3d0850cefa8a4c03aa75adfd9d9c2252405a13e90d56acb95d1ef9659d3bad71

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Size 4.2MB
Sample260711-gseq2sez2y
SHA256 3d0850cefa8a4c03aa75adfd9d9c2252405a13e90d56acb95d1ef9659d3bad71
MD5 44e9612796910b1f91e47a55579e8939
SHA1 1168d84b6cd41a57b9359c87ee5d4aa2b78daa6c
SHA512 f318ecad054950f781398bb13c68908d5640877406d4c2c7afdc3b9939ca1f44155ab2e0431849b6b17df732a484902d18a6384e81705d161b842b1a73f8c38d
SSDEEP 98304:UBeT+vnGgSDM4iiuSweb/jiVZiVHTvhrqFgrExHC:UByIGglSnbdrqFgQH
TLSH
T14E26DF12BA828076F5930272547EAB7E48BDFA30073981D7E7E81A5E5D306D2373A747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5000	elevation_service.exe
4156	elevation_service.exe
3968	maintenanceservice.exe
896	OSE.EXE
2108	PerceptionSimulationService.exe
3328	perfhost.exe
2444	ReFsDedupSvc.exe
300	SensorDataService.exe
3036	ssh-agent.exe
3700	AgentService.exe
3284	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f96567c9e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096386714fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038a04714fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6975358fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c41f59fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f2a6a58fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000795b3b15fb10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe
5000	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeAssignPrimaryTokenPrivilege	3700	AgentService.exe
Token: SeBackupPrivilege	2444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2444	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2444	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2444	ReFsDedupSvc.exe
Token: 33	3284	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeDebugPrivilege	3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	3744	2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
Token: SeDebugPrivilege	5000	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4248	3284	SearchIndexer.exe	98
PID 3284 wrote to memory of 2804	3284	SearchIndexer.exe	99
PID 3284 wrote to memory of 5772	3284	SearchIndexer.exe	100
PID 3284 wrote to memory of 6100	3284	SearchIndexer.exe	101
PID 3284 wrote to memory of 4420	3284	SearchIndexer.exe	107
PID 3284 wrote to memory of 6060	3284	SearchIndexer.exe	108
PID 3284 wrote to memory of 4592	3284	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_44e9612796910b1f91e47a55579e8939_darkgate_elex_glassworm_hijackloader_luca-stealer_medusa.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e7547a5c583ed0946f6cf4bfd8dc5d2af2e98c9993bb76c27c6e7cce412313b7
MD5 878b1132fe25d1d1dcd89f90351ee570
SHA1 94ac401d43aca66483df6e86468fc05ee75e88c7
SHA512 953ff396af5d50ac4a5029ac845734a14b3095e5497c0a97751ec0ab80c215d4a050d9b51876bb09952027674c128b95be708c17aae177314432cc2ffd9c5d2a
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnKxHfJvYrPs9HHC:23q6sjB7grExHC
TLSH
T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f0a80a2153a19092235e80c18c018d05786459b6fd82f9c12a37e71b710304f1
MD5 2a274cc0e5c79b478a52d358a68ee8de
SHA1 9bf6f62abfef465f6f59027997ecafc5c0070a64
SHA512 2c666c5b4ca8c1b57e2be461f68a0ec506eb480ef47ccbec3c6f5c7806ac2a0775f28da9a8105c23ae35309507d96f72a20aa2d692f914e892030f4b7b3b42c4
SSDEEP 24576:xXYfDtczA/xHfJaMJWTTXPPC1X9qSH9Y6VyP:UtcwxHfJvYrPs9HHC
TLSH
T175750228B7E509F9ED27827DCCA28111DA337C5547A0E78B03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fa387f4edf0ada36342fb2b105902e1095e1da185cb0ce05fcbabb4ae1d62777
MD5 aead48be549cf4364f00c51e1f9aa8e6
SHA1 eea70be33403c140a2b7b638fab5cb485512111a
SHA512 bf9b2eee07a42ccb5a7cfcf9225d412807b2d0c664ad57f03e45d31ebf8ccd823b3bbb297c7cae7c11958f8ca153e5b72ca426e50c11d032915aca38ab0e4090
SSDEEP 24576:00Le5ji0hmxxrMCxHfJaMJWTTXPPC1X9qSH9Y6VyP:0Pji0AjZxHfJvYrPs9HHC
TLSH
T1F4859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bcbbf70ffd7a2dd6bed2bdf6671be23b3d5df9b179ac8b3e82ddd704614ef0a2
MD5 7d5a77619ac0bb410bb07c835713dc93
SHA1 f0ecfa3bb0d3d26e5341548899dbb2e9bb44f98d
SHA512 f9a48477677ff8b28c37c5dcb3b2a7f4599546953e41101df1198c6cb7fc8f39ee6fd4bd1d338b4e6fde42a8855c879cd8ecb7c7443fb58672579bd96765be3c
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyuAxHfJaMJWTTXPPC1X9qSH9Y6VyP:P/ezSC6vUzPveHjy9xHfJvYrPs9HHC
TLSH
