a6c75bec8316a878ce1f6be81b9392b0765b3090448f9d3fafa4a48fc9ff8239

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 3.3MB
Sample260727-pc5arsej91
SHA256 a6c75bec8316a878ce1f6be81b9392b0765b3090448f9d3fafa4a48fc9ff8239
MD5 70fd8f2e9e3cd499e5241f1e8a5d6961
SHA1 ab1bc5991c0715d579ff38410ae02c71973d032e
SHA512 963b9de9053122981072702ba5ac51857f4dee7307c59ed3bea745d83e25eec2568682665cb4be6af4b2141b7a9fa7efb62f24da061e1086bd747cc98a4ef9d0
SSDEEP 98304:OElUF3Y1kpRvpXUm1OKep8qDwY2sW2Gc:OdYQXu8qD7WA
TLSH
T199F57C2267E54076E2B307315D79B25845BDBEB05837CA1F32985E1D3FB09C2E920B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5128	elevation_service.exe
3536	elevation_service.exe
4312	maintenanceservice.exe
2488	OSE.EXE
5124	PerceptionSimulationService.exe
236	perfhost.exe
3320	ReFsDedupSvc.exe
5684	SensorDataService.exe
4152	ssh-agent.exe
3084	AgentService.exe
1224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43ade8cbe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002502932fc11ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d638786ec11ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b47a86ec11ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d86c802fc11ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc6c2730c11ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8b83c2fc11ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4372	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3084	AgentService.exe
Token: 33	1224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeDebugPrivilege	5128	elevation_service.exe
Token: SeDebugPrivilege	3536	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4372	2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2076	1224	SearchIndexer.exe	100
PID 1224 wrote to memory of 4636	1224	SearchIndexer.exe	101
PID 1224 wrote to memory of 1180	1224	SearchIndexer.exe	102
PID 1224 wrote to memory of 4704	1224	SearchIndexer.exe	103
PID 1224 wrote to memory of 2732	1224	SearchIndexer.exe	107
PID 1224 wrote to memory of 5404	1224	SearchIndexer.exe	108
PID 1224 wrote to memory of 3956	1224	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_70fd8f2e9e3cd499e5241f1e8a5d6961_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5684

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 90f9559dec34b87d00f6f7513884b92c40485a1f2b437dd004a28157ac689289
MD5 54443f1a7c1a9d175a975f3c10232f2a
SHA1 acbe5d01b47e4f3cfb08468b9d1ab7572926ef6e
SHA512 67fdd07e454257b585d34f2f9eca6bfca7358a91e707152bed6ffea71f77ea2348f1f6576cf4a80edc084c79d110bbcfcf4ceea8267a1b25362bf827c09d1a28
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnh12ah9+v:73q6sjBm2Gc
TLSH
T1EBD58D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bd9d6088ddd63295b19cc8f8f976ff79bb0909c70a710adc5baf43194f4e0c28
MD5 9a65f555aa85dcc2e50b6ce28910fe0d
SHA1 9c51a96476d0eae4e02cc3bcfa1e84ac2794427b
SHA512 f7282533cc28e3be981a338a609e878994e6f0b9a049a745c26dd9dc509bbe9b3ea04f5c6f6012a679e7e8f328098cfc05bfebae4dfef661ffdb2f21f4a68ad4
SSDEEP 12288:E1XLsswWkxy2lRq2czAs31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:CXYfDtczAI1WGA/Cj+UwA0eeEXUD6
TLSH
T144750129A3E408F9ED67813DCDA29501EA337C550760E79B03E49A7A0F333945E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e8d781d40ee10e463721122f033de2a1bef1f2dff3b1b989be0a8de1c7207548
MD5 76c76d8664036b4e5122265eb5b1b09a
SHA1 91c39d9e65acfe201a58c23ccace51543552eb4d
SHA512 c8f6c1232019ce68d08893e9c212be3b8cbfa02e6a401e2f469dbed3a9fa47a48ef19452d0f734c9d482319fb802afefc2ae7df1a1c28caa566f934d49a72dad
SSDEEP 24576:+0Le5ji0hmxxrMp1WGA/Cj+UwA0eeEXUD6:+Pji0Aj612ah9+v
TLSH
T127859E56F6748371D073C0B9C5D2A68EED7130861B308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4852e8d31f45ff8c299750b39744b31f6e9dd4cd3d0ae2cccf9ed2a6d818703
MD5 f2737697f2e1c97e4ba07bb5fcf637d5
SHA1 d57271be17f039c26ddad89d0ac549a6ccdacdae
SHA512 7b6b7b33efb73b92ba7d119899306782fb7a91e59d1b2f3f81da136af70dc88438359be07de338694091b2b445996fb383c3af425d959d6bff27448ae085a712
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWn6q8wyuX1WGA/Cj+UwA0eeEXUD6:K/ezSC6vUzPveHjye12ah9+v
TLSH
T18F755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aab1ec549e5f9324066caa8d9f919db8fb430bb2ade58a6237ff5aaff2adba64
MD5 1404e6367789b070c92da0ecb4d69c7a
SHA1 5940f43eb8a2b6aecf6f6124dce491ce74da5242
SHA512 b87300d0a4c1d8a50eb19e343f11ac448fc5867e77f55e4b40468dc245122c6779e8aae04c903ec423c15620536f471dc4190908663b960b5b27924779ab3f85
SSDEEP 24576:bVbqPb88hv/l+YU1WGA/Cj+UwA0eeEXUD6:bVO88hXl+v12ah9+v
TLSH
T1EF559E66F5B48331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3f42b79da3636b9feea89873998d2c4bcdc8fb108f93c8b1c1f4d4b9a7b58383
