897dd46ad2a3f181e004497003d21349bc3e91ce0f25ab1f731411e5ec5d50c8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Size 5.6MB
Sample260712-v3fb8aev2j
SHA256 897dd46ad2a3f181e004497003d21349bc3e91ce0f25ab1f731411e5ec5d50c8
MD5 2eaa9b9c5be8ae7958e5641ed488c633
SHA1 a882de6546c2b6d75bda9c995d5d94b291e86c8b
SHA512 3ec6e49797b6d4c3523b7361fbf5e4560d45eb919ada30e82053346ad85f38b910588417aec1788e3e53b904229a449a4eb7b0cf57bc57f807a2c6e44873809e
SSDEEP 49152:RkCF9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/T7gH0a0BihL67Sy5BpNTVb6SEiJ0:heXttyVhPVMn0ajE67mqrWETR9b
TLSH
T10646E642A3E944A4F1F32B756A3619714A77BD115F38C88FA68CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4780	elevation_service.exe
2940	elevation_service.exe
2728	maintenanceservice.exe
2964	OSE.EXE
5964	PerceptionSimulationService.exe
4632	perfhost.exe
1392	ReFsDedupSvc.exe
2836	SensorDataService.exe
4228	ssh-agent.exe
5860	AgentService.exe
3796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6dd2569023e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe = "10001"	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000645d2e352412dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054435e752412dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f35d1d352412dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f54719382412dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6f0ab352412dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe
2940	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
840	Process not Found
840	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6140	2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Token: SeAssignPrimaryTokenPrivilege	5860	AgentService.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1392	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1392	ReFsDedupSvc.exe
Token: 33	3796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3796	SearchIndexer.exe
Token: SeDebugPrivilege	4780	elevation_service.exe
Token: SeDebugPrivilege	2940	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4808	3796	SearchIndexer.exe	99
PID 3796 wrote to memory of 4204	3796	SearchIndexer.exe	100
PID 3796 wrote to memory of 5948	3796	SearchIndexer.exe	101
PID 3796 wrote to memory of 1312	3796	SearchIndexer.exe	102
PID 3796 wrote to memory of 2660	3796	SearchIndexer.exe	106
PID 3796 wrote to memory of 5000	3796	SearchIndexer.exe	107
PID 3796 wrote to memory of 4824	3796	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2eaa9b9c5be8ae7958e5641ed488c633_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cee09973d83e7d9a49d236d16806d0cf4ceb53112a2cd53658e111f4132b3de4
MD5 69d43ef108881a2720dcd2683c5de594
SHA1 f9a88275ad2f309ec00bee35c45ba847057b275d
SHA512 a3a7682631f8f724b9e255a1c7fa491dbe2f539eb2523251b54600f5ae3d08cf737f755afeb44b17a3c1fabaf66d3c6bb8be49cb8622ee81ae6f4f73e6e88beb
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOm+brLC2hTR9quLB:Z3q6HjBzmqrWETR9b
TLSH
T12BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 777be3860d67e6fa9cf45e05e11b749cf79468a2851ef18196ad491f927d4a46
MD5 53abb7c439afb6134a1ffef478b55554
SHA1 3107c327fabcf365d8989762909a043c2a6017a5
SHA512 a12b5c43aeb56c72c982e8260907599fa851b8d48eb831f3faadc6e8dd246cf3d33ba0e388add820670cb1c295185f5542dd0a6ee84272b818390942bad72d63
SSDEEP 24576:GXYfDtczAnRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ltcgm+brLC2hTR9quLB
TLSH
T1DD05022867E408F9ED6B827CC9A2C401EA73BC914760E78F03E499651F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8d39aae485011c701e3adb6aec87f51c66d1ae76eace2d9443bd7f07e51d6723
MD5 195de19c696cb0520409037774129501
SHA1 242e4c1139e2cf701dabdd5b3780001d3ea762cb
SHA512 e3c399d63b1421df03e7dcaf214214bdd33025036e64c0e98eb5a2870c50f77838d868cc71ca4fd4ecf1531efe25ea6ea0af8fe88d3c6f2c1e79b76627f1fc27
SSDEEP 24576:20Le5ji0hmxirMmRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:2Pji0AcVm+brLC2hTR9quLB
TLSH
T14C359E15F6788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 50df9f15221fdd6a7f72f12d495d27f5fd11699dd36f531195ae126aa92a37ce
MD5 fe1acf2df13cd696cd844c85d1161207
SHA1 e5024d8cce6249bdca37723c3d66986252c98eb6
SHA512 4f8b014c044356454c85c2a7138a05370ff5659aa644f091809cf86853dd4ce1988a0721fecffd53c934ef77e8f96c861b88ae99be142028cbaaa606c54f7a92
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyuwRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:9/ezSC6vUzPvxHjyJm+brLC2hTR9quLB
TLSH
T1C7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5000ee91b54dbd08dfd708f05922c4fc67de4fe52201e228bf3f4336cdf31f4f
