Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
- Size 2.8MB
- Sample260711-glpyfacv6p
- SHA256 d2fa0310442bea3367741d078296dd8f17b12fddc387201313e9172690cd3d5d
- MD5 86695f6b43d723c427a9b001e8c10a10
- SHA1 0ae6def376c5a4e1333a4eb9b59085929644a5e8
- SHA512 95fb121c67886575d929c905315460db9b29fd0c0ca331ff1fb87cfaf09e4e76538d2b288c2ecea5f49adf9963e53f4f16691c3cc2b8813fc945e587d6964aff
- SSDEEP 49152:dckCO6uRycRUAMHryl0+h6T/8RQ4EsFlt0bYLAxHfJvYrPs9HHC:dYcyGKM0k69oEjgrExHC
- TLSH T18AD5AE223911C536D55231F58D78AA6E956CAE2007121AD7A3F43A1EAF701C3EF3729F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1264 NativeUpdater.exe - Executes dropped EXE 17 IoCs
pid Process 4292 elevation_service.exe 3252 elevation_service.exe 4620 maintenanceservice.exe 2820 OSE.EXE 4856 PerceptionSimulationService.exe 4436 perfhost.exe 3332 ReFsDedupSvc.exe 4088 SensorDataService.exe 5136 ssh-agent.exe 5848 AgentService.exe 3804 SearchIndexer.exe 1264 NativeUpdater.exe 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe - Loads dropped DLL 17 IoCs
pid Process 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\65c7dfe48f8562d1.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NativeUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcd620c5f910dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc3067baf910dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023d49bc4f910dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c36ad8c3f910dd01 SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{E81A9C9E-52C9-4E81-A2BB-CC52A5F0B275} 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4292 elevation_service.exe 4292 elevation_service.exe 4292 elevation_service.exe 4292 elevation_service.exe 4292 elevation_service.exe 4292 elevation_service.exe 4292 elevation_service.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2348 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5888 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 5100 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 4948 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3252 elevation_service.exe 3252 elevation_service.exe 3252 elevation_service.exe 3252 elevation_service.exe 3252 elevation_service.exe 3252 elevation_service.exe 3252 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1264 NativeUpdater.exe - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4784 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeAssignPrimaryTokenPrivilege 5848 AgentService.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: SeBackupPrivilege 3332 ReFsDedupSvc.exe Token: SeRestorePrivilege 3332 ReFsDedupSvc.exe Token: 33 3804 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3804 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3804 SearchIndexer.exe Token: SeDebugPrivilege 4292 elevation_service.exe Token: SeDebugPrivilege 3252 elevation_service.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4784 wrote to memory of 1264 4784 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 98 PID 3804 wrote to memory of 2840 3804 SearchIndexer.exe 100 PID 3804 wrote to memory of 2976 3804 SearchIndexer.exe 101 PID 1264 wrote to memory of 4276 1264 NativeUpdater.exe 102 PID 4276 wrote to memory of 2348 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 103 PID 4276 wrote to memory of 5888 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 105 PID 4276 wrote to memory of 4948 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 106 PID 4276 wrote to memory of 5100 4276 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 107 PID 3804 wrote to memory of 856 3804 SearchIndexer.exe 108 PID 3804 wrote to memory of 4628 3804 SearchIndexer.exe 109 PID 3804 wrote to memory of 3068 3804 SearchIndexer.exe 110 PID 3804 wrote to memory of 5532 3804 SearchIndexer.exe 111 PID 3804 wrote to memory of 5540 3804 SearchIndexer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\tools\NativeUpdater.exetools\NativeUpdater.