MD5 222619c4436dc4b2cc74e7cf391c87d1
SHA1 015186ba9bab3c84a01fed42b34549b23903d7c9
SHA512 cb3d05301d56cbf6915c80ca48db56db6cc4bae1c993296ac22e6a3abb1c016b2de6806a6f5d40a1e804b25491678978a2beaceb49446e13cee4a6db853f9be0
SSDEEP 12288:JL131WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:JLF1WGA/Cj+UwA0eeEXUD6
TLSH
T1CA5523DBC3BCB1E1FF234637AA493AD499212D843E40993666607FFE487471181A672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c5df9ac62797386cf38ec55858c06c76348fdee2f22cab66ec05b0305bb54837
MD5 ec00a52b40e7af57745eb4485d868b6a
SHA1 b145e47e2fcdb7c2d3720892fedccbcad0b8ddd7
SHA512 67785675516f9dff892ec6d197ed843fc4b2241d1572422a38ef634dacffcec2124807b066f4472afdf52ee0a43e494fea21122b41ba767df05d9c81f57d477e
SSDEEP 12288:xeBNUbTVO86UI31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:xJIU81WGA/Cj+UwA0eeEXUD6
TLSH
T1D975CF7BEE28FCE2C67A8DB95A518640D77278304F51A3CBD164830ECE235E11E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7949b7610f289192bb84ea58d77cbd791f3fd559ca015b856a6c27941e0503f9
MD5 230ab8207c3f1c7dd9ee3a31cad19aa0
SHA1 33e773cb314ccd5476fd904c7e07da83dc3221e7
SHA512 f44f02a44060ab9430b8b50de3e94f5aae2dda08f8399cd59db0fb8b9be9004c8caa6d607413cabbaec6d7c3521377b1b67f3262f3d14f77ab2cbed9fbf8690b
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:2QvGAdlCEL8c/DRNw5CV2Gc
TLSH
T19E267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 171ec9a212ab86fc93b1b1095497f7b6714bdb52bb1d9903749fb41a2ff113fc
MD5 1608dabd31aac1ac811d8ec73e567c7b
SHA1 fd03aa198ef9db597811aa002c0187fdc5c044e3
SHA512 649383952649f4c15e6c71c2dff6604504725d95ccb3ab46011c2796b894a8253f214a6c21606bfeea36b043f858ab05a3fa0c03e15cff4ed7ce6c0c81378f33
SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAje31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEf:10ewsAjq1WGA/Cj+UwA0eeEXUD6
TLSH
T10F75E031FA74E036C77B0DB21B26D716583D79204F511AC3E3A89E9E59702D22376B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ed84d25148690ecf1b4bcb49a8cf2b071e4f2dce1fa848c7aa4f7f9c8bb7875
MD5 e4ffff2e416b6da1579033dcee5772a7
SHA1 d81219290595d7c1e87a95f26625c1ddfc0b1f3e
SHA512 c1b77ee16dd20e15218439faf2a3149a65a99a08ffdec93336414c381c0308d987b32d50085df8dfb101078579a13064b221ae9f92c49144903d85a7e22f1af5
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcA:jUEtQevvqc2W1cpV2tI32c
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 612d721f77bd493f03a37b7bf9836463636fffb697397f7d195a6a8bbebd03b6
MD5 d8ad8cf380ac5ac1689f755eadf147d4
SHA1 aacd30d68b657e2a867f875ce372587ace96f1ee
SHA512 bf91a6d298907ccc1152d2b014f986360d6e1cb7a5fd4b49ca48c54b08bc818a22495ecc35c80f914cf931dc8060feca5983efc7f58ecc24fc9e8bc9773bcde0
SSDEEP 49152:tCbRquA/m2yL5zifFiV+XenmE3/zK12ah9+v:KoqHVjnmJ2Gc
TLSH
T1D4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 80ce9d81d478b2d6efe035ade7ae14b876fbe4967d1aa567496fa470fb102f6e
MD5 081e4e925362caca00855590bba6635e
SHA1 7b46658f8230847c1558f707c7735c44b1456509
SHA512 4df223eb5559b9baf8b53400fac8b58ce049ecd8f59f229b2b56d1a7d71e3ec492575c32381c6cb34431157cea91f7141eb4731984fd971671ea2491827f7974
SSDEEP 24576:vAhGL3IFoiwtA5l7S53r1WGA/Cj+UwA0eeEXUD6:vAMUFoiq5712ah9+v
TLSH
T18B35AD81E7F955D4F5B3AA7899B69170EA76BCA65E31C20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0720a4489faf52c017c209fa791c9cf1e2d448d32bca9bd8c8b85822004a9256
MD5 6bb41bb841476808cc699d36114133eb
SHA1 7bc1b34b0054a60a1b2dc37bc19410183ab34892
SHA512 a1e07b778bb7170dbba0f5d31b13896cee5a59fb3baddb7c6aead625045ee4fae877e0c1ec563af6fa227d7c9bc88f5fa20ba9dc41e2742503968904c42472fd
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+Cn31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9X:Cwu4OW+1WGA/Cj+UwA0eeEXUD6
TLSH
T10065F14A63E81CF9E9678239C6479535E7B2BC013A21DB1F1760C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5c8ab8fe9a7d9a29f02ae3f4d01c338f411721b3d081067de4db7b2c3afb6be1
MD5 5550393ce0739f9e01e3e6b5e09cbee8
SHA1 0be6385cdba172976b770b9a10b32750de21173a
SHA512 9bc529eee7b17dc66319c1ae6e73095b8700448be4c68466e62929a51ea4b8e012cfa24e77ecb92128dea1026a0fb11d3e8605b41cea3733ad1ff24b72174264
SSDEEP 12288:XeZ1IyO31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:uZuR1WGA/Cj+UwA0eeEXUD6
TLSH
T1E955128B23E871F5EA634239CD952684D7723C523B3183DF266056AA1E72BC21D39737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6f91c1361db14bcfb8efe6096037a9f72694e2906e158395854309f595df86bd
MD5 86e64277a5e3b9617cc37ff390deff55
SHA1 2b679611b0b236294ce4d4cd75407beb3b0b5e5d
SHA512 d05bb4404cadcc6620f7108ec5e6fb745bf69a51e43663acbf5ca48c86ca91ff431a4d8e7297091463c35d891382875fd9cdf34e37f1e9b90fa9528257009cc7