T102755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 695c1adc6a8b775cb38e0909df7897d02cd7f588aa710f71edca90066cf4357e
MD5 ea0eecdc5b27c0965f143c9e88a0cca7
SHA1 db1a68df6dccd762a5916aff38ddb27da75a0bbb
SHA512 85e923fdd2713c6a091cd325fd8999f5ebb710522f889bd869ff387d9b370b1de339099cb0d70204a4cd7b61d9fec4f03fc694aa1738c514c15e846d15188cd3
SSDEEP 24576:TVbqPb88hv/l+YLxHfJaMJWTTXPPC1X9qSH9Y6VyP:TVO88hXl+IxHfJvYrPs9HHC
TLSH
T145559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7a981bf595996d6661e5287e9bdd3848d72d6198c84ea627840a79332ec7a39c
MD5 534b2e332dddbc8fd706d0283e31e511
SHA1 39c61a62c7c3b06ab003f5b0d6c6e53243af07e7
SHA512 c18721ad7d5e2d20c3ea86f7fe6007faa21127d3607cc949be9e08d5ea4804706170e322f1c049be910c38361ed48fcf551916a263fe21d42dae85f6c7a51040
SSDEEP 12288:9L+xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:9L+xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1AA552356DEEE8375EF22037605D762580852BD6DEBD7990A1003B8CF253ABA5D00F8B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ef734b5bb64c23ad91f755bee71c00feda4194154f09e764a0f0830032757a48
MD5 b84c52dc874c6f6529545696ea27ac19
SHA1 89614279f76cfc49f720008bd81f56eb009d7448
SHA512 71564eab7b32538827bb9c2c70934a0a6f096d4a7dadf7fc2000dadaf02af81d5575b8cac1ef1760088274aeeec4f31f37f16b4661d16cbd0981f564fd101de5
SSDEEP 12288:GeBNUbTVO86UjxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:GJIUjxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1F475C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dfc5a6d03d4839579cb98294806ab89f735a0725c5d10f12aef7612ee7809342
MD5 318d11c2fc773964611ba4d4bce6555e
SHA1 83d55ad164383e91cd709bc3063249c6604851af
SHA512 40226d2a1f1bd27f27891316d4d636fa4416e01bb66ea5109dd6f079061fbe5fbdc476873600245c06bc315979e7880a6e8ac39607ffaef79f6429431d2b30d7
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:sQvGAdlCEL8c/DRNw5CQgrExHC
TLSH
T10C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e89043391b279b5eba6b648be6b1378703d344d2368b8b5e41c21482e9a9860c
MD5 6da0663c6ab035d8e568cbb35116716d
SHA1 eb92f01412627cfec8dbf7144efb64c03231ce6a
SHA512 aa59d1c625a49d6ae4586b9c132503c83fd30455088c325abfc4d11414b59ea7309195292070899b4979d17fa575f0b58e6e8b4a88e694b0150d5e54350c2b21
SSDEEP 24576:f0ewsAjpxHfJaMJWTTXPPC1X9qSH9Y6VyP:8ljpxHfJvYrPs9HHC
TLSH
T1ED75E031FE75E036C77B0DB61B26C716146DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c738e0e6904752774f94d079d61c594b58632be4572648323fe5d3ae97bd72b1
MD5 d3c690fcdde594452d61c1b8f644784c
SHA1 cc6f45b9160b178ae53e9d9fca69d109e5fe159f
SHA512 789062615eae573b1a59dee4c6c99444c8deedc374d2a5702452a5fa6e8b355172222996cf2c4a4774729255a56d4f685f9b8163b82df68c79f733548d76a4c9
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHRgQH:JUEtQevvqc2W1cpV2tI32yy
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3ca3c126f6b3933ead094b3291d91a4b6c43312a371cd43a81c55b6c8d118878
MD5 1f6d14f4a69cf18b871f86203f618492
SHA1 f0610f61359ea1973faa1d4efa0fc73e171d9eef
SHA512 f42bc9ef82005b391a74794785fac1c5f17f7fc9ea1a3911e3d7069685503aee66adad165d85f5851b843afa061a01fbb8ad7dfedb1476404962b97dde995b3f
SSDEEP 49152:bCbRquA/m2yL5zLfFiV+XenmE3/zJxHfJvYrPs9HHC:Eoq2Vjnm0grExHC
TLSH
T1A0D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 414a0016ec7254bf632d06556ca10ab4fcabb5bdc35d1552efd3aa8fc8258a36
MD5 b5e9efea489a8a74cd5a8085202bad41
SHA1 3b65a3d8333da0a6908a8e23179d9930098c0ef6
SHA512 aeab2553e846fc398f90d6a926f50c0622f6586b50359cae308122199ce0ee18498aac6c326ba3bb8c607dff8e626b3ca3ea4753a392b325d40d5e292646cb6a
SSDEEP 24576:XAhGL3IFoiwtA5l7S53UxHfJaMJWTTXPPC1X9qSH9Y6VyP:XAMUFoiq5ExHfJvYrPs9HHC
TLSH
T1B535AE81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 446f1f55480027d40453bd6a73d5b79dfc40a69d3bab33142aef333d11954b3d
MD5 95d310b4bffef8d85f412e33674ae848
SHA1 ad54f9e81db728c1e5b53c307b71133a46ccc5e6
SHA512 0daba1f50806e365b3e022c71729f967126a3c982f22afe4f04c85d437b515b6a783b592c1e69814a80d32cfdd1865b5da1b12572764ccce530f2943d95c78c6
SSDEEP 24576:8wu4OWdxHfJaMJWTTXPPC1X9qSH9Y6VyP:8wvO4xHfJvYrPs9HHC
TLSH
T1E865F14676E90CF9E96342398597C135E7F2BC122A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 97e734f73ca1a7291138dd77461129952aff7da6a65a553f7082c478f093d5f4
MD5 0a30bab404d959a58f1f9508ac3ff637
SHA1 169695349519f15f17a6c32b0f3a927262e6da65
SHA512 a37440ee65e286ea48f6ecf17a66f47adb1ff8ce5cc3e5c8aa6cea55dcb6ebbdee98fc8077a2db8d3f0b7ad08b0e7ea1d52f28d01830e13ebe6f06f5211c63f5