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe.tmp --nativeLauncherVersion 659 --nativeLauncherVersion 6592⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe --nativeLauncherVersion 659 --nativeLauncherVersion 6593⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" --type=gpu-process --field-trial-handle=2312,12421432418180896186,5643559191699296898,131072 --enable-features=CastMediaRouteProvider --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --log-severity=info --lang=en-US --launcherui --workdir="C:\Users\Admin\AppData\Roaming\.minecraft" --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --mojo-platform-channel-handle=2320 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2312,12421432418180896186,5643559191699296898,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --log-severity=info --lang=en-US --launcherui --workdir="C:\Users\Admin\AppData\Roaming\.minecraft" --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --mojo-platform-channel-handle=2688 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5888
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --field-trial-handle=2312,12421432418180896186,5643559191699296898,131072 --enable-features=CastMediaRouteProvider --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --log-severity=info --launcherui --workdir="C:\Users\Admin\AppData\Roaming\.minecraft" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --field-trial-handle=2312,12421432418180896186,5643559191699296898,131072 --enable-features=CastMediaRouteProvider --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt" --log-severity=info --launcherui --workdir="C:\Users\Admin\AppData\Roaming\.minecraft" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4620
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2820
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4856
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4088
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5136
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2840
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2976
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2848 2844 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:856
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2888 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4628
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3068
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2848 2844 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5532
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 948 2888 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5540
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{45BA127D-10A8-46EA-8AB7-56EA9078943C}1⤵
- System Location Discovery: System Language Discovery
PID:5764
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 3a9e20f7e67012dd6114772ea56c6eab6bfc093547574cf4c4d62bf8442fa8e6
- MD5 3fe53df6d619ae37dfb354a0f569ed50
- SHA1 1de8fcbf9a08b4f908d65e6150217bc9ef52c587