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:wQRQyi36YOcPbLvw2gAf+PN3S2Gc
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 361f5cb95d19a333a4d655863112a6d3e6e3eb7d64034603fb88a108085c5fe8
MD5 ddaf9816163e9dab6af7aa47d4e7727a
SHA1 7bbcbe550f239c6a0b6defa38b271d599a409c9c
SHA512 dab1ce31190e9f42506a00f3794c3d13385978405dbe8f56a049a02a2978a01e968a395e5f96a43c0b3adc68e10c07f2811552eadf462fbde1b488d3a1cd219b
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ul:9QRQyi36YOcPbLvw2gAf+PN3S2Gc
TLSH
T146667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2c868c66e00937b4e3efae25a9588db084ade4ae1ec8ba29da6b6be61959e407
MD5 0dc659405ae40e9778e9e7453218256b
SHA1 a0f99d36c4739e77259f2e34d437c92f7ac381c9
SHA512 167442939627fec9359bb19f54a6fe5f8d0acc7c2a4e11b04276bcc1fb5f51ca046544771c755626551a4b26170063b6fe6ed87bd80b1ac5eec9b3ba6b9cc2d3
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0h1WGA/Cj+UwA0eR:C68Qg55nhceWu7PNU3/612ah9+v
TLSH
T1BDB55A33B2F600A9C44DE1769F4A972196D17C718FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 727a05c725bf762cd4e17bf875504447e62aeb3e5ced98e4e59fac82aa49fe2d
MD5 7524e00d2a0a2bef7e7a33a618a95332
SHA1 449e710da4e05a5096acef60fa0c16f51a1a344c
SHA512 ea7e4a7dc26d6cfaadde912c0ce8852a7784d4bbb7c69ec077618b93cecbf3b06e192811c8aa53f880070a3db65eb9f35156d2e96c08cc093932d4b1304afccc
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99v:Xy5112gYy5azzVvt69nLKnhZ72Gc
TLSH
T171167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 959d24dce90e622ded649baea94907b710fd70eb589c9db2d68b73ec0777d963
MD5 8357c389cee80971b3e0ef85975dab18
SHA1 ca3dd150744893a95fb8385105f045f3d762fd68
SHA512 81669011aa4eb84235305b860a4f8a6165aada4ff3cbf55dc82d6e1d66fc75183a4a0e37b867ef09c8bf0cd236e75b05fe1ba29ed04ba4bf7d15060f31352fdc
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glY12ah9+v:Hu6Jmdxd2da2Gc
TLSH
T199D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 233ada9a38c873c35ac0469b30276f806aaf2c9f3cf788f82267acd1011d0544
MD5 29bb60fba3f3c8e0e699d324d4c2337d
SHA1 d66b8a9f9101baf7835448acb94ac0ab18dfce32
SHA512 15399756191a96e970445595db17eaf49e3cee3ec7fd386e84c5b0105161ae495efca596771a682c54e73cc24eb0d8d4c8600124c1d16b428db1143c5e7245f9
SSDEEP 49152:q1hpsNoJpF1A63U44CwH7R4xc12ah9+v:qmifPWRJ2Gc
TLSH
T1CBB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1b9befd75fef2ab41ee134be02754dad20146203198ee42616c2a299afee8be0
MD5 948adf69d8eba464f119b8950aa967cd
SHA1 6413a80920c16d02ab7720180006ffe669263003
SHA512 2fe2a46ec0a0b0212e7c1e6d3bc5600b5fadd97888b870089d698eca3c05cc01d43067d30d7e619db5402300ea733198ea7a6029857107939f17295b9918af90
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqR12ah9+v:25dKii61X2Gc
TLSH
T149C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3839960083135c5ef3e62877750206a1e1419dcbfe5cd593c1a666b7b924c809
MD5 e8c32e30f1e7b9884942949eff606118
SHA1 73fc845f0c4e9ea474e7ad1a3233026ee2e0c885
SHA512 adbc8e5d03bb1d5d358e15b9e7362a3a7395890d24b35c4247c1e89ef1cf1a3a1f6987b66f1ba3bd0d243a4867b57c0d49f1fb1ec4e1cdbb0e01308342c318c4
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wI12ah9+v:4X2imphN2Gc
TLSH
T17495BE13F2D900E8D05ED179C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7b515b606601d903373ea17d0e5df9dedef36fca6b78ae4c2295bf90b8566fc5
MD5 18dcfd9b88bb9b70be2d0d8d90e71f15
SHA1 30d614804f071558b963f952a7d856dd949fb183
SHA512 b3c86a796c14f4bd0fb8e14ea8ec68e1649fa023001aba19524ada6b1b878d7e1bf1d61020b25962cb9362af84ba2233a12ddbef21f47e1cc6ddf9f7ff9c18ed
SSDEEP 12288:ut31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:ut1WGA/Cj+UwA0eeEXUD6
TLSH
T11B5523CBC2BCB2E5FE134673DA0936C8D8212D863F40453A77657A7E58B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 85331c54861b4d1b3939502861aea2fd8da3e6ef1177f8c7cf43337325ea49f9
MD5 aeae6514c9517992ea224780394f7d19
SHA1 c385657a35c5d5648577d1e3eaa1a317b83a879b
SHA512 1869daedbcf2624224584d3fc3b81b6fcd073ebb6e4d7645944ac227e2fc6a8b277550462a690083c1126735691b5fc8a34b6a5c57b67fb94325092ecb25eb3f
SSDEEP 12288:bS31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:bW1WGA/Cj+UwA0eeEXUD6
TLSH
T1545523DBC2BCB6E5FE134273DA0536C8C8212D863F40853A77657ABE54B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 84d73c5f8aabc4b11a67577d8159c65b6c92fde096d98c620f95a7abd47ad22f
MD5 50dabb62f8f67800a5e1da458b93453e
SHA1 9f624cadba6186e85712e765098a87bb21bdcb62
SHA512 6241de6bf60c549940c75efb3a35d57059718c2a7d7811449f0bb856a4048bdbff371261db03dfb1afb5ee7a114ed3c04a968b5a449a327873affded4e40e839
SSDEEP 12288:Vg31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:Vk1WGA/Cj+UwA0eeEXUD6
TLSH