SSDEEP 12288:beZ1Iy5xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:aZuaxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A455125A36E861F9E663427D88E252048772786667B343CF1111A68B2F33BD15D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b076d630578d5a044f6e3b679533436e5bb9b8d199b286817b9cf225df8f08d
MD5 9297cd15eef7ea3bb27ebdb52785adf7
SHA1 c90725ee71f0ed4283d8601e5d6c72d53087e455
SHA512 0ea7bfa68642148f6918912b2826a6d7cafd78f1811241a6ab0b5623cbda936223d1163c3439d58b353ddf8b5499596def9900f12fa8cae6b58f63f9986f0978
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:uQRQyi36YOcPbLvw2gAf+PN3XgrExHC
TLSH
T1CE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 19cf0b2b15092d1a8ea256ab3f578b579732ce2013d4a61954877db0d6ddddf1
MD5 291dddc51e45162e742846e24ef84540
SHA1 7d17082bf0c718644035cc641404fd389b15d270
SHA512 a0f6a3c78177319671b0aa61e2d88fa72876e1f2dfbbd96ea364bb2f7523d89125dd2f83bbbb89569ccec8f2553e59f6f391b691d7fd155cb05a79b541aa430c
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:QQRQyi36YOcPbLvw2gAf+PN3XgrExHC
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e65bf830dab6bd0bff24a4ed09761ffb0230daa190e415736faa69b806b5a4f3
MD5 26fe8650c4d972a4c6e59b851b86b86a
SHA1 c6fee35568312511151e32ca01a8806068e21de9
SHA512 9e61b0754a94fe9504c3456dff81325cee90a856cad1381d590948033093c580681f6cd9e4fb9ac199adf63ce2e723dffe099cf68461bb77075b60fa4c3a10a1
SSDEEP 49152:568Qg55nhceWu7PNU3/ZxHfJvYrPs9HHC:HthLRc/ZgrExHC
TLSH
T19CB54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0e591d64c3f79ea5c19354c70ed6b280d6c660cf2d00633c4bc8299ccf56586d
MD5 eecde39f8e7eca4c891011c4bf2fdc49
SHA1 af297ca6e7821938e3ce1574973ace2bb117f507
SHA512 a1a17f14cdc2214578b6a50a3e0e8a55c01616ae5bef2424f99ee6c59f71332ec9062fd55af46d60cc798367f859c45ea980c0d7f21de9002631ccd9faf804fe
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99O:py5112gYy5azzVvt69nLKnhZ+grExHC
TLSH
T1F1167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 602ca8caffc3147bd4766bfe71e1a28ddc121d430ff98fae7f2a2f7ec6ccc2cd
MD5 c8b113e0b05e1e419a622cf0674d60c8
SHA1 79242d82c2a0562b2dca3e21c2efb18ccddac767
SHA512 3593c34076b9013e1e14792bb85069176f6f180e5b37035fe8db366ec75098c8a3039587ee2f1fcc57138a4f48711a230213615733da09dd1bc21ab7e4f723f5
SSDEEP 49152:GB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvxHfJvYrPs9HHC:0u6Jmdxd2dvgrExHC
TLSH
T125D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2432fb4707a6379720a4d4c6119796c4e058993e30340f8e756e2d1df41de2e
MD5 49cfa7e76f4d3f4d1d62d86bef3fc105
SHA1 2110da9da93ac3aaab2a69175372bc56789c1243
SHA512 644a5691e3b2b2dc15bfc3ab7cab0fdadf873b48643881e61847fd5ea7028f5b7dcc2c1ab8095095797e7908d349a8a4daa0e7eafcc2f72bd244b6803aa553a2
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4xDxHfJvYrPs9HHC:EmifPWR0grExHC
TLSH
T131B5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51a52747d0c573c1804cc45c525b232e05ddafad85ba3f1fa6253d592f3d6021
MD5 49098a9ce3d4b50a45946bb1450d49c8
SHA1 09fbb2a493aac7d414c32756cea019b839191cc9
SHA512 ed263db18376bfeab6e1163f5fb1a0bb3432ce7106210fb1268391bc6ddd9c7adf8a6620906e3452bcf0148f45ac2c1e387a2938eb2c449a7bc919a796ed6795
SSDEEP 49152:ySuZQIY0Be2KcRVtOnks6NMHqaxHfJvYrPs9HHC:s5dKii61agrExHC
TLSH
T126C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b03b208d9a91993b02426b6752dd02f6cf3c171fac554619831909199fcac68
MD5 a047a9c136654d2fbd897ea418c8b0cd
SHA1 055340dfd0d2b0a7113c1ae0c08a24b80abc9d5d
SHA512 052d2bcafc3769f64382e66eccd83f297fb79eaaa99c4b5555a5fa2fe8b5ab6c419f7e298c9fd97199008bca5d3c1170418b419e8cc045e9549e3f0b59162939
SSDEEP 49152:EhtSn8EApI0fig3giDn0AP5w/xHfJvYrPs9HHC:FX2imphYgrExHC
TLSH
T18F95BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1f9595a26592167e6cfce2f53b02788dc85e124cd08a6bef2049508a503ef0a9
MD5 a5a7fc313b26442b5410bff605502432
SHA1 a003879588feacffc1966ef328ad7a1c6419ef0c
SHA512 635ea7a161be226717badc51c5f52445060ab007e654e3d2508396c40a95c5c29057d136817814c6160aa59617ed9a88dc3788c934a9c43b546948ac6bbd4ab2
SSDEEP 12288:8WxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:8WxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A4552316EDEF8379EA1103B6459353880856BE6EFBC3554A2007B48B367BBE5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5907a7e0b66b1b86bc1398f53686bc280b78b9d964b1d5374ca915602abb9f2b
MD5 dbc25d851dfade428c66220a5a8ff810