MD5 13724abae86b05ccbea3f4d92f79d898
SHA1 a7da117afa47157cd22f8a81142cb671d0266f18
SHA512 d8c3edeaf1f721d41cc69d43c585521c865316ea4d5f235f13d77c65f4cd0aece79010d9324867bc1f714c831cadf5e5ba61a98fce6a8212c8ba1c25b6f324f9
SSDEEP 24576:lVbqPb88hv/l+6DRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:lVO88hXl+am+brLC2hTR9quLB
TLSH
T1ED55AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 133837e5052c22d05c357f8fcce93da2f703c784e6602f81d1ff2ac3ab41d98a
MD5 0d32f647d813776afe8f9de6d42d088c
SHA1 62f4cfa7b33ced84458738beee2148ba1ee97bfd
SHA512 eeba3d88e0981fa5788cf9c2b835ca1ec9c39fcd372ea66c8097704b90764aa0585c7a62fccab9211461783bfd4349959eb59640e9f3d3901842783af343ba7c
SSDEEP 12288:xRTWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoV:xRiRmlh8t0D+7y8G2G9yL0cMoThTR9Pf
TLSH
T1B3C42358CF2D0082F39FA2B1B2E1D8D5997DFCF1D984AC0EF0817DE11674CA4A62599E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0127cabfadbc2219004ab9f42e5d61ecc9badd639d08cc123113a992cc73139f
MD5 32593936195d0e9b2a444e9c44948301
SHA1 bb2f3d6397d7331cba16694123875bdda8003f7e
SHA512 5038051d1c77c9cfef85adf6ec3326f109ed73366a162c70fdeb62f2447a51f036414e7cc85a0e0e186ef6e2b48bbd6717b9f84766dffc334ffadd20c37d022d
SSDEEP 24576:tJIUbRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:tJIUbm+brLC2hTR9quLB
TLSH
T1C005CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cd8ca36aeb19516fe59ff52772b830524670fc2d806e24fa80383ebbf669783c
MD5 02f573ef400e341ccb562a820697260d
SHA1 cb530ab51b22ea3819fcbb64f7d453ce40e027f3
SHA512 2662df5431638e942e838047bdf7e344c1b621996e280cf057663e74a7e4537c7331b1e64969478fbe0f02fa1bd9356cf0338f81cb3f9a77efe145b538ffb966
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:XQvGAdlCEL8c/yRNw5CAmqrWETR9b
TLSH
T13C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8e93a669818c86f5a4123eb59d536d3a71e09142d7353ce872e9076480d9af5d
MD5 24adc2d31b48542f2f39fc61cb47f2c6
SHA1 e2a9a7a0faa5bd605f76ca9bd5eb11ad841a7886
SHA512 28bbec45731dfbecc82924d0e75afebc44610023e230aeab290fc8ae92c0187a982f7b497a7b7d0d8b48a099059ce12893dc16617190264dbe8baef44a3b8672
SSDEEP 24576:cdewsAjlRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQov:Eljlm+brLC2hTR9quLB
TLSH
T1B715EF31FE74D032C3BF0DB22B62C716587DB9604B511AC3E3A89E9D59706D22736A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a43041e3bb9d08df6b4fa6672573ac3812680c7b3e7b6597496c47e484e1305d
MD5 83f638f1bf2083a48830a5de9b87a3e6
SHA1 bf8e236993c9ed8564d3e8d8b2fb19d0c6d61804
SHA512 9c73b899ea012c0b5e68398b9c03699665a24126bd68e56e516980afcbbdac307759fbe283887f38dd50b168ca84013013b52e0deb029f34e725472d2273e655
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH39b:GUEtQevvqc2W1cpV2EI32N
TLSH
T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ee1360ff1c4ff2cd66197f2a401c9bd89b3ec1cb0ca13da5f338ca0f628d46cd
MD5 735fb221aadea3bd5598cd11e2bf6e38
SHA1 57a7657f0d605bc2287d1aa8ee3f894c7ad49027
SHA512 bb41647117f9dd3e7d98825ee1cf29d287edb81809c57394718f0156ef3e6d6dd6d12526f9174abb6323091f9cb7fc0c410a1642f1da0a21949d8f1efa2d23ca
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zFm+brLC2hTR9quLB:zoqtVjnm0mqrWETR9b
TLSH
T113D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7207da3f75a8877bc594bf6c53cf956a0b3f44f92e83bc1b62f7e1be95e06b2c
MD5 c9e08848f7e0619c6046ade6c1f2e9b6
SHA1 ceb997a8d06c182d1d472f391d409dd7e3b1fa45
SHA512 721268c362d047db9619b99619d97d011ff71d3e927644ab49c49b712122541d606e4a28079c5596d4aacc7d00d96cb8e61b51b803df04fff9025abe2c48a04e
SSDEEP 24576:tAhGLJIFoiwtA5l7S53URmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:tAMyFoiq5Em+brLC2hTR9quLB
TLSH
T12A359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ad9c25c69f1569a80fa0e306a7aace6a5f832311f40a4b12711d77be8fb02a8b
MD5 be6b56692098cae7715ef8f1cc295b1d
SHA1 1f6c9741d8d387f2991d2d626f6186455b23044c
SHA512 b7e8af673f94b63d32c476e50c3fca73305892ccbb91387c68f9ecafc141e854feddb687b7633377ed5d299d65ee447f6cf14a8fc7a441cc665fc3f0b26338d4
SSDEEP 24576:dwuoOWpRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:dwDOIm+brLC2hTR9quLB
TLSH
T12B05F14976A80CF9E5679238C293C536F7F2BC122A21DB1F5360C65B1F376616D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 44bbf2d1d1b7d9be68c994dbc480e6fad7943060dec1e74d687d54c93f7e36ac
MD5 38fe5206e9ff146182bad98b4d5c2368
SHA1 e266e47f2841e0b73c545cfcb0511995c065e9ce
SHA512 2dec344ee33bf4003816cf0fe21bbfc2a2aba1d4bd13b06a4e9c93e8f81c4714eee2b352d3370ead9cf33502a402601345e5a5e3b6dfd629b2f95bafa235b500