- SHA512 7bd4489c571640206962772de7a957e8b0978e5cc61f17648cd7b56fa5bef3b9516437841631ee6a0242224833e7808d0afb5c90c6f3d76a620e14feb035f493
- SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGxHfJvYrPs9HHC:J3q6sjBfgrExHC
- TLSH T147D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 3ec70fed06860cc083082a3e0cb53a07a97b16df95b03f6c70349b75f50bf932
- MD5 30acfbef3d8b525ce3fdbf433063eb01
- SHA1 6e81de7481dd97f92a9b35322e25016d52b2d4fa
- SHA512 c002ccc60b15fa2771148e3c980eddfe8d8e3e2983b5b88c8e23dd500f760372f8c3b388825e43bb27fe684a6bd56982b9636c750ac4e4a7815f05317cdc7570
- SSDEEP 24576:+XYfDtczALxHfJaMJWTTXPPC1X9qSH9Y6VyP:dtcwxHfJvYrPs9HHC
- TLSH T17675022877E509F9ED27827DCCA28111EA337C5547A0E78B03A499661F333D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 341d9a4891d17d2c851773cb62d668d1bf47d31a67a7264eef3ffbdc8cce1831
- MD5 0245bed622be48562272e9bd0d597007
- SHA1 f73ad4bf14460dbf326fa3bfcd7a72c497c235cf
- SHA512 c5e7b2cb51a843a031f985833285d50df3be69d11cc83ae7ba6e0155ff94f70aa4ca1e20439a87ce31113300d17caa3e9aea6857adc6a24b5066acd067f653b0
- SSDEEP 24576:Q0Le5ji0hmxxrMOxHfJaMJWTTXPPC1X9qSH9Y6VyP:QPji0AjpxHfJvYrPs9HHC
- TLSH T1A4859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4e0fd2ebf8faecdc36411d2664f18caeee0ab0fa0785770a855c1c1b1a205628
- MD5 9b6daa8f23605fa1f1f1c79bfb3b47e4
- SHA1 ff6580e7ce96ebb8c36650a6356c662db164aa60
- SHA512 ccf14e3756847866dff12e185bd2d42ea858ebcf3a6d9b8da8bd2b36069402db90b9acfc483acd62d7c4b075e5267d60ce8bb940fe6b88fa650de87f327858ed
- SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyuAxHfJaMJWTTXPPC1X9qSH9Y6VyP:J/ezSC6vUzPveHjy1xHfJvYrPs9HHC
- TLSH T1E5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 33299c6914ab7dd1793856f820e0159289bd77c0185dc9e48733418c2da48e69
- MD5 2399ed34bfd668ca5c77f11e44dd7c50
- SHA1 d47d8e6e898b68efdc9225203195239eaa6c4129
- SHA512 d900c89c3624226713207ec925f0697608a80cc39fab4e74858c1cf61100aaacf7a418cc0d392bd968012912966c5a033c3cc85a993ef18df9aecdf17500ef5f
- SSDEEP 24576:iVbqPb88hv/l+YvxHfJaMJWTTXPPC1X9qSH9Y6VyP:iVO88hXl+YxHfJvYrPs9HHC
- TLSH T178559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 65fdb0345fbefc683088e4fe7c5e76f3d871eec5f7294cd15ac43c1408cb39f9
- MD5 f5b14255ae3549e83176d6875618333e
- SHA1 69ec7a7d7658975664e1df76b4d443f8d619083d
- SHA512 5d7de151b57dd3e737df5d03b9d6388318ae51c94de0644883721a90a300ff29117612ca2e12a60b3c7f9c9fb7753529eafa650198cf0e90feffdc913388c940
- SSDEEP 12288:mLCxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:mLCxHfJaMJWTTXPPC1X9qSH9Y6VyP
- TLSH T1E3552356DEEE9375EF22037605D762580852BD6DAFD7990A1003BCCF253ABA5D00E8B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 bcf2a0ee8420835305a4f0610798c2df018891f8d86ad04d4f607a88294ac523
- MD5 10788890d6302ffd17f8099ed155807e
- SHA1 7543dc2d0b1953456353e2830c14245d672b1c17
- SHA512 9dc068fd2d3488274dd74e8ce5c685e615caaddd9b6009b7484e12dc5e1f5a8fdcc892bc0573b9f08bf6f691d3dbdd6716082b8a8fe38f9967b342b12e7f507a
- SSDEEP 12288:HeBNUbTVO86U3xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:HJIU3xHfJaMJWTTXPPC1X9qSH9Y6VyP
- TLSH T1D575C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 2807284d7268729b754204486f91cca9417e5d2387a7844403b7b7fac82097a5
- MD5 730c56243bdd049b7f722981318b5468
- SHA1 db129ffc70d9d5c42ca26611727d3083f09449fe
- SHA512 85da06fb39c14dfd4d18ee45c8474a3fc326d1faab733cdf7f12ba19f6e149283a16d70782aa25674248e2aa43197efba9e2264fc0159065e95e538e9c08ba88
- SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THU:tQvGAdlCEL8c/DRNw5CQgrExHC