SHA1 9cebb9225c752d3ee1a472aa17b04ecd5ad03e5d
SHA512 7ddfd10624943902739bd1a735ac08bdfa325a80a19adbf5a4f56029184379a86d810bf2c6f1cf857dc398ba5bac2820b3ed3b96418a0607498685775462e1d5
SSDEEP 12288:nFxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:nFxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T14A552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B327ABE5500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8dcf5d06a475675283f395fc742775236d9dd2d93f624778611f0f5589248a15
MD5 9768ac878950380bc32cc900b4294352
SHA1 7f5ff2f5d6f75818d7bc3d7c39beb6cca4e076eb
SHA512 2ae63ca0076da73fcd41263d55753a6d698c70eba220864d0dc2995733063b4cef34b31612cb04074e6d4bc3c8e14d8561923fc6457c128dae7dbcc28a8085bd
SSDEEP 12288:67xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:67xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T102552315EDEF8379EA1103B6059353980856BE6EFBC3554A3007B88B367ABE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a31b0e001fbd7bc7438afbddd66aec68ac23b378c0e5406d00dc6975770ac557
MD5 3bce461b7fe572f8feaaf93745f59601
SHA1 bbccfe52e3d1195e4d2febcf37287b2c93f08573
SHA512 e4d87b084bef471c1c0f10a1cf8d7e7788aa61e68507bec1d2eb8b04d8360008c4ba63aa4a262fa537ce0433d0f5ec34466c48616df4ff6c493139e790cb7363
SSDEEP 12288:DV0xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:ixHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1635523116EEF82E5ED21837989A352540572BD6DFBA3578F1102788B2F327E4540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ead3caa474b9fa18840af06052cb506718d00bafe1e8edf54d65c4785b39cf31
MD5 12a6e3c56fff81d00163c2b538727e0e
SHA1 8fd7d7aa572668899b54970b0cfad03d1370a7d8
SHA512 eed0d423435b52fe0afd792e32d2daf9c5e89507bdbd00a38d016a090fd93d93265b11dc7c7462a079da13c848a87f3b90db7f91cfbbfca82fcb832c4c2a11eb
SSDEEP 12288:Q8xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Q8xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T175552315EDEF8379EA1103B6059353980856BE6EFBC3554A2007B88B367BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 721c39e62ee2cd19f0883d1bddbb92c114a2b222dda99b2bb2fcce9383228ce8
MD5 e2c0e1f59a6db8b4d31ab422a59b2ef4
SHA1 124e44019409b7d52be9716b4d207449da8b1a9d
SHA512 7a1004832d5be8d715872c8bc897a97a9e370f9fac409102e2a904f8a2e35b4ed5e8aaf788bad8ec85f685e672f804fbd98a9fc3cf17aaff0a72f86946de1060
SSDEEP 12288:DhxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:DhxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T122552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B337ABE5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c9b1971f8f927ce359008b3463111954ff6dd9f3ce9d96ca305564598147b22b
MD5 33a2d2011df7d0ba3cff45ca5c569625
SHA1 d951e9ef9875e342d253aa9df6b3b75d84f77439
SHA512 da8380d7585f81fd3e94d312ef6a1eeeae1410710e15f3adebc4ef106bb3d66278f0f444db7e10ac5da9097257ebb9273cb418888614451f3fba8b37874739e0
SSDEEP 12288:VNxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:VNxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B1552315EDEF8339EA1103B6059253980856BE6EFBD3554A3107B88B337ABA5500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e16e309928dbb3616b47e4a82b8dc7051d56ecfb9aa6eadc2d0e5b89812c722c
MD5 aca9929e7801d766b5dbcf26e3d70f25
SHA1 d14102ecf40d87212bb381c7b34f6dda52504282
SHA512 a8e42e2e69dab9b740100bcd67630b9a37cb349ab956e1ea486318d395bf7afd41d8f6a0a851e19279330b34babada5d7df42ba6e7274ec1c3434cdb243466cd
SSDEEP 24576:xZMRzFVSOlxHfJaMJWTTXPPC1X9qSH9Y6VyP:xZMRzfxxHfJvYrPs9HHC
TLSH
T190750295B39418F8EC63823ECD568905D6B27C5A5BB0C60F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cdc4f4a8df8638541b1a7a6a9ebf45d38256cef77787fa499d3e64e65f649851
MD5 e39020ae4b87b9e9f6a672bce70a05cf
SHA1 2bd8c640332c5e791593ae9a0c795709fd3582cd
SHA512 e143634bbe33f8c65a6c1dc2bf959b7d3a9ec516bde32cedf1fefbf8977bd27daae2434bc6d83850af2e8a99d50d6fa6a968246fafdae47ef0ea93ee9c711eaa
SSDEEP 12288:nqxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:nqxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1F1552315EDEF8339EA1103B6059353980856BE6EFBC3554A2007B84B373BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3d12d42545b7d7a5922237e5ce9408bb0eb789da7253c5d970147835cc54f723
MD5 1d81872c37b674d22546396b0846bdb8
SHA1 eea6b7c82e93666956993f846087b6557936de14
SHA512 53cb48fd2d54ba26f2541da3fd04a7e957f3b2dc30b617706f648297d1d2172479c39ff3b02419cd22e2e28824c08c78a25c3735def03df2ccf8d5e5409343f5