SSDEEP 12288:JBZ1IywWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:nZueRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T110E4224827E820F6E2AB9278D1F18985D7B6BCA2673183CF219056E51F33DD11E39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 711704e1c7eb594d91536a0d8b01b40d6df115e437ad9577583bbe3bde953823
MD5 bc3aa66cd58f4cd4ce5a0a4a9ca1457d
SHA1 31c14982d69e68ce2cb68032584433b0b7b015a6
SHA512 73a41ed9a60d70943897c65d2af60f1f3f8a03b1c167530d8b3c7b8ee20aec3042656d7baacffa31018a176900d1eb86b52af3571bd4f913e5a6c4523fea651e
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN3fmqrWETR9b:uQyiKayX+PN59b
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 06eee49e042452faefa83dcbb2ea1cb606ab8bfad345587f6896669459f40906
MD5 d70e16f29d18e352892648391916d5ee
SHA1 f97ddd35bee1e642212a160b4a673b2d28321f25
SHA512 af09cbf906ebf83c79d5690dc78ee17b4ed86280eafbf57043dc35ff5a4b215d63d7b29fc96638f4c6550cda3a0ad0f7b95e35aa1bd944c6a610b5b7511945bf
SSDEEP 98304:zQRQyi36YOcPQLvw2gAf+PN3fmqrWETR9b:iQyiKayX+PN59b
TLSH
T143667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7df00f525bcae3c35c8a0be87e88119b1d48189f9d5a2050b388ede43d2d5b4a
MD5 89b7568d2a3404fdd46ee34cdaa68b0d
SHA1 979933d1f335ee6e15447b913ddca9c022fb5683
SHA512 5bb59353bc410e7088f2b7a3647ce54e9785c5df6ff5d5498b421b66cd4d67e9571d86d2cb549a0b8c3f24a966cdd88f6d444cb74cfbd9ed23c4484c11b51133
SSDEEP 49152:n68Qg55nhheWu7PNU3/Vm+brLC2hTR9quLB:RthWRc/VmqrWETR9b
TLSH
T12FB54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3c737e84b36a116fd67d5bffae4564830f15805b0dc4334e372f02e99da9dc2b
MD5 1716ee0a000d7c21b1032ed524fd0833
SHA1 7cff7a432e75a14b5d42065a9aa0ab712379a93f
SHA512 48a50b2725a743c349461b8939e3ea62735c34d2e0554a9d2146fbc83fe325c8af823990086b2be8a95e3496468132afdc11f051525b1f87763d7653bb20b5cd
SSDEEP 98304:9y5112gYy5azzVvL69nLKnhZimqrWETR9b:gLIHmWhq9b
TLSH
T1C2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6be2f5defb40b1d0233cd05fd52875bee1e86bf07f03125e2c90fc4a2fadf92a
MD5 fca9a9424e9f8c8c3b75d5211d085943
SHA1 c4d0479176bb1b01a2e688a8bbcb3222f935c750
SHA512 46ef89c27cc6c58d7199f1c7800a995cc6a1f4f1995c86effa5d8d658cf6ac3a5d480723c5b1e1dfe7434129b2197a49837bc99de3c415bd2b8d729bbf57bc1b
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXm+brLC2hTR9quLB:1u6JmVxd2dXmqrWETR9b
TLSH
T1D5D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ab0280604d32d65c469727128ee91783536075ac15694f2712afd35b6c8d4a66
MD5 0d73bd05a612c727ca1dabed76a13ea3
SHA1 b6033d316dbb28905e00016ee0fddbccbba54f75
SHA512 463ee5c3147a58512006efffd8036b6f0ce75da45093ce49bfbb8c39e3a955b38725c0284605f895851dd53e46b3a65ee21bb8a4f4203426ca3b8edda84e8b6c
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4x7m+brLC2hTR9quLB:4mifPbR0mqrWETR9b
TLSH
T12FB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a405bab73ca1b1ae37cc66292026dd0d4cf02d54f7808cac6dddf86a7e99b98a
MD5 f2320a6aee63a91f1c0c13e04640f8c1
SHA1 cbf807e161b8af12d5114e279ddd035d459574aa
SHA512 d9f799be0baacb26e084695fa4a411ff32ac2dd1da3c1c65e34338f895de18d46881d2d6060b1b86672c2cd4d1698ddd0882cff7d5c7fce65c1c56abac275d74
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqem+brLC2hTR9quLB:u5dKTi61emqrWETR9b
TLSH
T126C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 30b02488df266ccf52795c52d2b5abc3976d697bde6a96fe208662633fa6c6e7
MD5 e0ea224d04a5ab67058abad153ec6ddc
SHA1 073236289234c346b3a5ada63466e9d788eb861f
SHA512 2260c2d5c523eb0fe1ae3a110cd549e07e3b58c243f018725b3b9dc00895b6ca680f7553fa2c7071c31351ec3b3bc14e0181b93ea5bfbaeca0b3abe5473a50b1
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wnm+brLC2hTR9quLB:hX2iyphomqrWETR9b
TLSH
T15795BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1fe8b4bd69fa433828f3586a76eb6d124bc5faec195dc237455ec3ff756f0d73
MD5 8f0089e14a4f2cfd619ce289d296c9e6
SHA1 87e8548923973eae8fed6dde4248dde85243bc18
SHA512 c21652c27a3c8d856a69196b2a70f994b1c667798d3f8a5c1af784a0f4ef93802fd1b0dc1c39fc0580b4863932b041b711f70bc9eda3385bc700b0d91f671397
SSDEEP 12288:77WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:7aRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T140C423188E6D0086F24EA3F1E2E188C5D8BDFCF2FA45644EF1C578E117B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0dd3688e4d36ce62b382a54d3cb110292e3587fb1d3b69870a7f1f8dcd193022
MD5 7a6e69e88a2939cc56b994a5743597a2
SHA1 6b256ff483fe03f04cbc76f6b9199649de910235
SHA512 f9ee972c5f7ea8e805d086232bb3522f956cafed22d40e808cbd070e34b058b94b62c6f15614443fa9e16f6e8a18434cee985c53ae736be145832cadec000473