- TLSH T1DD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 88a3dfa965ee261bc8693d263b9518e7730f2dc38cc498e6a8098c7d5bb37773
- MD5 023d0f59be44533b43dd1b8862307c1b
- SHA1 07f268f7180769fcdf8b8c3339f142dd670a2a84
- SHA512 a98a85b52d4156338e3902426323fe539d7ee35240bc903d3584d624d1bcabf255cabe95f1b73d284c039e665072065eb5d12637ee041e2872ddbcf8a1ff5781
- SSDEEP 24576:R0ewsAj5xHfJaMJWTTXPPC1X9qSH9Y6VyP:qlj5xHfJvYrPs9HHC
- TLSH T12675E031FE75E036C77B0DB61B26C716146DB9204F9219C3E3A89D8E59342D2237AE27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 11dd3ce1eecb6347cd582f284e854b03f3c177ca79b0eba58f85717c4c4f7971
- MD5 1cf7fc6149c93abcec392932a012506f
- SHA1 17263f17f4c727da72e6ff827c34785d72050af5
- SHA512 f44433cbf1ec4674b554d11c34050be124fdd4bb2452f6bfc6e45b27b3f466a3d838244839d9f43941f1a966c8f236616bc97cae04b38ac9fcbe6b8790ad396b
- SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zZxHfJvYrPs9HHC:foq2VjnmsgrExHC
- TLSH T1F7D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 9633941ea22c95d978db7f92319b985337e0d2d1ca2da43643bdc7370fe5d95e
- MD5 ea5e1d4709c7c704c6374250ffa7dd20
- SHA1 ae0740a12a3bfc4b115b40a47cbccb0464688f6a
- SHA512 5f365409d322ca30d7367c42a903cd72623b0781e647f2cb7fa2da05a201700f02f0387420d1a2805456d96f032dfa05c323881c42c0bd3bc2ab30b670583f59
- SSDEEP 24576:rwu4OWVxHfJaMJWTTXPPC1X9qSH9Y6VyP:rwvOIxHfJvYrPs9HHC
- TLSH T11665F14676E90CF9E96342398597C135E7F2BC062A62DB1F1360C64B6F37361AD1EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fd20cc9006f57c5f9e4227f6f6a0afcffde5a17149e0dc38cd3add141c5454d6
- MD5 a7b0e494333891d05522939194024af9
- SHA1 f85b281a778c87f665ef716bd497190399080572
- SHA512 bd1329d629f5b572bdc998583b667614f2e33cf891f2086ccb8e114769b25acbd4819b58ef3eb4fa2457338c7d9eac1f1dd703d3eaab56c14cf234f9054864c5
- SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl7xHfJvYrPs9HHC:mu6Jmdxd2d7grExHC
- TLSH T11DD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 388666c50c201712c09d62ee46b10fa8ae08fff6ed700675d9f1003b2d4cb8d5
- MD5 405c1fb35444a136f3bd4f7742a5f471
- SHA1 fb5c8faf6e3bb0e691dda3b0ecb353bfc307f572
- SHA512 a0d02e59a064b25a483c208da7f0a070f39becda36459210b7615ab5e510b40a44d64c7eb00a9808c320a4b7b62d2bd6e637d3262eff333bb78edd781574c555
- SSDEEP 24576:QfwvUk9RX6wkyAIixHfJaMJWTTXPPC1X9qSH9Y6VyP:kMnYIixHfJvYrPs9HHC
- TLSH T1A985D029EBDC44E5E177823C89B3460AF6B178691B31C2CF125A53AE0E37ED45D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 141a69149de6a7cc5bbddafdeaada724557ea1e7c70727dc93397dd6cb6aee4b
- MD5 42b50f00cf783d9251d0cac909b1d919
- SHA1 026cd3bdec52b97a6291ff5dc1e74c36f8b263e9
- SHA512 98dce5b041f8990bff6d70418c059b9b1f7aa90842502cf5c3364c2d3526185141b3ebda718674e4ef04efdd0880c75c9c748421a6f45f5a89e2f4d334d79c39
- SSDEEP 49152:XYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rxHfJvYrPs9Hi:SySzPTgrExHC
- TLSH T145067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 9f6d5dbccb1a4a4a7e48683698832abcf9246f54c33a4e9bb431e29b46aee8fb
- MD5 fff74b46856b6ff8d9b9782f9a14006c
- SHA1 40b187001f87bd9de2c110aee9cb30d0aeac80ce
- SHA512 b51022e493636c39e4810306eae92ae45631c10440fcd51583a5d73d6ffeb8f1157a37dbdd0334fcf7f99ab8fcebe9c460faddad6b0be2b8cf280efd7e2431dc
- SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdxHfJaMJWTTXPPC1X9qSH9Y6VyP:Q47JUQjTirIhCnDHUPfF/7xHfJvYrPsI
- TLSH T11865AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1000KB
- SHA256 b27e07985ec2b3cfe63e53087d28cf306b07997f2a3a44ff98d59c54c4677b68
- MD5 ab159b59f0a82c5a00cbf6204e056451