SSDEEP 12288:WOxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:WOxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T134552356EDEF8379EA1103B6059353980856BE6EFBC3554A3007B84B337ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b158f18f2eff8b713f5934fa2852a260a98e841d10e5f4f00a7ed26cfffcb173
MD5 18a612afc8d3c493b23bc1ab5854b212
SHA1 1c7bb872028bbd7a5ce09169ca5b764299c5ca78
SHA512 1c9a9cfc8afb812ad182e1aeae8e88771712187f90e9c7873154f33193780acc844fa1d990c7866be09593d0c9f1c791dc9b7395ad3435db6fd48b61c975ee79
SSDEEP 12288:jyPz5L85xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Ozy5xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10065120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c4dc0e1668018c65a2dbbd7443c2b7d5de0880984d6af1884ec8834a87c2c34e
MD5 de5cf5fdd8fef6380c396c446ed085dd
SHA1 6dcfbc8a06b91b132e5969cedae5a86f1891e907
SHA512 2011ce71fb35ef0a3017233601d7b70c8ab390dad4920a4ff13d1f669e2958c9f0faefe74d6ec87d782effb00602caf91f00033e2d34e16a4bd3a499dc7f5efa
SSDEEP 12288:1qxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:1qxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FC552356EDEF8379EA1103B6059353980856BE6EFBC3554A3007B84B373ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5496b1e5a1a74fe6ca0d59da9667a42116b4a755e48471f65cfc0de7f6588065
MD5 80ac3be0ae5c41ae8c4f1b5b3464a4ba
SHA1 85f50f04528dcdae20b402f6d1fc6f468698ce4b
SHA512 242dfbf19f1bcc1dfc93a27eed54931cba01739b76d0542633bf110abda89d5eef21471025e78975f8e89467b3001d41ed32f644f0685e15abe4a4cb745ca6f6
SSDEEP 12288:bqxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:bqxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1F6552355EDEF8379EA1103BA059353980856BE6EFBC3554A2007B84B373ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9bde225a7a48983c55c444b0e1cedd5f64f66e052d694c3836e904698503a357
MD5 777012a248d305a8ae44698c542200f9
SHA1 ec0e5a6dfa3a4c6eea80f0a3c010ffd0b3242399
SHA512 7bbaa36e0ff26ba541c952b70ed247f27965d1987c1aa3673e18204f51d5e4f142d48c58874a98e1e7d626fa0066ee3a9fa1ddc6bd5af28e1236dd3998632318
SSDEEP 12288:PyPz5L85xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:izy5xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A965120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c8c00090724916f19492cc21083efb9d093031748dbc3f5ecbee2ff9c6f53d3d
MD5 92b4b82ce9a17badf46283d5fec2ad76
SHA1 42670a3c43b359f0d9f69e1277fbdc5b799e1797
SHA512 5f1e195bc7677de2123b278fd17211b136100b001b760b3b00f12bd20680018ae3de12df91e94598761ad3196bd29a40d75ac56e6ab4a998a3a9d059fcc9c4ca
SSDEEP 24576:STDaLl3z0zDrxHfJaMJWTTXPPC1X9qSH9Y6VyP:STuLljAxHfJvYrPs9HHC
TLSH
T1EA750295B39058F8EC27823ECD568505D6B27C5A4BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e6a25d4d420dc81d910cb435f0bff09f926bb0085fc81feccc1a1d48635cf576
MD5 95babfcd3f497f71e9a72a6dfc408f02
SHA1 cd941b3aebb99c71f67dbff92742f74927ee6b5c
SHA512 0663f2ffee5e6019322df6654355d4ab4a377e6bcc121f53919807371eec2f0d8a95f3fefbb1eed6117ae6062ddaad7883d0443a3d55c6b1878c8389a7f7bd72
SSDEEP 24576:23vd9CHKy7GZ3xHfJaMJWTTXPPC1X9qSH9Y6VyP:Yvd9CHKyaxxHfJvYrPs9HHC
TLSH
T14C85CE90F3E810E8F0B78A3589764511DAB67C5A5B71CA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dd0208cee9726778344f19f97f405f2c99cf34316cf7ccebd232eb2c0766f9b7
MD5 f1b6d88794fdb6053cc2a46ce5545642
SHA1 fa2e6212bf90a6a3d2e7658276faa07c7c07316d
SHA512 6971a6024063aefcc4c1813d943b862bea7e09951f410dd0dd61757e90f3ba4091437cc9d8c255870e34a2ffd79dd183f7b707eb8f7469c88a01252136141ce5
SSDEEP 12288:/bxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:/bxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1DA552355EDEF8379EA1103B6059353980856BE6EFBC3554A2007B88B367ABA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 592f5955157501ab9f44be012f49113a702485ad1b443bbf3828eecaafca8587
MD5 88074f9f61d53033c81bf279db19f41a
SHA1 17c3e0dd8c9cefdf1bfa0aee86cd53b16cc419ee
SHA512 18d500148c7b4e1bb9696425f7913378ffbf6dd2427eb81d33d1d9e722466686a188e01ce61e9a66adb11786c252ffb079e54be577bf7d4e3212f8632d26b4cc
SSDEEP 12288:bZxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:bZxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T183552355EDEF8379EA2103B605D353880856BE6EFBD3554A2103B84B327ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a2ba3b33cd3d9069df98be4cf3a092fbd3f7be1b2172f432367484eced0a5b21