SSDEEP 12288:UcWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:UxRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1AEC423188E6D0482F24EA2F1E2E188C5D87DFCF3FA45A44EF1C578E117B5CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 776a4d3cd4e1b9a303aeede71c5c18656fff876f9a6de480a25c17fe34cae262
MD5 88797ccf6e6b6fe05f9f50d400205b7e
SHA1 fccec726f5c0392c4b01e73275ea0ddb4777c63a
SHA512 01d3ad2d7c934a39797a015e4dccc69d69a8be7baf77d60ad4dbd83dd3971a6fb89cea4a7bcec245c1c45797203ae6ee6cf611ef10612472f8957261708f7718
SSDEEP 12288:oCWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ozRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T12EC423188E7D0486F24EA2F1E2E184C5D8BDFCE3FA45644EF1C578E017B5CA82B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ec7a93e0b2e0802b596a4e8338f612a47ca09699cce3a2c97c8075957a80b15d
MD5 f056c200748c00e4f5340445a3308d04
SHA1 610b0d89591c3bf619f5f4a1592f18fca6854893
SHA512 902c4d30255939b3b730a4c6e8d5a518a1c42863cbcc4c32a5b5b35a67963161a982f63eec340306f84e6808036f418c7ce4ee5c3f0dd10569e2dc35cd368f35
SSDEEP 12288:NVpWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:8Rmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
TLSH
T1C9D423185B7D00C2E16BE2B1D2F184C5D5BDFCE2EB51A68FE28028D50F71DA46A34E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d6e5103a024285c44fd859616feab9e08f29d98c88f54f202ae1e692ba943c89
MD5 dfb181b673dc13f9b6f3fcfe95700f74
SHA1 dadc0d4a6db4353d2a4ed5e5c8f691b1d502fec2
SHA512 dbcef7813f0e96554f840ca7949d877427908c3e0af600b2faee00fb3229dbe29da345c9593c0ace97fec64f12189929844f1a189b2f9a2036ab9d2314b9ad6b
SSDEEP 12288:dBWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:d8Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T144C423189E6D0086F24EA2F1E2E184C5D8BDFCE3FA85644EF1C578E01775CA42B259DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3a6642c350772c5ba08cc833887b5876d34334c91b4519e64e707f9daa92e24a
MD5 11c2038fb23d48284c933b4e37697ad9
SHA1 f650fefb443a048d2f5ee34944cf45744ff94b41
SHA512 cd25f4957bac9398f48af0ad48404b7262168cfafe705ec50ed1aed21ebad37b0392f69eb199b39c1e5646f016645a81eefa81baf27c1386423c894f7b2006a7
SSDEEP 12288:qIWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:qdRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T121C423188E6D0082F25EA2F1E2E188C5D87DFDF3FA45A44EF1C578E117B5CA42B2589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b1930e920cf17809d4b47b45d84fed0161a902f9eade1330dce2b71ba58dd347
MD5 fb8944f898510c9c6db6f9aead697bcc
SHA1 097efc4a469210baf18a58e5caaac472be9b4f47
SHA512 9cf28c1e7a437e50d4d1ec354b113fb7b78165180146636cd3eafa15949379c53a02abc88a419d381625767e8226049d31497626813a12671afa8ecef206e0a7
SSDEEP 12288:CUWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:CZRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1E2C423188E6D0482F25EA2F1E2E188C5D8BDFDF3FA85944EF18578E017B5CA42725C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b18884f324e5be3da2c2454790800a803b2a5a9127a0b8a921c6659c58cc5f34
MD5 f628bdbdf57015377dd5703fef657cee
SHA1 d8fc9c737f4ee8fb91831546a2de3a78493475ec
SHA512 43a977d96ea81c7ff11200a87440da4771d331c38020f3d506d56941565fff9d02172d596adc891325c9b877828c624526316a1d669d2391937f881a89d5d2ad
SSDEEP 24576:QZMSzFVSORRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:QZMSzftm+brLC2hTR9quLB
TLSH
T100050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e08ae7fb4b39274cb7a0d46e694a927bea4bf91dfd70b206af0ae4b0bd1e0a89
MD5 b1baa3ab22199ab5aee95672b2bf0536
SHA1 1f62e1895f54dfdbf2ff4a0ca17618436033436c
SHA512 525420a81d08454194ea5f5b3a0a40fac5127ab392f8b6a2a4efb50b9e4602bf45b527a6aa94702719558484c2ba6aeaf667c58591676411131da7c15f6da7d9
SSDEEP 12288:FPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:FuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DAC423588E6D0082F24EA2F1E2E188C5D8BDFCE7FA85644EF1C578E01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 631b8a6d7e8a1b98e9be96ef24da8ca0153675e05d4e7eca3458786ded3584ce
MD5 b9313eb457e25b7c86f3d0f533d1712a
SHA1 1a4231c25bc0754181a30979305f6da1e4f53033
SHA512 bf049dfad9dc70f9661121d7867b4b25c56d400e2e1d1b5e4c1726f58813c98cc0fb3a45c84149fc19026f724b6b25896713b553e09a0ca7303e5be59c9199e6
SSDEEP 12288:3jWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:3yRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T138C423189E6D0082F21EA2F1E2E188C5D87DFDF3FA45A44EF18578E01775CA42B25D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4710d5105609063a08cdbc26e915bca18ff125e629f73977e38935d8a7a31810
MD5 3fc49ad103cb740f74cfd24bd05e2908
SHA1 d5317fa1ebdb5bbf33bac98a8cb2be4d275d6bcc