- SHA1 e806197a1eedc9a42f59bc3f87e57dd9289e6988
- SHA512 885a4b24fd3f140d94a75174366b9eb5b0c36761aba6d6ffcd31465f3b38425c5533284fcd1d04c298eda2860dc994af027f85e33c2712562c612c34ff1df932
- SSDEEP 12288:Iew0TU3ffnathlJLjKCgP/+jfE1y/ZCRMkFnVCbqr:HweUPGgUEYxCRMkVVCbqr
- TLSH T197251810762AC74FC6A980365E36D2CCA7707D01EE046F0773C8873F9576A58BAF6692
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 98bafdad1c742afc698a60a941aac18355ba6eff8d4f56cac2bd4efefa27ca18
- MD5 9365553e49ae5015edec3fa6d131a688
- SHA1 edcc8d28b39382cbab1d1cacc8ef1259319efe35
- SHA512 a9bb4641337394a4f97dc424d3849ae886ed9d3078d8d26a32056e9f44bb7d815e1860162b6c0fcbb2a821c06ed2721377cb3f3b5a0ae19bb1b8da096a50f192
- SSDEEP 12288:nhCICSGofjFzhRcfpWflyA2/GOvGWcBNsYWDNbu:nInStfBIWTBNx
- TLSH T15365E840A436E38FD1BB2172071A5B8CB7A4EC0776056F26B3C9453AD86AB15A0FD3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe.tmp
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe.tmp
- Size 3.2MB
- SHA256 60c59edec70f5cd7d1cf880e7a1475de6f73932dc23ae913f9c7dfeaf52489e1
- MD5 e8c86a94df2f0a4c5edfa59cfc420329
- SHA1 4212cb446a2dce87225ca20ba45e10befb084062
- SHA512 273298886ff9466a28caae48e59d701fc1519ba39196ff5abac8c52b0d00e21be00e852ff453ed659fcf2c7cc980c138bf162a4dc8453d84fc542df451880e2e
- SSDEEP 49152:6K15MHftob8+qaKSQ61eka2F5vYbCxTIQiqF3x4T6pf8C/wYE7XejTpNDTCbdczg:6KDItob8+Z86VSEiqF3iTJYEaUd1
- TLSH T15AE57D2278018971D56532F0842DB6B5C9649D2607221EE372BC3B5E6F750C3EE3B6BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\cef.pak
- Size 1.9MB
- SHA256 455dd904ba68305f45682ae9c776a87cb2cb67bbe2d20e13cf97a812b68cf5f4
- MD5 fa6c54291dcc13acc9dbec30923fe503
- SHA1 8f157cc1ab1c18bf47305543b149604797cd6587
- SHA512 135773297e6481f66d53a6a6bb887e0e0ba17ded9f76e2cef2db48a095a4c301eda84feb46f2a44425f4d34accd72765ee324d30a0692aa0c6d2c513166d51de
- SSDEEP 49152:XjObD2VVfSm1e3VEgCGmthiYqCXici0Jot0jqg//bkYaZwHT:aby7qwe2NGmthi53dYM0jtzkY1
- TLSH T12E952301E9A56C2BD7EBE274F4A891228931C48316A1BC2CF1CF450DD7AD96B16F437E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\cef_100_percent.pak
- Size 261KB
- SHA256 6267cb52b0ca5593cf402139e736eb4f1d6bc3f2eab4c6deb99934711050ef4f
- MD5 4cec40309dc9e4bf0f0cc915aeb6c9ac
- SHA1 2da1b18943265f473f6b87b63132dbb2398ff487
- SHA512 e684d4d735762e87c8556c164379f97f59b8b4077e2f4c49ae43610ca2a3994ad45839cf6edef4e741a4f1fb345413e4246fb5901dd52bd98c9a2f60866817c7
- SSDEEP 6144:mIYS+eUgHY8qzwV5TrOHCZ3x5c1YC7x10fSucY7OP2ITQ:mIZzNgf1d/dQ
- TLSH T1FE44F1E3B3B5BC3ED65B0A33B1510B73D97B413506A30349C28685B66D56B84EACD38B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\cef_200_percent.pak
- Size 412KB
- SHA256 c8f7697bdb4aa19722b975dd2126baf8c2edb5c0a58e2d64a6fefa4cbb8335ec
- MD5 50a6d9ab74ebfaeda5baa28997149977
- SHA1 1ad557cecf3d54a5fbe471ceab189d344fef347c
- SHA512 31647191b432f82ff24a41a16abb77512bed2f3105791079d795304452e2bff89f618202023fd133cdc79f80d02647093edebca9e43c19cbd4d2bed4c8d35180
- SSDEEP 6144:cYS+eUgHY8TDQYak+9bQHgs4jTlyOHCZLz73QYV85u/oFYvwoytKi6obByPGlPFo:cZ6fz4gs4jTEg5u/oFFpxLlFYZ
- TLSH T1759402E6F3B8AC39D9530A3361120A73DD7714350AB7434AC29A9D393D95B9889CD38F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\cef_extensions.pak
- Size 1.2MB
- SHA256 8e8882c3d420231e1ddd1329e259cd8dc38fe392727aa74cfa4df57125d4cfb3
- MD5 c294094045246da46492204f2920d74f
- SHA1 229367ac0be0a2da9d6338cba6f45c07f790140c
- SHA512 03543e3c436a8b42b3f5bb942de468b4898172720ddef5597535b81347581ae0c89bf91e6bef3b91c796ca5bd393a865b2fa53ba70b2fda6578c640b14ab92cd