T14D5523CBC2BCB6E5FE134677DA0536C8C8212D863F40853A77657A7E58B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e6e0c1fa3c42050e2d6e390b63a43f41f8417b1ec0b24e663443c2039177a2fe
MD5 e8e70897614347a40dad10108481e6cb
SHA1 913a223e3c33df1f7019748d0f0224f9a233fbbe
SHA512 72191cbb505c705182a68bf81787b7af6f792f1908ffd0eaadc9c1bf9eac787dcdbeb32c97d4417da56576b6e54ced6ea2f45016457885ed9872f156154de854
SSDEEP 12288:LVz31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:h1WGA/Cj+UwA0eeEXUD6
TLSH
T14F55228B93BCB1E1FD239276CA063694D6713C953F2196AF6B103AAE0DB03111575B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 274fda766519e74bd6154d158bc1c4f20ccbe52de92d8b54cbf34c8a6393aa37
MD5 dd5b2d902a2130802bd222acbf4edd72
SHA1 3e77c0a9b40dfc584ed2398061e4c394aa7ac7a8
SHA512 729b3388380214a9458339f41b9422b24628b45b3e32d7258592a5b4559b4990a9f63b8a8e64929c85ccb859d6f7fb505024998b4c87d013127cb4af47c3a38b
SSDEEP 12288:y731WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:yj1WGA/Cj+UwA0eeEXUD6
TLSH
T1ED5523CBC2BCB2E5FE1345779A0536C8C8212D863F40453A77657ABE58B471101BAB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4efc56b6d92cce98e2e93cd850aafcb955774f91517d0dee95c7510e00459271
MD5 2addae04d98ca0cb3063bab5c7890cee
SHA1 00f5862d0539c0f1ef64619dd97acde4a859cf88
SHA512 013c1b26d6dc4c82da04979db27a4c2571f7f64283b58136a4541785950f2c8b7268f481886c23cfe9d91354f78977f061c27b866e1ae51a1881823de99e6bc3
SSDEEP 12288:4231WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:4S1WGA/Cj+UwA0eeEXUD6
TLSH
T1A55523CBC2BCB6E5FE1342779E0536C8C8212D863F40853A77657ABE54B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1c7085b0f20cad64537232638afa42e4ca895fe06a29a703c0a2da1b341d10c1
MD5 0fdfdf845cbb14093d4eaee5a2d33de3
SHA1 f8e954776c4687a6fa9ee79e460f2b48357c51c6
SHA512 0e7b8ba3b19d5dee6a7c0d3b42b44233368e280b67f1483974d02a388b817c5a3c5b21b63e01c0578cc9c110b156d7bba4b39c83280c098dfdf93a64a63d9d08
SSDEEP 12288:ga31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:gO1WGA/Cj+UwA0eeEXUD6
TLSH
T1CA5523CFC2BCB6E1FE1342779A0936C8C8212D863F40853A77657ABE54B471101A9B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 672993cb30bd5d79a68c021deaf8255d7b01b491b76e035d78cda9e7162d0243
MD5 e26fcf21a8c0546114b926afcc7b2086
SHA1 c2a6efb11a2543c0e11354bebe39ccf135396d9a
SHA512 b5466138426d5ce1f08af2731daf563ef61eb2a59c58dca85917cc4d3d93849ab3a89edd0b0bc7b95b54d3d4fc01e15591373414611883e6c272bea7b4dd23a8
SSDEEP 12288:LiZwbVzzFEoS2cPvyy31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:2ZMRzFVSO21WGA/Cj+UwA0eeEXUD6
TLSH
T188750199B3A028F4EC63823ECD159945D6B27C5A1B60C61F13B4366B5F333611C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ef201360a6f003a31a5a0e5ebeff843d5a3518f3da817cce5cbcff02c758b435
MD5 5d7ab4a2bd3617a468e04ef744586f12
SHA1 4df2129d3644e37354d5d11d917221693aed5e83
SHA512 14a5a79cc40decfb2f17b1190591f6a20c89300cbfdd0fd6eb57c14411a001e8168651f67ed9a4863ca3a6c0e5aae8195ca56818c0f153185df8596a42a9e64a
SSDEEP 12288:EZ31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:EB1WGA/Cj+UwA0eeEXUD6
TLSH
T1D55523CFC2BCB5E5FE1342779A0536C8C8202D863F40857A77657ABE58B471101AA72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6c959662cffa838d8917f6e5b6a2a2b353e8e49515e77cf4fb5582417cec1e7f
MD5 97377581cdac7f101591a78e46569074
SHA1 efbdce0b40989e93b3d5df4de9435f6a6a504b8a
SHA512 cd276efe61ce7fcf16f31ed6264b505fe22bd95b98a1583f4c660d8b51c127dd250abc90345738a309d66e3a7911b015671c23b5eb0a68a815133901a449c198
SSDEEP 12288:Nl31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:N11WGA/Cj+UwA0eeEXUD6
TLSH
T1E05523CFC2BCB6E5FE1341779A0536C8C8202D863F40957A77657ABE54B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e196484c843614a942c1ec5653ab396f3f12a2163bde868864802b89b7cfac9c
MD5 083ab904596252f84b195019d1ca998b
SHA1 21f4cc353794027bf27b6df32f4908559bcd2da9
SHA512 01e7348bfbfd41864d0088f1e2fe597fc044f8749939d312fec58a0bfb54628e7006c3cacbe06eca3d8f76cc9fa25957f89dfa61abfdf99d178995929ad4ce40
SSDEEP 12288:lyPz5L8O31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:szya1WGA/Cj+UwA0eeEXUD6
TLSH
T15465024BA3A430F9E5338239C9522A41F7717C361B208AAF2764177A1E337915E7EB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c06b71a4fa04c1cf42d5f8fbe14c058304d080b45176041c5571832ed9228523
MD5 6d6dc9802f2b144e64bfaea1a47fd026
SHA1 c33c0ebb330b0401b02fb7e9f9927ccaa4753600
SHA512 9e548160c12f6b6a54283dd17d5b5c06d6aa43f28d9857a091ff76401d55bc7f600f1b2477badd1bc4d40b4db61ea567976d062ca2583417391e43694872502f
SSDEEP 12288:1Z31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:1B1WGA/Cj+UwA0eeEXUD6
TLSH