SHA512 2e90be0bcef9ddfb4bd773ee04adfe3d4076585fab63d4d908110f2dbc7ce7cafc0cf380250bdccfa55dfb3acc598db584e52d260c25ab8a83f34c902d5a809a
SSDEEP 12288:KyPz5L8wWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Xzy1Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T19AF4120777A520F9E17B9274C5A20942F775BC7257208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a8df9eb943a7237d4ab0dd23e62ee7a1b95121186aafd1290573fd09a1292c93
MD5 f7e10257c1a7498c55dd5ee20a5eb6f4
SHA1 f0f432a19db5c1c01ef37e423914aad74144945e
SHA512 b50b8a5bdffc471379b38967f1dfe7ceef34b1f74310c92cbc8f20ee1a304522714e2de06bbc9351195f39fbf6ef3abff6d06f0f4129e47205269f02badc8399
SSDEEP 12288:DPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:DuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T108C423588E6D0082F24EA2F1E2E188C5D8BDFCE7FA85644EF1C578E01775CA4272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f20fe9b6bb6d725028751423cecfff7f4db61a7cbfab7ed8ec263be3d2bf9dc0
MD5 6ca6d8dd1c4482f0d46ed102bcf59d84
SHA1 ecdae19947e9744645923b9c7f673d3255f9e194
SHA512 ada582a859f633504ea9e804c9cb8273dbbfd2cd14ee107051e03706625bec153d79ab81e188f305a42c54591ffc3f74cc5c3dbeb1813dcccd59d7a088eb5179
SSDEEP 12288:SPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:SuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1FBC423189E6D0082F25EA2F1E2E188C5D8BDFCF7FA85644EF1C578E01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2e3c0f65ae118f23e3335772f21f50dd694467e98cd7d5f282cea9033b35b5f0
MD5 51760cbc11762c0096ae5ee5798b60a2
SHA1 a7a2b8b3b8674f26d70f9221039e586970e8403e
SHA512 43c5db9a4dba8d94a2b42d7852c00d8f1c5f5a106c863f9ded16814ddcc19333ee3d15b523f148082f8a17589218c1bcb990fe8f5e0caf8a4b1885b31ac2c40a
SSDEEP 12288:YyPz5L8wWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:5zy1Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1F8F4120777A520F9E17B9274C5A20942F775BC725B208E9F639016B61F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e724eab2681976dbec835d3b4986512cb53c1586317bee77f47e2c667f7081a7
MD5 31f13de754e6ff8edfaa2fb4b968d906
SHA1 f913b03982300f062d7286fff684cbf578e1fe47
SHA512 a45c59f3340612d439fe75aa1a2ef00125ac8350c7d4cf48b10ee27dd0f9d7916d6883caa8788cd037d05f5d86722670ad1b7a9bd101272d1f785dd8fb745029
SSDEEP 24576:5THaLl3z0zDjRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:5T6Lljwm+brLC2hTR9quLB
TLSH
T137050294B36408F8EC67827EC9618946D6B2BC6A4B60C61F13E436671F337A01D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 41d5976009e2eb53653de0c14f02d7c7b2a6b29901f42202e762946c72f1925a
MD5 04da6191846bd70904e0482e24cb0db2
SHA1 fb9bb551ebb2eee8b85c06942821c50fd2f5d14e
SHA512 2f7be6c2bc170fcb14e3a84ed6f2444d8da9749ac2da68e659955058cb6cf645188f8ee512b5ae16c1a8aad9af7949109c3df5d38f5e6db8970ca0d0bc416df1
SSDEEP 24576:U37d9CHKy7GZ/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:e7d9CHKyatm+brLC2hTR9quLB
TLSH
T10E25CF90F3E810E4F1B7DA35C9728511DAB67C9A5B21DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cc0bd40a51b08e44ccd19d52ced348fbf8d92130995d4038547af82560eb91b2
MD5 74f91edce48f8850d6795707391081bc
SHA1 84b2321d0ba7f21121deb4018970e3b9b4733c69
SHA512 9c09ee031fba732f9e70b8989659a07cd4349db7b713bf786d5167a0a6a58ada2ba0bb501dae6e63a6891b39577a32088143eed1a9eb75b891ed7afd3c8c994b
SSDEEP 12288:BiWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:BTRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1E9C423188E6D0486F24EA2F1E2E184C5D8BDFCF3FA85644EF1C578E017B5CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b7d7c09b0af4f58fe5a9c2a334adad3dee2c6ca145950808580546f4761fdcd4
MD5 e422a5987550b6c093838d9fd042ebef
SHA1 a0b6cb1d0d27bfe3e08b5dbb93946ce7edfc28b6
SHA512 13e8714a6ebae11e50878e60d6a04dd9ba4516c1bf653a4c8abb3326759ad7672fff72d4814b91bf915d4b1ae3f60a8c8fc7169a8945c45b16a4a031bec1cce2
SSDEEP 12288:/QWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:/VRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1C8C423188E7D00C2F25EA2F1E2E188C5D8BDFDE2FA45944EF1C578E017B5CA42A2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 68263440b34c218ccf431ddd5ece89a6d6b30af3e041cd53f6ad31219dfa97f3
MD5 b7075bd1c375055f00460ede262b3b21
SHA1 a9d6c21519ee2c1a7b3fee67fc1e98eaa190b0a4
SHA512 cd5bb69c519b0b1b7a257a976449509fefd4ae748829b9eaffd9e61309ef68fecf268202191f8fdd349dda9bf385a99f4ccf04ca138a79c756036441f807a449
SSDEEP 12288:7tWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:74Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DCC423589E7D0082F24EA2F1E2E188C5D8BDFCE7FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 efe45df25109e733d96fe5d8653b52a278ff52cdf6fb87b18ebc615755e88d0d