- SSDEEP 24576:AwoOhcK5rb9RLjsDfG13xdT0b+n8F2gRB12k+gGFauCBv3GkH/orJm22O+EcRc7D:AK9xRXsDG1hdAKn8VBAkDGYuCBbHgryE
- TLSH T134552331F668643FE0E1D7B1C97540362A2C884715E5A82DB2DF925EDF8A21443F19BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\chrome_elf.dll
- Size 810KB
- SHA256 8753acc450280e1c5ef5a09dac46d1fd873f1e66d771affc4b4afbfa3d59e3c4
- MD5 4c8f4689e087a9843a79d6ec923f00df
- SHA1 e6e37e19a04a55944bdfba6f9359bbe0ea8402fc
- SHA512 30b205bb4b391b23a7bb15248daa42af3ec34225d169a0d70325ea7e1422d298ea3376962e689311074346dd7aec3579789748e3aaa17b04ab72de6c0a0fc5e0
- SSDEEP 24576:P+T2JHW0pXGqKrTEZocI3K064Va5zdGoD0j:Ea20BKrTEZQV4zd9D0j
- TLSH T1F405AF01B581D035D5521530912CE73DAB3EE6124F248FDBD3988CAA9FB05D1AB3A7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\icudtl.dat
- Size 10.0MB
- SHA256 27993e2079711d5f0f04a72f48fee88b269604c8e3fbdf50a7f7bb3f5bfc8d8e
- MD5 9732e28c054db1e042cd306a7bc9227a
- SHA1 6bab2e77925515888808c1ef729c5bb1323100dd
- SHA512 3eb67ab896a56dab4a2d6eea98f251affd6864c5f5b24f22b61b6acc1df4460d86f0a448f1983aac019e79ff930286c3510891be9d48ef07a93ff975a0e55335
- SSDEEP 196608:Ub+wSv9AAQbNjliXUxR0rHf93WhlA6tj1w:U5KlQbBliXUxR0rHf93WhlA6tj+
- TLSH T1D7B63846B2BB0DC1FAFBAE70D8F463679127BD05AE71814906042F3B5C772E087617A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\locales\en-US.pak
- Size 225KB
- SHA256 8fe734f556d97e7c07d02e839a16565f7db88ca7091ca3903a9b153a68aaaf72
- MD5 16a6914c9637812257e28b2cc4e6d809
- SHA1 82212a642c90b51b8f67e517ee8782da841b658f
- SHA512 6efbab68c8b036fd73951295a5f65718003deea46db838f6f263133452e09be45ce006246850facbb1922766f42c2ce1796722cecfcc8495921a7bcd9402a446
- SSDEEP 6144:Yn5hBCDNRj6AcM89eWwzuWfaYM035cxsUwL:Uh87GnMXzuHc5caUwL
- TLSH T17A346D0FF784223A069352627F0962B2FB21905DB36126567CACC12C3377B69D3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\swiftshader\libegl.dll
- Size 334KB
- SHA256 ba6c8b38def6141447032c9a2b46b67a515276c88b30580703db24cf18d3f0d6
- MD5 9f68bdd2b3a78eeddaceb6f6c5cae5de
- SHA1 1231c5b199ba2bc48cbafdbef813cdbd5dc3c42d
- SHA512 4804c84b4183f9096d4f83cfc73df673467b45f4bd2613fbccc46739a2e8c2a887b36ca7d6785ab64ca17cb74f6c1fea74ca5587e24d2009030dc0604ce51443
- SSDEEP 6144:oJMf96qmnOWDS4f9jwFdQC7fJijYiNXKCeKlsdTgFsl3Uji/ubjwW6t:oJMf96RZDxf9vYoKCeKlKd/ubjKt
- TLSH T119749E00B940C036C16E00307518E7795E7EBE615F61DACFD7988AB99FB06D09A397AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\swiftshader\libglesv2.dll
- Size 2.3MB
- SHA256 8b73aa808f2373c3ada15349e676f20a9dc644a8a7c21d5699288bee907fee14
- MD5 cdfe6b31acf7e3f398725bc57158a00b
- SHA1 cbf51552d14ae32f4651d1770ece1dc9ba3e1d8e
- SHA512 1ec2a3139bc5e38a3a15ef33d73791dce721fb864626a8767f834e11ff1a74ea70eb7aeb8107fe80b2bb7309df3cb620df7453d26524a0503929219b751249c8
- SSDEEP 49152:HNzWyvuzm9s2IcjQ/sI3pfyUUZdWsT/poVvAz1mupuYBFJ+HrDzCmSxu9lVLTBaM:tCOuzXZ9lVLTBatvQ+qFKW0evP8R6aL
- TLSH T1FEB57D059520E03AE40601F5271CFB38AE3496705567874FEB8898DCEBF49F1B67B68B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\game\v8_context_snapshot.bin
- Size 167KB
- SHA256 ca88a3c7034da1de52d35823fba0fe80ba5376ab70cdc1841e6aaf25c1f5dd6e
- MD5 cdeec3342ce88d4de5426032a6bf6a53
- SHA1 b36ec3c3b20a7a06ff282d696f12b51904b073a4
- SHA512 54874cd76589124b750fdae90be75e1acf374566d56352c15dbbee98c095aad0e56db142952a808b08e4817bf5f8e176ffdc4ff79110d8661ee4f7ede16b2ea9
- SSDEEP 3072:BQaeMAVsTdWDrchybFmSVqMgZTiiFgDOCQzoFxhxOgiFz0:veHVskDIhSmIXKFgDDQz0O9FY
- TLSH T178F312778770D629D06611BDAA6D98F3B0AB99BD4603127FF73EC63720311C36A58067