T1615523CFC2BCB5E5FE1342779A0536C8C8202D863F40957A77657ABE58B471101AA72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f5f90185c825f74af686331e9aa71a242fa212bd3828479c0fb4beae2e911d56
MD5 66de7acb3e2b5ff985aed5c7856304e0
SHA1 7c2cbb2c7100e1bc29d8efde70d86ecdb2805f7e
SHA512 2e464afe0227cb882c51e6e48e22e9b25c500d8599a23763f8906c11db18f426128bb3c752c27d58e060f09b8e1258c3e0efff381152340fef066d6d134eb5d2
SSDEEP 12288:UZ31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:UB1WGA/Cj+UwA0eeEXUD6
TLSH
T13B5523CFC2BCB5E5FE1342779A0536C8C8202D863F40957A77657ABE58B471201AA72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 480a5fbcb54ba0de49e2ffc45e525ca73b6d9901eaa98883ca1fbf18d986bffb
MD5 58631a4e447af458d40f4101db83ec3f
SHA1 26aa011bb65ff0357872aa59ea1c4c6672fba4fe
SHA512 08e15ee16066c1897be932ff2348d37b0597c626fe4cf898138709bc76033dc14d7f7a13a30ae8fd014aee585432d13c5a80dfd36d5050495c466d8eed023f28
SSDEEP 12288:byPz5L8O31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:Wzya1WGA/Cj+UwA0eeEXUD6
TLSH
T1C565024BA3B430F9E5238239C9522A41F7717C361B208AAF2764177A1E337915E7EB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9393514e0233303eb6ea2fe7e526664017a5ff30548875eb57369447a15216ab
MD5 18de0266aa9886f0ba5bfbfdc6ed3954
SHA1 87b74f254f26984702747df8b5d41dd673f24fc2
SHA512 1308c2ae91fb7e460e5b7b74030ebe2f0386a801e8598bea3a866e68a911d708b8360dfebe1c69ccc27de9286cf3c7ba289d7208cac6ca6be9990583fd303ad3
SSDEEP 12288:ECd9CWYoaLHF3z0z04PDvhw31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9X:9TDaLl3z0zD01WGA/Cj+UwA0eeEXUD6
TLSH
T13B750299B3A028F8EC63823ECD155945D6B27C5A1B60C61F13B4366B5F333611C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 393bf2a6f1145a05686c985d4fac543ba0c67eb09c29b02f097ad614c6604203
MD5 8d2745522054b8fb40e82086532c3b63
SHA1 bba98bdd29ed8ced6cc56e74ad53ab3ee93d24bb
SHA512 af15d7a840c06a02da44b78d6ee690882292322f866ee3b4c3fec0264f46093712fc22a2351a7d433313f7d5973634c320e49f022d7243a2a78d87541a7119f3
SSDEEP 24576:T3vd9CHKy7GZw1WGA/Cj+UwA0eeEXUD6:zvd9CHKyaC12ah9+v
TLSH
T16985CF91F3E810E8F1B39A35CD665511DA767C9A1B21CE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4e311bae5681e8b5f46f3c645e1871398ad3c576d743549ae5bf9ee02a43ab62
MD5 bc19475cc6adcdde1678fa21690b85e0
SHA1 0ded7843dd4127e9423403a8cd8192c3ddf39703
SHA512 5992aaf21aede0e4e123de7881097917f0eba97b4316b1abdd59eec3d09436d2f8f4d20718c9cd6e002d590175b8416b5a51932ad15a4ee79a60074a1fd6a15f
SSDEEP 12288:aA31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:aE1WGA/Cj+UwA0eeEXUD6
TLSH
T18A5523CBC2BCB2E5FE134677DA0936C8C8212D863F40453A77657A7E58B471101AAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3ca15d4be5a16e07c2bcb55005679238b7402b305050b35f8af42a7e5a2e828b
MD5 e979becdc65ec1262ac3d876fca22648
SHA1 e56992084b5aa4fe2b11651da2488f8b0fd66921
SHA512 554891c7c63cfac7c818eb6b487fda8db638cbf1a6980e0619ff33e310b946a055485970b2436a1537a6461f3165dbe47f2c46185a892252b8a88d6edb947961
SSDEEP 12288:Cu31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:C61WGA/Cj+UwA0eeEXUD6
TLSH
T1B95523DFC2BCB6F5FE1342779A0936C4C9202D863E40853A77657ABE48B471201A672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 107634f5bbf9f0c40808ddf91371b886e931c1b4406e716b3f88ed2c9e1040bf
MD5 9689ce965d40932f5e36c10e4f823ba9
SHA1 cd868fafb29e2970fcabdcc733c5180876aff283
SHA512 8924a95ac8f541ca8f7f997f7aefea0d6013334fff06cf2da227cb42a1ddb1d82843a83db6181015c43e645e97ac226c3aa0a7f5675f06e39d04f72ce3b7950b
SSDEEP 12288:vv31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:vP1WGA/Cj+UwA0eeEXUD6
TLSH
T1905523CBC2BCB6E5FE134577DA0936C8C8202D863F41853B77657ABE58B471101AA62F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f9f7c0330301bb1dfe1c94817b9ccd510f550782a7c2f237da66b20b03e853df
MD5 8cca45053e8a92770f4be179ac686616
SHA1 bc13d744102b3c65ec3aba00d51f49972684c5bc
SHA512 5b8c1ee62f647891520c872f29b270fe96351d8a860e9c0e9113ecf9702b4212dde24322670d387bea9501744608c3f25da7097c19a8a7ead49877fdbafcffad
SSDEEP 12288:lZ31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:lB1WGA/Cj+UwA0eeEXUD6
TLSH
T1FE5523CFC2BCB6E5FE1345779A0536C8C8202D863F40857A77657ABE58B471101AA72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e7785bd0a4492e337b2b9ec22f740ca6940e91156ea81dd074281d47456f4bfd
MD5 3df9db41396610e53b2ecaa332bc1517
SHA1 3bad656e599eff9b38998d1ca68268d112574fb9
SHA512 ddb2efb7239f69a8e74e409152cae8cdcfbefcf7c9dd57360710320ba58236952e20ed1943e5e882b1f0927fb9a0c0c62bcd5b1528ccd74dd45663711d180808
SSDEEP 12288:jA31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:jE1WGA/Cj+UwA0eeEXUD6
TLSH