MD5 c27732d078594cb71321d572f8b487bc
SHA1 f3f8737acdf3132ea3ad3ea8db63ff9635baf539
SHA512 0324b6766a95435ddcd8b238289db747d9544dd34c7ba927bf24402effec5750ad28499a84b9fa7e338b3e994b18d464f660b8af334795a962ec3018852b3aac
SSDEEP 12288:2PWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:2uRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T154C423589E6D0082F24EA2F1E2E188C5D8BDFCF3FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 103eb7353dc97b4572a211ff5a12f1721381fe458e0c915ac9108dc9302c294d
MD5 1d472ac3b10a1be9731cf1e99b07011a
SHA1 11e1f8533a68a6a1bb8a83d5ddc2c90023752033
SHA512 b4f0ca4f6ee16e7748e4431310a2bc805869eeaf7f255d19ef7fb7148d0ecbca9018f066aef835cf67387610dc54f467dfecfc93ca4eae14fb862c6bdb3e26a1
SSDEEP 12288:TiWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:TTRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T193C423589E6D0082F24EA2F1E2E184C5D8BDFCF3FA45A44EF1C578E01775CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 81098811175d93ce5c1fda1503e11870b7badfacaff7838e90c848c0958b04b4
MD5 ec142cf7d9ed6fc56c4aa74aaa111958
SHA1 1d88d96236c312fe214095ba0e09dbdf921d74d7
SHA512 99b86fbb303d30b8901845989469fc5e285252dae8684533e1b9091cf99628b487a6d888e601124c569ef78b4e30b0fa105e70140d9b9a3cbbb63cb0a35605f5
SSDEEP 12288:bnWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:bWRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1F2C423188E7D00C6F24EA2F1E2E188C5D8BDFDF2FA85A54EF18578D01775CA82625C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 884e977d4480bf939ff600b8a24d3e7c42c362c0b5fd928c954742a0574ac2f9
MD5 da540a597273803a8fb4d7297e098975
SHA1 f15e04f9d3c2e1ddb078deb6d9204e8b53352cf2
SHA512 47ba4bb545138e09309453e85dccaccaa946c3a2849330909221fdfc80f2fd5ff362eadf1244b82be49bf1132d754ba5ce37866cd2013f2885d682aec61616f2
SSDEEP 12288:UBWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:U8Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T17AC423189E6D0082F24EA2F1E2E188C5D8BDFCF3FA85644EF1C578E01775CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 ab313fd0e29bdd452a2212eaae4dce4e8b5f7fe09c612b1093eb0d665a84b7b4
MD5 4a3683d0b925c42bd410cb31bf641bc0
SHA1 f192303e7001a2df602ef4351dc390a0c9f398a4
SHA512 105d5604da297cdf77881417cce67c2f9a9a4a9b1fb3ae7a58bfa3931b7a016635427b714340017c43369da31d989ca63037dbb3a4802c49794b4a53102a6a63
SSDEEP 12288:rKWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:rrRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T130C423188E6D04C2F24EA2F1E2E188C5D8BDFDF2FA85A54EF18578D01775CA82725C9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 b27bf52acacd77c7108ab686564e7dd7fc4c5e224dada3111fe82be2712d0bc6
MD5 78989ef4504a3c51297b3ebcdb6c49f7
SHA1 7271316738d2f6b2bd4f249ff02b61337f8a86a3
SHA512 b96784a03e0c8b2276e0a16d5922c864f578699c942925df9aee59bb006ddd3b246604ccc5f820e5007a372f7c236b82921f4e770565e73469c235cebd9a0aa4
SSDEEP 12288:EBWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:E8Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T103C423589E6D0082F24EA2F1E2E188C5D8BDFCF3FA85644EF1C578E01775CA42B2599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 51e51bf6c91644dc542543bde8f53e0dc9cfeae1eec6d00eef57739b61459efe
MD5 9aac5303d52ba79d6220df34351cfcd5
SHA1 b9a13fb3f7ab5a71065aaf1e854302a2be81cdfa
SHA512 1e8ec8cff244cfe7e2412f9c3583c4ab0d9462de8665e2a637977cdbc2d7104d27baf6d3df0cfde3d7071488a6432a65728c2e35fc25deb1deb8a6f53ba2beb6
SSDEEP 24576:Bfwvok9RX6wkyAICRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:nMnYICm+brLC2hTR9quLB
TLSH
T15335D029EBDC04E5E177923C99B3460AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3035d3f2cdc4ff3376bc76aebb8e96616c80460304fa3b6badf5d2ac9944d016
MD5 51d47275b5ac6ff7692fcf2a375231d8
SHA1 0f6c1281f0d21b57a62c60ee16e434923508e583
SHA512 38ca8a11a48796af0165455475df40670b4b93fde88de6c9032cbbfdd8ff70c0550ce585b18576408ea554b5def2517e520ec7fa3679077b27a690ee7d014d87
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Hm+brLC2hTR91:jySzP/mqrWETR9b
TLSH
T19E067C96A16801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f96b63ce5aab64ecc1b7b698623e0055a775637aa88847aa5c9b7e950c1dbebc
MD5 9fd517e0fe26f821cced55d8f855b302
SHA1 54966a2cf04dc023e2f8207be892ff8626e51075
SHA512 e0ece495f8dee0364283561dd08e748857546378160d6b1397517ccad03237c53cc4a31523e521f04662ab6afb012d48e5f2b2220c1c150f1069ec61232f6e10
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhRmlh8t0D+7y8G2G9yL0cMoThTR9PN:t47JUQj1irIhCnDHUPfF/Xm+brLC2hTd
TLSH
T15765AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b31df7ed1961e37a3bae40b62bd9090cb57b4eddcfad2524865a98e0793e4d49