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tools\NativeUpdater.exe
- Size 497KB
- SHA256 aded922740ff305d08c9351753dee10b354a322f18289f77f5f7b71eb1326000
- MD5 32ebe0f563f50819a18c0f90869ddecb
- SHA1 f2087cf7eb6424697b9db14ce6c45dd8e84e5d63
- SHA512 8b098e438f4b672cf15c23f0add00e55f3487181c2aae47c6be9017f616a81d0a65cf96f748d1719246b2e29507bb40fa25700c234101a9f4d785afb1cb92261
- SSDEEP 12288:szj8GJVeN1h9Q0fT33oyo4Yiob591snXt3dbA44Jc:sRJch9Rb3E4YVs93dbh4W
- TLSH T1FEB49D2175B1C072D5A382728D78EB6B15ADFD610B2646EFB3D80A6D6F701C13B32663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_cef_log.txt
- Size 173B
- SHA256 49db11c98a47f7c5ccd86b07fcd72462ff43a92e2ce98a054186e0053100b591
- MD5 b9ee452d20b7ca2779688141eb81c0b3
- SHA1 b4aae7b65efb36c6201724500d5d94c75aeb7400
- SHA512 9177b438f9373cfcb5af3800ed5becc2d7cae2f8741822b28e277ed09459625d3c3285cd95f60c9841c453dc6e1dbe3aca53217983def01128df40f720832752
- TLSH T1A1C0124307254C9E65DDC8F67729D445239400413596413F7AA204CE76D44B697D4975
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_log.txt
- Size 2KB
- SHA256 2da809016a02e2f734326fe9f7908f736c789e31193af2fec64ab2b55440f9ac
- MD5 9edd2b0c6d980556a0fbe007bdc9f4bc
- SHA1 3a3eb879e2e9969e5bd4b7ce49cc4c04db1e8a59
- SHA512 2958e1cec658ec2ae1f4a6084a35e49653dbaf836e3fda4a700e54ff8d68608a7ffc779a3cf883524a5219ef6bf34fc642f92020bc6ca32ad449ea92739dde64
- TLSH T1C1418A4E2F7004A9167A4FC1E4FE37A085EDFA4B966040A76AFB00481334A277FDE574
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_settings.json
- Size 128B
- SHA256 7afa6b9dacfb8d546c8f9c386601999232fa9aa6bcc9879503ab2433e053c3c5
- MD5 270ade77b4358d215f30e625a2b172f6
- SHA1 c407dcca0525ba0bb9d9c5d63ac78f7aa03ae03a
- SHA512 af56d5ec7d603284db4fe340f5f5fc00c48b0e3d065660cb3d40088e6c4c35675cb7eaa6504803a11120d49e40d7aeb0f5321aacef79e5b074369722056bcd62
- TLSH T179B092E2D82C043850B07A8B408F0044AA935F4BAB724C0F76BB9B0085AFE2D84C1B28
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\.minecraft\webcache2\Network Persistent State
- Size 194B
- SHA256 727ff17c7670d111b8d91ed761537f848cfb6fc76d34b2b4d3a7ca3ef2a1eff2
- MD5 e9e8b480b2e5c91fa3572f0a6d4949f7
- SHA1 36f6e62bfd0e5c3a2a5a11a183f98fd53731c57f
- SHA512 19957f4b3807b2fb0f17eb37fa1ebe0aa6fd871911cf80118f52b05d1f8d653f037812888b7504253706fb26f2162520e08158c2023ccfbb07b083901adcc704
- TLSH T189C0226A452028FF0382C3A00528BEA7C2FE0006021898BBD624372C82B96AE080488B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\.minecraft\webcache2\Network Persistent State~RFe5b1421.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 fd7e4e54053eead7f4e270434de28addee9d9bdf77e429a5b264d5ee5c11af22
- MD5 d78e1a7f555de4fbfcc6ae8ebd144f8f
- SHA1 94f89b8bf38f284645b917642586d543bc5fe189
- SHA512 1e1238f28ff00aae6fb0b9d1b9243c4af0bb66e3651be359902c65357fbf5ba1943266a33603b55085140c3164bfa129bda8c189c6582bc89c87772a72813949
- SSDEEP 12288:8F7uxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:QuxHfJaMJWTTXPPC1X9qSH9Y6VyP
- TLSH T108552312DEEE8725FD3103B5049B9224141ABE6DAFC395CB3002B58B3636BD49D1E9B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 4eba78ce058c5113e4daed821c65dfd7cb59feda7ed2f6f0ddf75ed28470eb92
- MD5 0f02d4bd1cf2c753b3e720ff5f132878
- SHA1 613c9b89ff2761fc6cd7c8f1eee0d9870fd711e9
- SHA512 a5d7bc50aa9ceddc4dc6331fe19c5dfced114cb88c8e421ddc97246235efe906bb803a7ec5e9669b984b452fbfed638e491a55bda7eefd76ed724cac326ea424
- SSDEEP 24576:gG88u8FpJqH1bzria7/mNxHfJaMJWTTXPPC1X9qSH9Y6VyP:z7ZFPqVea7/YxHfJvYrPs9HHC