MD5 b6b23201ff4af13efd86d38e2160e01d
SHA1 177bdc62bc3dab8176c2a0936d38261b52c85441
SHA512 ca4bc8466716bb2547f109ab4dd7c7653305283ea9f9302bb9cc185c3f18fa5d8b05bad932671956adddc856fba7cbe18e55b513d0acc80c307aa80ab706fba6
SSDEEP 12288:MoxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:MoxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B8552355EDEF8339EA1103BA059353980856BE6EFBC3554B3007B84B367ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a6a06bed7df8ac12677a23b869e05045585b55a6bae474a3d1ea29278d9f47be
MD5 19b6a9fe75b19ffa9ddd3bf38c5e9d78
SHA1 c3a01aa8d44a3038dda87a5b3802b785dd31d6e7
SHA512 6080e84cd1e7ced1c71e9eda8cc79712a4f8bc46434a9a9cf8821f267fe2ee27e89a3e66f0c34f4ddc91e2abb04b7e17fc37e8e20ab95f390c5e3e7946ca22d3
SSDEEP 12288:1qxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:1qxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15C552315EDEF8379EA1103BA059353980856BE6EFBC3554A3007B84B373ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f866ce05357ce9517428730ea1cd899f6d37c2c08db60ecb3899a1f68a5a9ce1
MD5 26027508b1c13d592345d20ddb18c7f9
SHA1 b4930de4c4dabdf61ddd18424c16ec6344aa9bde
SHA512 00960849f0b0d20e6310a21d86e5269bce456773c6f74d4b5d3f9c16bee92a13b53e408100c49fc48af981eaa71fb982193b2faec1bac088b58815ed608f16c9
SSDEEP 12288:+bxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:+bxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T181552315EDEF8379EA1103B6059353980856BE6FFBD3554A2007B84B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cb38a691b0773dd295bc51e0a11d59475f7e734eb924cf6d7e9bf12f6841fcea
MD5 5ea17dc92d39d1aaa74d1804ffa5b1f5
SHA1 2711517d867b5d2cbd7c831bb19ba27bae1a604e
SHA512 ed5f69349adfd8c57cd10b46d14f4162c791054d1a789dab2e0d3621e94bc3c4ebfcddf5dbe4b8f0a19f2f02f1cbde815161b10953dec00966cfc90f29a4c68d
SSDEEP 12288:hyxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:hyxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1CE552315EDEF8379EA1103B645D353980856BE6EFBC3554A3003B88B377ABA5500E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 26f161e029c36d904a50442d292f1869054e52b7e7e58807fafa5cf9633e0769
MD5 39e4e5e37d7e11423d389cd89c914f0e
SHA1 d6536206ce22bbbc2b9530a068600bb6ef0a89d8
SHA512 363d686b4a5f77628a8a715bfd2d56d4cbe3599c16a4cc7332ecf60fadf651c5f093a12eb3224930cceac58ce85677a397f5eabd7acd6680adeb6b18a55f5d48
SSDEEP 24576:MfwvUk9RX6wkyAIexHfJaMJWTTXPPC1X9qSH9Y6VyP:oMnYIexHfJvYrPs9HHC
TLSH
T14E85D029EBDC44E5E177823C89B3460AF6B178691B31C2CF125A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 57920e6aed015362bdd750a8572f08f80bbbc45faa51ae71d2f0d9692209e017
MD5 6429a43e983976137578a33442d771f0
SHA1 d9772f77bfab588355de0c5a5081f200ccf37066
SHA512 8c13463e419179fc1aaeb7de293660f1f3d2c742343f9ad4e5ead795999c3d1bddbb353d712d315c5914dda4fdd3ad3ad47e721fd78dfe965a8add384f6d6232
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fxHfJvYrPs9Hi:FySzP3grExHC
TLSH
T1C6067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ff45fb47b19e42f7e13afa3edd77b5d1e89bc590b8d72e898051b50456e11d01
MD5 f8f69ca9048d473c22aae265c4ac3a1f
SHA1 a8e2ce82e7900e438bbcfe61facd01a1a5863ae1
SHA512 784a98f4c3c8079581289bbb5e6f1df891c0208e5b72d726868cba98af7a8e6a2da2e6dbc16b2153d4df8cd411da85c9980eed1e9ae780e4972fa823e59458ad
SSDEEP 24576:B47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY1xHfJaMJWTTXPPC1X9qSH9Y6VyP:B47JUQjTirIhCnDHUPfF/vxHfJvYrPsI
TLSH
T16465AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 825e61e90e5eec21ce54eaefef395bb6dcb594129b6bcf32c9f6f230b462de71
MD5 1f33fcc937fce5e9c747dcd54c9f299c
SHA1 6774998ca3a13dfae6816fdde21c70419c150133
SHA512 d0ff0204deef68bca61d465d173d0d202235a77a1fe35e6a11a51c3b74e6b0c17e810a2615fbb36b24d30cd0f68d62f0e2d40474fdd4d2320ef947682e4e471b
SSDEEP 12288:7bsfaxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:uaxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15965011AD29842E8D02E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 032d14165913238588b81ee59e645dc109d9f67e5697520ab3604efb3ca3c62c
MD5 fe45682e9f43c80e7b3af6eea825b796
SHA1 f00689f989dc4a372fe051266c3151c5660056c9
SHA512 d2d33e8d4d11ff82fd243e43a4058d6563da063b6c1d7b8ff59003efc1071fb8bf26ae714818c6ea510d1d3075f060082df4aa157a866b830101a16102c3f26d
SSDEEP 24576:IqWNUPjY7gFVdq5AS6k/OEMP1JlYRib8P:kNUr6gDdq5RL/OD1J0Gw
TLSH