T1EC5523CBC2BCB6E5FE1346779A0536C8C8212D863F40853A77657A7E58B471101BAB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 24ffcce447ac30de49a546a4655609f58dfca7a6677b7d3d0661e2185b881218
MD5 d52099262520c55930686bcef07b4f47
SHA1 ae666a41ec6e2a926c31848004fc8dc63d025267
SHA512 642f906c9b32757413ccb4a0b1ca02037f0a23d4628f962daf5a34addb89a5af630e0a011649f1fa01e6d7eda1b5199f86bbcea8a5c938a4a7929e3201ed4d59
SSDEEP 12288:EB31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:E51WGA/Cj+UwA0eeEXUD6
TLSH
T1845523CFC6BCB6E5FE134277DE0536C4C8202D853E41853A77657ABE58B471201AAA2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0352ec2056051eb2a33140b47588bd5f5dea97a22893973eba2d425447b6ed9d
MD5 e2513dcb9470829ca3f188be68c04a66
SHA1 32e766965bef473124b547a2036a1d3eabc5167e
SHA512 e4c11a542eb5b0596a6f3a7c7dcf8a407180d65aeddd1202f948caf4b06c4df88c12244488c0a8392dae8b69a1d50f844b0f34a56e4193a23258ae63c26fb076
SSDEEP 12288:C731WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:Cj1WGA/Cj+UwA0eeEXUD6
TLSH
T19A5523CBC2BCB2E5FE134677DA0536C8C8212D863F40853A77657A7E58B471101AAB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 4e31719b0ea5c05da6254ff72aa4751baf1b96865da54f6c0bab061a2314df5f
MD5 c6da7e937e8551213fa10829a223b368
SHA1 94a3161b3766fee80f263207c6bdee45c1d844b0
SHA512 cfcd51e18500cd09b4476ae7fd3601d860b13175e8f722f0486dc6d0e04aabb89909c11f25e4b8971a1afd56f7da14cdf740512d49522befbbf39a0b3623ea65
SSDEEP 12288:u431WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:us1WGA/Cj+UwA0eeEXUD6
TLSH
T1C25523CFC6BCB6E5FE134677DE0536C4C8202D853E41853A77657ABE48B471201AAA2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 eebfa445897045c9d3b8a1991cd987b9e0e1a6c115d5f879068c558746583e10
MD5 de4723d6a4b93e0b49116c234650354a
SHA1 42bec78f71e073053efd377cb9971cde1b32610c
SHA512 cae0baf9c5d69d5eed34ce2b17b2c17bef49d701f9d52a08e6f2237abc84fbf32269d5c75b1a8f5bf338f4dc5e6aea8a9d925aefd4bb32f4dafc7477a093d5f7
SSDEEP 12288:9731WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:9j1WGA/Cj+UwA0eeEXUD6
TLSH
T1975523CBC2BCB2E5FE1346779A0536C8C8212D863F40853A77657A7E58B471101BAB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 aef01c7c15492a937ab3a8c869f219770dfa6ae403e1d4348c03ba45933cb8a3
MD5 912bf1bd15046145b7567164fb8c68fe
SHA1 8fb2411d91cdb76987b3ac1e6559af2ec14402a7
SHA512 113ee00547eec563d96469b65a762a3522325d6afdb489c4bf58c936793c83925f137ec11832c302d2e6dde89ba9e6750f13cd804b371840ddde75a22453843d
SSDEEP 24576:0fwvUk9RX6wkyAIl1WGA/Cj+UwA0eeEXUD6:QMnYIl12ah9+v
TLSH
T1CD85D029EBDC44E5E177923C8DA7460AF6B178591B31C2CF129A53AE0E33ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fc233b3add47dab103bece424eccf192a42bc4acb467c97bdc423c003d57d2ac
MD5 6e08d3eedc85bad934f20c3698136580
SHA1 b368e26a10930bb8ac0234ed961e6cfec5903b21
SHA512 f5b41f9c114f50dcb9899534febe01402f2bb9e12dcb5022e006a31d0c69b667c9efaac74f4df642c5d3b70693b66558c9c05adbdf99e78611bd28988b4b3599
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0o12ah9+v:RySzPy2Gc
TLSH
T124066C96A1A841D5C1B9C1B98F0BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1fec29b889a6c6a9ecbaae7e703bd7d06fada9a0fc7d3f1f1341027fe6740baa
MD5 876abc598fd3febe536c6a3e20cf946a
SHA1 beb0ed2bbdc220a1409ebdaede00e929098145ae
SHA512 800f0f4de7c539b18cf7ec41c125712207ad37f1715f3414766dd431dea6fd6a387428f063df07b074917db5df460df73cf32bfc2704a435de50ef4df236b272
SSDEEP 24576:847Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYm1WGA/Cj+UwA0eeEXUD6:847JUQjTirIhCnDHUPfF/Y12ah9+v
TLSH
T1E365AE1EA3EC01E5E1BA927885155A5AEA71782E1F31CACF2270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ead28c9ae1f636894f0e7195533e42bc7b0ad3d7df2b042fedcc4849094f4c4a
MD5 7d8e3b94220c13adc135d1972c9a6d6d
SHA1 2e4d0716b4e1e342034e9cea7e5d6df5f2b787c4
SHA512 8a652302ed7ab3b0e4d77b8f29237a2127c77f517dead91937facfbec69faaf6c9a5e038df24927e42dfcd5a6274562393219dc11ec938a6afe35e9199e3d56f
SSDEEP 12288:1bsfp31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:QR1WGA/Cj+UwA0eeEXUD6
TLSH
T1F665F04AC2A812E8D42E6236CB465A80B3333C6567E1D3CB62D0F57E0F756905DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 944KB
SHA256 320f23de28bbaa367aa549f7cb82c05d226c58dde65fa6aa170c306ced5587c2
MD5 63a4d0aad34277b682c05c61d5d75f0d
SHA1 4f48c2a97fee00022a6c1d4efee051d909625830
SHA512 ddef623584c9bb4d3593f60b5527180d92eb915ef27ff31eeb28581914ada8009ad3e5692672a4a3f91cd1d03fca6b9f218ac18a37c911858e11d8b588787f35
SSDEEP 12288:jgF5+qU3fB3BjPTgP04r6PSs8MarOO3YA:jgH1UPsSSrMarjIA
TLSH
T12E250610766BD75FC6A940321E73C2CCAB707D42FE059B0372C8472FD576669BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 317KB
SHA256 dd7e6769d02626ed2650e62940b14404e7437b613129470ecaaae4c09c640c79
MD5 9144f532332b3afb2671a1a10dc48641