- TLSH T1EA85F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 f7522cc30a802c4119a2958235c7e322f1d305f12c8365c339e64cd69ff95bb6
- MD5 83a1425f12eefd829443ffa6f4d43813
- SHA1 5d4b7f1c1e96373e1894ad8312b590c3e263c480
- SHA512 6e91ae884fb97e0467913a971d43de69cbdb7dabdab019ae19da75118b233aedb06c83c248da2a32187a7aa02c9d8954bf0cc8f6c1c6f25283d5471c34f2e812
- SSDEEP 24576:TPUr+NQRxHfJaMJWTTXPPC1X9qSH9Y6VyP:TJQRxHfJvYrPs9HHC
- TLSH T1F665F12F66ED18E5E636917D85828309E771B866171292CF0291817F1F37EE8BC3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 f098b60f48ca6c2363fa12b2f36b71bc1e644f160faa5bc24527972835750219
- MD5 fdfb33a887d2bb7d3e45d16f57031cec
- SHA1 f80fd4625635fab1fc73b1845a83a2cb09a020e0
- SHA512 ff4b3704d178593dc71d1bee7c970f05931dbc385a4a7fea847be1723b3dd39ce78719cf7d41318bc0028f06af8a8d50f2b5a92338a96a9bc96a0fa27c52d1b1
- SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBxHfJvYrPs9HHC:NG05lO43b6grExHC
- TLSH T122D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 7ddb52a56a03ecad7b7636a8429fd5bef06fc2d47f216d3e9c73b5eca23db28d
- MD5 ce0a112e2922cef68908f3f253881f32
- SHA1 6d5353f7809fed929df1bc3f658bda4010df5d7d
- SHA512 7a3d3288aa7fcce389b8ab5c0ace19427ab5d6a74697edb64cc8d62b673b641af8b2bd6b2df0a31c5ba7140b46195df67840ce0ea12651e38478e0719ccb4391
- SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnrxHfJaMJWTTXPPC1X9qSH9Y6VyP:ua5POZ3BJt2pasx2+mpxHfJvYrPs9HHC
- TLSH T14165BF5EA6FC01D5D579D17DC583861AE5B1342253329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 b23ed93af8c0edb3c8a33520e88b4732dad7bc6f01bb701e9268fd7b251b571b
- MD5 eee283a1cf3ee27caa8bc4360c8f53c7
- SHA1 bb7082d1d54fd7b3b602ffa0ee0a6ffa95aca1c6
- SHA512 81d58236efbe7d3985527712490eab3a6071db516cda1e30bb31dd239da5a3f81a8f356da3d23374435cc142649411f53535b635e3d35ec1ea1ee51844b04a49
- SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fk1xHfJaMJWTTXPPC1X9qSH9Y6VyP:eNc/zEOVHF4xHfJvYrPs9HHC
- TLSH T1BC858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 1.4MB
- SHA256 0a91e98634ddb90f4c2c536377c77ad25b54008c471be61d6684df499a68a174
- MD5 f14a6f13b707b46fb8eecc7f34c21652
- SHA1 758d4cf378afa92d94d070076341f32d050e7d5d
- SHA512 505ee220ed41d9417cbc6c8963ad65f84d85e6c45fcef463710d90aba24023e566475244ee2c8bbda6849042b103c7dfc3d98f67dc308722624b20a4355d7de0
- SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYAxHfJaMJWTTXPPC1X9qSH9Y6VyP:agb4mBIBhGFdxHfJvYrPs9HHC
- TLSH T1D465AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8139d80870e3c94fed7e2c12ea7a6990d784e034867659706c9c6257d05489b8
- MD5 63d88d6d6efbbc26866c621700a06413
- SHA1 a6500eaecb91d378541791139824c10c027a1d99
- SHA512 72560977384a3d6f8a81dd2a201f3d60472088adada0da8fccad003447d7bc0cde917de229c39d51a80775b317d44bea5f3db9b4efb0cb1d441d6c96dbc3a6db
- SSDEEP 24576:ITkNvNnaFeYhJNtmZBmHxHfJaMJWTTXPPC1X9qSH9Y6VyP:ITMwBtOmHxHfJvYrPs9HHC
- TLSH T1B655AF2EBAF846E4D1FAC6B5CD238512E6727461173293CB5290C13F1E279D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 7ae0f4c0fb32c1c83cbc3a959ed398d3e9aa31823cf9d55f4c53bf10407210af
- MD5 39e1944d2c4d2a09a42af7d6487ae10d
- SHA1 927e4910b895a234fd9f55c8653dabea2d0b709a
- SHA512 7813b559b3ba34058ffbc1c599128f6417a0612743bce312d4cbff1ad6fe471bac7ad40b85c29320dbb8d11f30e34ee7f07570366f74e0c9cb2dbfff50b4ce0c
- SSDEEP 24576:ED3FHshBIYQgAKxHfJaMJWTTXPPC1X9qSH9Y6VyP:EDVHeBIAAKxHfJvYrPs9HHC
- TLSH T19575E13DEA9D04E4E57BC2BC8A638606E67138AD032255CB1190D1BA1F7BEE46D3DF50
- MD5 SHA1 SHA512 SSDEEP TLSH