T174451741762AC78FC6A940325E36D6CCA7707D01EE45AF0773C9873F8476668BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e171ab3b339a994204c5c88aa77838dee4fd83413e9b809bbc7f649840915bae
MD5 2da8b77b361f7245a1a6b225ec0ed4b9
SHA1 e6eb904406e7fc73e14112f23371ea8a709d3a66
SHA512 a2f593e1da9fd3b6fedcf4487a315a37b2b8a592bb3c3072a7910ed22641388ad435cb8882820f3e7e27d2aa44b781d6af5dfa53a8367e089fc61c6357deb6e5
SSDEEP 12288:tVQkC1zCMl3KDTcWHFhdtDbwNQvAPKmbcbTbvlyON2Xi62rwR3h9SyJB9SyJn9Sq:tVQRWCa/9lrvAPsG5L
TLSH
T178553A41A5A7E31FC9FE5037423296CDAB746C12FB453B0173448E2C98675BEB6E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 78KB
SHA256 cf42d5b750058d2fe19016db401ee26f6f2ec51a618f68ed231de88cc23cb50e
MD5 dccc58e47d693a626fe384b86f3ee094
SHA1 2debd41ee7cce88f1ba19768185328a1eed6e841
SHA512 f00d631c3c8c0d2b54a25aa05dc3b863278859c0a1b96293fd1702c6ac0e5aeb4c5daed4ca7378fc9ca5c8f5918b02a3ba19707fe991bf76766575f109fc6d4f
SSDEEP 1536:NPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVl7hxx:NPMSwvYLbmzINcydDVlV
TLSH
T135737C432A5544F2D2866231B5957B31A7F5EC620F9A06C3C3EF82EC2FB6787F561212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 03fa2f2020f9d663135b09cd21a86bebb1bd4b1690cfeb34e19ac3089891efd1
MD5 13489e8b1da6412ced22c37b5d550008
SHA1 f4cf5ea3e3bec9e5f8915f1396fe888a1fcdb853
SHA512 38cfa4f983872f6acea7ca509c4d747849cf79406f9b89298254292f034296adc2d763bc7d4ca213158e575a09f69991ece60d38ccbde0f9567423d1f0e61da2
SSDEEP 12288:7F7ixHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:RixHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T124552312EEEE8725FD3503B504979224141ABE6DAFC395CB3002B48B3636BD49D1E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d3fb5d6a6fc1ee8a72f0750d213169aceff3813e3d602d48b44a121d2010f17
MD5 29ed1b7f95fc04e09c8def39d7f72b6a
SHA1 f908c0976be03201ddeced33190ad22cddc3a0ce
SHA512 469c6fa00b4e2a75624cd483f8931e9c24abadf88ffe8a87b8fce5925a94688b7bebccf13021c5bc27f5e8f9208677befa57cdeb71c9b0e33da01cbf8ab32602
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYAxHfJaMJWTTXPPC1X9qSH9Y6VyP:Xgb4mBIBhGF1xHfJvYrPs9HHC
TLSH
T12A65AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f8fddea983762e7cae2cff28850ddaed5f9a47ebb9ddda5682303a256e8fb7aa
MD5 7873a4129e634caf558dec156a35cd91
SHA1 4d268c15aa57c2b66bd4de8783a8a53aaae2282b
SHA512 f81f8ff8a275e340e4629b3aaabd73f5194d928db34ad7aa3ad07b5da931a1b2fa241381292930d0a44257dd682539b376f62600f8aa5787bd2d7e88101ab045
SSDEEP 24576:xG88u8FpJqH1bzria7/mlxHfJaMJWTTXPPC1X9qSH9Y6VyP:U7ZFPqVea7/IxHfJvYrPs9HHC
TLSH
T18185F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ab360e1968e9b2112af16910f7a3afa39dee976946edc6a0c27fe4b2eb3e2c73
MD5 e263c8fc21162ea650814e3527dec55b
SHA1 357c7f94f62097b6cc873918553cc6d89a62096d
SHA512 e7522d143b4421692c91feb27393748d9e450873fd909ad4708c15249536ee654e77719cf5801bd4b8e49d7f2019acb4a27a7a6081daf42ebe6056929abbe6a2
SSDEEP 24576:pPUr+NQxxHfJaMJWTTXPPC1X9qSH9Y6VyP:pJQxxHfJvYrPs9HHC
TLSH
T10365F12F66ED18E5E636917D85828309E771B862175292CF0291817F1F37EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6629eefe0fa32e92ce30f80d821ec65cb3d3e81aa91c32dc2d172287a6bee1d0
MD5 e99a09adc7e48c6ea2f6e618a7c2ee3e
SHA1 04dee3d6d550ebad4848cf35339872475b586cdf
SHA512 40636a3d4c00e4aa150fa1f548338089a86a7bc29acec7f04de25ebec29d5bfabda37b8059bbc5d6242677f0224e772dc61bbdd6b1283258367d4dca8ba5acb5
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhxHfJvYrPs9HHC:nG05lO43bmgrExHC
TLSH
T125D5CF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4ce5e61cb33a5cbc60d74a18e38f6491588e7f1071a7b554ae98d11aa88b563
MD5 763120752f1b679a25cebac4b5688e2e
SHA1 8098b64b15d050e880c453febb575e713a0bcf33
SHA512 7faa1939775edc6937842a9eafc7c2cf780f06dcf2bf4ed1300bf08a7654f4d83bfcba6351ea5d32bef6419654e742879fbacc904adaa3f12c5342fed0c9e9ef
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfxHfJaMJWTTXPPC1X9qSH9Y6VyP:Ka5POZ3BJt2pasx2+mZxHfJvYrPs9HHC
TLSH
T1E565BF5EA6FC01D5D579D17DC583861AE5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9c58082074af81b07cf32d70dfeb853d27bbbaf209ef50ecd087a200af230ada
MD5 3b8b6267e0ca92ab1a451826a97e212d
SHA1 164c03ed4735c25ed1c207cf7eedd869f635a871
SHA512 11236fd37679d5048d7388d7edc14dd7e324a7d3b930e65a48306c2d85742c9740a2977862c8711f7acb9447e40de85db9d0722abd0e807b56421d17383a7cf1
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fk9xHfJaMJWTTXPPC1X9qSH9Y6VyP:jNc/zEOVHFoxHfJvYrPs9HHC
TLSH