SHA1 b3915f675ce691c6f5a5afd54a85f312798f2c1e
SHA512 41fee1294b81f98f274b4e290312aeb078080b7138af582812de6f373049492753d60eade13e88b8c524f84582ce6548d793ef1e515c675000bfaf6570c0d84a
SSDEEP 768:2/TBZlToOlTPBlTz2+EQMTA/TSLZlldllCZlToOlTPBlTz2+EQMHLZlldll69t9L:F5fJ3HfJcKfJwfJWWRdmq
TLSH
T128648311B754F329C4BA417648B2D69BAB7DF0228F5343033BC91A9DDCF2296367AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v32.cab

Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32.cab
Size 12KB
SHA256 9371a57cde6e2ba0c69dce60e25f12d2b429833675aaf9218410ed1d1fa601f7
MD5 87298d8481e5f0e373c415496b0c49af
SHA1 caba0bf1c6ee76d49966550a3deebce32f914aad
SHA512 45e88cdc8149038800a2496c5af0b11a846d604a538a3f8f0f753fd783b9aa20d651f733fcd4ce70133ad0ec6ce991e21f84f3e19169b06bbb6fedff82e70128
SSDEEP 192:rvoMqInsaepca8LxyQxh4FYqwN5d9GMsc+6UQ/X01k9z3ANXJaP:5x8pcaGAEh4FYVN5Lrj/R9zcJq
TLSH
T1FB425AD14E6CA483EE9BBDB09298E9933D7C83D30D80896729D8FA5409D37C1E31913E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionDescriptor.xml

Path C:\Users\Admin\AppData\Local\Temp\OfficeC2R0A0B8D20-31EB-443A-A05F-B5B6F362A91D\VersionDescriptor.xml
Size 26KB
SHA256 d3d9a170389d417e1d85c8693fec252f0bb4e2a191a54c98e759558f750f0a58
MD5 658469a7ca531643c60e9a81ff504199
SHA1 926892dd6f59c7a108fd34e92599119e75ee4087
SHA512 4cc44c34dbd207521dfa40bdaedee551f5d6e2056bd5c972610fbc58233fa2d4ab183d8ba5497f74269d0fc9668462b6bcc64afbfaedf829b20501cf6438efb8
SSDEEP 96:KcrBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJVK:KcF/rZ7CU
TLSH
T126C2356BB8D03D1D413477A7E96336E2EF62826396050458F10D734B3FB285DB3AB629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1fa1e1c05ea80c0f63f78440d11a5b8141d28476fd08bbe10098b3599de0c5e8
MD5 fd7b63057841120c689dd2eceec9a6b9
SHA1 907a39b0fc26d099a4f40107b7451a869dcb3044
SHA512 d295aa3f57ff8681fde6a97ad274cf5f3090b71ca4fbc0596b31b305d7c6ab34fa7bef2b06cdecd138e75672e894ec2c4cd0c0388da4e41e0394dc35f91f670b
SSDEEP 12288:Rz7R31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:JJ1WGA/Cj+UwA0eeEXUD6
TLSH
T16955239BC3BCB6E1FD3352729A0A72A499213D943F0085E7B61437AE5870B4149B5B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a1d99dbfbf70ceae4f75668663ef3bb9ec3e6f86e076c1fdf14e4d672fca44fc
MD5 437a4e8815cafddc49e15aaadb9825e7
SHA1 13fe025f5f088177a039bb2c4876ffedf771a3a7
SHA512 d0b01cc96eaf9908b3c6b16de19314d4883843e0d9f834bc996eb764def1642e3d7254e3be33f13f0e75bafd86b0ff9c625daf00c2620cbc49732d37061e92d9
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYX1WGA/Cj+UwA0eeEXUD6:ygb4mBIBhGFm12ah9+v
TLSH
T1C465AE1E22EC02F5E0F6D2B88DAA4417D6B278161731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3255b44c34a1ef6db1b2cbb3e62cf7217397910dae4d34ef390e5b460103f63c
MD5 685ba0994e99f2e6897d9c728cf71b7c
SHA1 bac089a264d400b8bd0f702f00a6806d329522c0
SHA512 e94602a747f0fb9245e1f160e2759d628955c730ce70b3d7db4d8224f55e50fa6a33a6a1f339c7bc23176e99132699da60e08b89f89705bf7f8965bca74ea923
SSDEEP 24576:rG88u8FpJqH1bzria7/m21WGA/Cj+UwA0eeEXUD6:q7ZFPqVea7/v12ah9+v
TLSH
T1D185F166A7E401F0D477D1388A4646A3F6B2B8251360EFDF07A88B551F23BD10B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 077c7aa747e4b79ea4c5775182c0cda18cd2ed60f65dadd6181d624c89c90b14
MD5 b61e58cb03b16090a0140bcf186a8314
SHA1 a491f16a703d020cd4d8691acbb5416ed700b96b
SHA512 b9c2710b71d00968e8d444edc6b0761d325e139722bbab6a3a517dd95341d9cc8f5aef4aa77b278cb32ab36ca9b49283abf8cd06cd4f186a003ac9dd2fe94fc9
SSDEEP 12288:ZHvUrBFrEjwaQm31WdmnAomCut2p+lvoarCgBXQwA0sblT+NEXX/V9sD6:ZPUr+NQC1WGA/Cj+UwA0eeEXUD6
TLSH
T13A65F12F62EC28E5E677A17D89425709E77178621711D2DF02E0817E0E73EE8AC3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf84453899310104ff1b533cfe2a0b5732bb5dd4aae448a95ff595977fb11ae3
MD5 c87473092936bdb2286f26e3b22a15a6
SHA1 f76288e14e188c36eb16a69882a80dca591ca88e
SHA512 78871aab512ce9477786fe57722593356185d5f8853613fd0d44835a06ccbe9ee19a5119105062f16941e2a786e6fd436cd7c649836f62410d313151918eaa28
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjS12ah9+v:eG05lO43bz2Gc
TLSH
T1CDD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c98e5866a394d0f6672ed07c5e9e135b94c84b32c7821850cd8456de26043712
MD5 38cfb5dfa93c7aa83c1cf7ea4177e7b4
SHA1 f41bd3454b566dacf65e5157ca6e5ad1d141beed
SHA512 6740eddd402ece6abfd8336b07a08460e72dec3f9de583a1ae4e1eef55fa770f58236b2f52421409bf965907f02d8678c53e0837bb9c6b5c0b3579c0008a126a
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidno1WGA/Cj+UwA0eeEXUD6:+a5POZ3BJt2pasx2+m612ah9+v
TLSH
T17265BF5EA7FC01D5E57AD17DC583461AE5B1342213319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e85bf74f8507be548774011bc080e49bc414dd6f0b4ce12491652fe8fc7defa2