MD5 7fb33a3cdaf8c84ff4251142a9a5cd7d
SHA1 5cd4a418afd94a35a48048ef44b806f9d39ec45d
SHA512 3f228be9e0fe7fdef309f6d8ab77150bc9022aa523153743b535c02766b5febaa01f695bfab1058c2de114b962e72c342448b238621480da2dd2b3b5645a12c3
SSDEEP 12288:6Nsf/WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:zeRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1A7E40119D2A801D8D06EA275C3928A81F3377C6197E1D3CB62C0F47E1F769905EEAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 6cb927240adc2babf133b58546852ce86c9fa4cb6ce8c150980c699a433dcd8d
MD5 ae075324a3ba3e1f0b783c84e5f79b7f
SHA1 0ce5484763b1d80923baa48e0435518b6508bdeb
SHA512 1b87bde229f97a3ab1ba3e099443b1e716b62f45f3a5c8bdfe9655e2875eebbb5f37a3ccec6d41d4498d83517e1bd6c95a9db76da3de9ad851fdb0a9560d4283
SSDEEP 12288:IekaU3f86VqBRZIiZUSCIUJNY+8SKD+aRMbd:IeLUP1MISuSfPaaRMb
TLSH
T10E250641766BD74FC66940361E33D1CCAB707D41EE04AB0373C99B3F95B6658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 47215bfb9957c8b99f2fc898873b3ceb8812742cca06508995e724672b4bea04
MD5 00168c4a836df7addeb59f6384f57485
SHA1 57b655ccf432a16c38fd2726440015ede3bb0b41
SHA512 d00ea9048565986cd5cc51c5a969e44d6784fceba458799eaa4ddea362ba6b34010e2992b941354a36ad12aac204e471a0d7c847706bcd51bc4e97cc1540ac56
SSDEEP 6144:PqxWfpQ96notmaV87CVYGkwLHiNafSQ5dD9tMxR9gCRi4M3rD9tMxtXh4di40C3q:C96no5G7CtLeQ5cpRi4M3sGK
TLSH
T1A065F9406537E38FC5BA603203365B8CB7A4EC16BB496F2677C8453AD86A715A0F93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0d00ddaeafd8ca984fb8457ab91612d6dd77dbed0c292aa0f1be1f9bfb42c121
MD5 dc2614589639ff277a2ec580b4ae62f7
SHA1 dc7c5f0e08e4d4d33dc5c2475e0ad6a9a9bb59bb
SHA512 0e4add369a557ec3c4a1cf34b1bc738a555a51b6e837807c6b272b06aedf22859ea90c09c5a669df5f92de7ada2e4e95a43ebb18fefeffcb0a829c5d7e796307
SSDEEP 12288:yM7XWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoO:PGRmlh8t0D+7y8G2G9yL0cMoThTR9Pyv
TLSH
T1BBD42318CB6D4482F27EA2F0A2E2C4A5A57EFDB1AF40D4CBF08175E02671CD45E35A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e6cb21e8a9fa0254e75c92d854dd5c14380b5589f45cccbb3a2140c6e9d9b04e
MD5 613f15ff245fa0d77b5ef84a3a1c59a5
SHA1 04a513e3f516afb54089452c3ef2cd428460d76e
SHA512 1963626aeb0f43179e9a30f0ce653ef70a3829568d339f3c86bab707e4f546f091f5b7c2b057e68106f6e7e9bfce98384a1edb62e6f9560a32d7e9a504610736
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYwRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:7gb4mBIBhGFhm+brLC2hTR9quLB
TLSH
T12F65AE1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9c77657b26030f52a4a9a3b5eb86844647cdaef976b412452103b5adb141b098
MD5 323fe063549d941017b034dba5203f66
SHA1 5ccc7f205d08e1a5d214920e443320fcd075ce49
SHA512 b17b4fd687abdf2ae0f61b407fd541f89a30fbc8fd7dd00dcc6ae3583e0fe7cb962047014403a021db026b253d078332b4e51955b84940c0305da2f241f69613
SSDEEP 24576:tG88u8FpJqH1bzria7/mRRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:g7ZFPqVea7/Ym+brLC2hTR9quLB
TLSH
T12835F16577E501F1D07BD138868246A3F6B2B8251364EFDF07A88A511F23AE50B3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bab5ade3183778c94147b3eb705497c8eb55ddbc4e3c403bba83f5cad4dace14
MD5 cd374844ede639b94cdd3ed061481915
SHA1 cb06ea41ece357559e766937c16e9d567cfefe20
SHA512 07ca0221b6f511ce620c0ff5a86ec0870650d26f965f97c6a0896cf9513d5bfd62f97939628b85ca026818702debba48950f4ba2bf80aeb51d1821fd1942ff08
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdm+brLC2hTR9quLB:jG05lO43bqmqrWETR9b
TLSH
T1DCD5C06E62EC01F9D1BBD17CDAC64A0BEBB23825032556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af527a56951025c56799f88b4cbab159af0f885ae7be4414e48fccbbe7cd747a
MD5 b8c0598f925cc08a94a69bd38da6f9bd
SHA1 f22db607fee1b2d7a87eb339ea3bdd2087ed8d52
SHA512 55cd464f457529ea214c1e82cf0e677fac666006035c386487444258aa7e4041d13d9300b0d6d72675a988ee3a542be8e39d41ef54a68c09440905e7c354ca86
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHRmlh8t0D+7y8G2G9yL0cMoThTRD:xa5POZ3+Jt2pasx2+mVm+brLC2hTR9qU
TLSH
T1F165AF5EA6FC01D5D1B9D17DC583861AE5B1342253319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1058e67a75d87f3d55c307e5b4f17035488159a7f629f11005b630a2be3087bf
MD5 54a3d1cf735dab0b6795979c41035180
SHA1 9a5d807b888d868388ee80eca0e84011fc5ee081
SHA512 30800833c4b8e48199a8c49d4202f49eaf5a30fcdf5d6973f3532b80cc1d81f47c3ecf4c17bd6252badb9ded17b9a1ae92fbb1abbb723348fcd1f643e6c3a497
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkJRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:/Nc/zEOVHF4m+brLC2hTR9quLB
TLSH