T1EF858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0069e3afc3e841a977089b7610de0b22eb080ea0deb5c55157b94a56e4b0c2be
MD5 c33f4f0a5678e8e22708eada2e2aa032
SHA1 a662dc2fb510061ada7b541723f5065e18908536
SHA512 b6e9a9bdec0059155e71e2a12a189a7adfe9f489feaa721e25ff4f39f9a5a6711c35638afcada82f729b63adfa8cb3c1172bbbc411849295e368d5b525951be2
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmzxHfJaMJWTTXPPC1X9qSH9Y6VyP:pTMwBtOmzxHfJvYrPs9HHC
TLSH
T1B355AF2EBAF846E4D1FEC6B58D238512E6727461173293CB5290C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6ba9c7e2f8aba59a0a173564f068a79d68e9c5413bbac0d1355a7b1482609dad
MD5 21aca82d3f64140fb3843d405609c6c7
SHA1 ea06fcc512e0dbaf46be4a59b365f25ffb6eacc8
SHA512 361bb5afafd4ab2a0ea039e2c61249f50c15f813212db8a8ae5711171a33e94cd83abf8474db8ad13b65125de823c54a02d1c8afda7baaacc2b7be6a3fa0cbf4
SSDEEP 24576:yD3FHshBIYQgA2xHfJaMJWTTXPPC1X9qSH9Y6VyP:yDVHeBIAA2xHfJvYrPs9HHC
TLSH
T1AE75E13DEA9D04E4E57BC2BC8A638606E67138AD032255CB0194D1BA1F7BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/300-330-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/300-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/300-113-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/300-119-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/896-62-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/896-63-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/896-69-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/896-309-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2108-88-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2108-82-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2108-78-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2108-326-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2444-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2444-346-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2444-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2444-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2444-136-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2444-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3036-328-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3036-133-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3036-127-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3036-135-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3284-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3284-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3284-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3284-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3328-98-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3328-125-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3328-327-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3328-93-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3700-153-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3700-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3700-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3700-148-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3700-142-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3744-92-0x0000000000400000-0x0000000000846000-memory.dmp

Download

memory/3744-0-0x0000000000400000-0x0000000000846000-memory.dmp

Download

memory/3744-1-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3744-8-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3968-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3968-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3968-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3968-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4156-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4156-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4156-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4156-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5000-139-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-25-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5000-26-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5000-19-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5000-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-413-0x000001DDAA590000-0x000001DDAAC10000-memory.dmp

Download

memory/5772-344-0x000001DDAA590000-0x000001DDAAC10000-memory.dmp

Download