MD5 9b07cb21b3056df211083676c1498953
SHA1 ac65afb2999c234859377ebbd4306c93fdb217ef
SHA512 50bae2fd1f8b1b9704b3aac21201827f5cec7c8ebbfb2aed498b6fa53b2ccf717c94b5ff6f238bb8045aa879f2caa9bc59f3730ab7b75f0dfb9a3714cf27cdaa
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7Fke1WGA/Cj+UwA0eeEXUD6:NNc/zEOVHFP12ah9+v
TLSH
T16E858C2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a78d7f24627a5a183b498fa471dc454b298a38699a910915c526dab40ab96867
MD5 d5677ef959a35a57c113237b6fe4b7c6
SHA1 62baa9b93411ff6bc937491badb9440c4d7c0a57
SHA512 2d571f00f519071870b77103592ed881916ac0994a2c0077fee60bfc5a8b36204e3c6c1f1b2625a23b612ef4eef13110dd0e8c978ba7eb657889cc29f8143772
SSDEEP 24576:/TkNvNnaFeYhJNtmZBms1WGA/Cj+UwA0eeEXUD6:/TMwBtOms12ah9+v
TLSH
T17D55BF6EA6F806E4D1FAC6B5CD238512EA727861173293CB5390C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4d58ce34980371c6d414f012428fb5a3df58e5e75d366a3fc34a745ea0803aac
MD5 85620b34d1cec97c291cb9a1d1e41f60
SHA1 b6fce949a89ec89b3cf3b515b678a44c2b2067f1
SHA512 03872d4d62e65f2296c98f9a53e82cfe0b248fb8b862831ccd6feac5771359478d083cdfdb903f73580672f70a0a73e3b4793f385407c6527b4217b6a2807251
SSDEEP 24576:6D3FHshBIYQgAN1WGA/Cj+UwA0eeEXUD6:6DVHeBIAAN12ah9+v
TLSH
T18C75E17EE7AC04E4E57BC1BCCA534A06E77138A9032156DB12D491BA1F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-93-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/236-94-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/236-380-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/236-99-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1224-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1224-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1224-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1224-166-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2488-76-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2488-309-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2488-70-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2488-77-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3084-153-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3084-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3084-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3084-149-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3084-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3320-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3320-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3320-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-405-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3320-407-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3536-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3536-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3536-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3536-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3536-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4152-131-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4152-129-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4152-385-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4152-137-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4312-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4312-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4312-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4312-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4312-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4372-329-0x0000000000400000-0x0000000000752000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x0000000000752000-memory.dmp

Download

memory/4372-103-0x0000000000400000-0x0000000000752000-memory.dmp

Download

memory/4372-1-0x0000000000E20000-0x0000000000E86000-memory.dmp

Download

memory/4372-8-0x0000000000E20000-0x0000000000E86000-memory.dmp

Download

memory/5124-89-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5124-334-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5124-83-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5124-81-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5128-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5128-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5128-22-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5128-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5684-381-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5684-383-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-123-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5684-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download