85523e22174920cc56
SHA512 dee76bb815189486f0fb328a6b8cf48bd0783e35a7ad88e35e87fbcfdb181ca5b644abb6b0811aabb0d440dbc3281e4279e0a4e2121a76312419079d6d3e25e4
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4xHfJvYrPs9HHC:0G05lO43bvgrExHC
TLSH
T19AD5CF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4bdca4359e5786d4cbc0acf0d4844c042b6f3e8ec79823cfca4e1430a0724a79
MD5 821c37f9ef93f0fa68e80879b570b9fc
SHA1 4c374ebe3ac4e90d2a9a343e6ae413e7343804a6
SHA512 bc368885930a2c96f48a9f6291a1b0f026037b9f9e5d583debf39363f1a593626590a1d510b082be2176f28472b1c55136343454321d46a8bf2ae2031aa65bf7
SSDEEP 24576:Vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnGxHfJaMJWTTXPPC1X9qSH9Y6VyP:1a5POZ3BJt2pasx2+mQxHfJvYrPs9HHC
TLSH
T15565BF5EA6FC01D5D579D17DC583860AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f607d974e718d28133b87fa1a6be4bb66b96e34bdfac2cd9395c8a3f5a14b907
MD5 45a12e3dcecf5d68ffc099cb09db5724
SHA1 7c501daf48d608beb2468a92150f1ae91513ba53
SHA512 b67438bdd6bcbd6b3ae9e1a3ce2e789916a0daa6b1ce5f1bf92b942f592712186cf61ce97e671df63e850d047ed38addb52060653438e2321d90c29a1244ed71
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FksxHfJaMJWTTXPPC1X9qSH9Y6VyP:DNc/zEOVHFBxHfJvYrPs9HHC
TLSH
T106858B1623E901E4F5BBE1BE89679546FA71786913308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 551aa8cf7999dca1a8851e96265ebb59fb716d5bb7d016f528bafca3c1d07618
MD5 9208432502bce3d14d89ae6506150f63
SHA1 db055cb089f9363588fb7c44cdeb75729dede32d
SHA512 c2ceefbc4d26455d1c035dca4f40cca987112756019556adc2d3158605399501c4ed7bb164706d685ea4a0b02ae3824b5c4a573f27abdd6f3aade484f752ad4b
SSDEEP 24576:yTkNvNnaFeYhJNtmZBmixHfJaMJWTTXPPC1X9qSH9Y6VyP:yTMwBtOmixHfJvYrPs9HHC
TLSH
T1F355AF2EBAF846E4D1FEC6B58D238512E6727461173293CB5290C13F1E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 642ac8c58a8dae0a9e0524c1480c328c48e36d135f967d2a73e3e1e68e4686a1
MD5 94bf8ee6047c21cef7ed7e4871e7e6f6
SHA1 5e0bd35220639073475aa480034d64e36d5dc417
SHA512 53267e976602ae94b649c928badfcbc86907bbe18aef74f918b2f30c8600dbb1ab00188ca683a2a2860dde60a78f0789afd2f0d9c46b50e94f304385afbbfeb3
SSDEEP 24576:zD3FHshBIYQgA/xHfJaMJWTTXPPC1X9qSH9Y6VyP:zDVHeBIAA/xHfJvYrPs9HHC
TLSH
T18C75E13DEA9D04E4E57AC2BC86638606E67138AD032256CB0194D1BA1F7BFE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/548-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/548-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/548-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/548-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/548-339-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1196-59-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1196-65-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1196-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1196-260-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2480-54-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2480-50-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2480-44-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2480-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2480-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2824-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2824-142-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2824-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2824-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2824-130-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4396-299-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4396-77-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4396-71-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4396-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4544-26-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4544-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-18-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4544-28-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4612-314-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4612-82-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4612-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4612-87-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4892-0-0x0000000000400000-0x0000000000846000-memory.dmp

Download

memory/4892-91-0x0000000000400000-0x0000000000846000-memory.dmp

Download

memory/4892-6-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/4892-1-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/5132-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5132-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5132-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5132-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5152-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5152-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5152-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5152-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5732-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5732-105-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5732-111-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5732-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5732-317-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5732-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5772-118-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5772-119-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5772-125-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5772-320-0x0000000140000000-0x0000000140295000-memory.dmp

Download