T19A858C1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eb343b2a1e053690ece79d6adce2335af0f3ee558099998789c339956236b590
MD5 5d6f2ae8e376af94f00be449ae9ffdd6
SHA1 3661b63a857a6406fe23a187b988e04198767826
SHA512 951f9bbfb0992c78d0013e02bde3213aebd6635b0475fdc07a9d070df23b1fc9e5569eba7cb91b1f8a7157460eab5a9e639ce3a4000240ecbf1555cccb437ab9
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmrRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+8MwBtOmrm+brLC2hTR9quLB
TLSH
T16055AF6EBAB805E4D1FEC6B5CD238512E6727861173293CF5290C13E0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 26cfaa241595e8541828efec7bad383e1335feb6f0c61f058729d964c5f59334
MD5 681d79bbf18d844962b95f8a2cb5fcbe
SHA1 7971223676548fe74aadcb9528d8864c7f5887c9
SHA512 b7b862d14411c3c964592f4d41a1b3adca0201576dfe55850d42ebc0b1d2cd151b2d5b7dfc3581f70a167931794087138a0a4a9b03528ccce2fb5e6e79c0b634
SSDEEP 24576:hPUr+NQtRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:hJQtm+brLC2hTR9quLB
TLSH
T19805E12E66AD18E5E27AE17D85828609F771B8621712D2CF02D0817E0F77DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0a78493b9b5bc492ecba4a30629d2c382868d73e6754f88ef8e5ec2ea602f79d
MD5 e9ca0d31e7d293128a24e6b25ce6e4aa
SHA1 a9d0a5bbc261fa1297517e17cbe28597daa5f2b8
SHA512 a8bbeae34e928efc28e78e25a2debb00ff15539003de61298304cccf1b91d6e17de699ccf1171ed2dabf60cd6bdd46cfb0cec350fd1650706f2aa7b9d66f230b
SSDEEP 24576:YD3FHshBIYQgA6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:YDVHeBIAA6m+brLC2hTR9quLB
TLSH
T18F25E13DEA6C04E4E57BD1BCD6A38A06E77178A9032265CB12D481B51F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1392-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1392-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-382-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1392-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-41-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2728-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2728-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2728-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2728-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2836-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2836-367-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2836-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2836-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2836-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2940-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2964-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2964-63-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2964-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2964-289-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3796-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3796-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4228-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4228-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4228-370-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4228-123-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4632-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4632-86-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4632-81-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4632-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4780-24-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4780-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4780-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4780-17-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4780-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5860-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5860-128-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5860-134-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5860-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5860-139-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5964-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5964-75-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5964-69-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5964-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6140-319-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/6140-2-0x00000000028C0000-0x0000000002927000-memory.dmp

Download

memory/6140-79-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/6140-0-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/6140-7-0x00000000028C0000-0x0000000002927000-memory.dmp

Download

memory/6140-6-0x00000000028C0000-0x0000000002927000-memory.dmp

Download