de49251691dca38b4f297599c3d5e0ceb176278cc500df0c3d07dcbe973ad5cc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Size 1.6MB
Sample260729-v17npaydld
SHA256 de49251691dca38b4f297599c3d5e0ceb176278cc500df0c3d07dcbe973ad5cc
MD5 8b37a0ca8160003b148bbb498035d3ef
SHA1 4ad5af8c7cbd2f0554ea98292b975e9ab096ac7e
SHA512 0609f0fdeaff1b79b86ef57e58be96d37e1e0a15cdf25aa930adedf39f5ea11bdb2182cdb0db34f9da6b3e9e7ea2992468cdffcb065dff177bba978060c40a9e
SSDEEP 24576:vjEt0EdZywJBFRAQntxdRvzkSHCytY4eWLiSEk2DhPIhhb4GTt6AUpkgAH:vnEdzHtxdRvVl2DhPmhb4GTt6nCg
TLSH
T1CE85B02037C68536F6B211726E7C966B543DBD620F3281CF62D88A5E6970DC21E37B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4244	elevation_service.exe
1092	elevation_service.exe
4736	maintenanceservice.exe
5104	OSE.EXE
52	PerceptionSimulationService.exe
4436	perfhost.exe
2632	ReFsDedupSvc.exe
2688	SensorDataService.exe
3684	ssh-agent.exe
4708	AgentService.exe
2692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e6b1135ee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000090124ab87f1fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000630da604801fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d8e2cba7f1fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010b55bb67f1fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe
1092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1652	2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	4244	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4708	AgentService.exe
Token: 33	2692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2632	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2632	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4244	elevation_service.exe
Token: SeDebugPrivilege	1092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4652	2692	SearchIndexer.exe	100
PID 2692 wrote to memory of 5248	2692	SearchIndexer.exe	101
PID 2692 wrote to memory of 1296	2692	SearchIndexer.exe	102
PID 2692 wrote to memory of 1672	2692	SearchIndexer.exe	103
PID 2692 wrote to memory of 4676	2692	SearchIndexer.exe	105
PID 2692 wrote to memory of 1504	2692	SearchIndexer.exe	106
PID 2692 wrote to memory of 2496	2692	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_8b37a0ca8160003b148bbb498035d3ef_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:52

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 72f1b48e129abe7e2f28822be72465ae5368df8d6480a64ae7a0613ad646e7d3
MD5 1786cd11777c0c136141f32701f674cd
SHA1 34b32434756cfba05cdfada07f70add4cdf954f8
SHA512 96e701e561d21880e38aa50e1426f0ce60e13092fa318e2850692463f3c0909c0f80daf905fe3e96983d91ef5a98b78b2710cc41b8f707040565eab1f27d4e07
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxPmhb4GTt6nCg:63q6sjBAPmhMGTt6Cg
TLSH
T18AD58D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B7562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3743a14cc73a1dddf20c6ac909765bf3d3d6ec490745e991d5224d9657086a4e
MD5 69bf06525c69e8137f5e976eb703c5cd
SHA1 53015cf8c71b3bd5a4f3771245d1dad743ea5f78
SHA512 2198df4a6da4a061c2847e56c8d118ab2d511b245dd802aed973702f5ace25115270f403dd5dfb31933c23d66e74b1765511d3688473fec1232f53b2843e8850
SSDEEP 12288:j1XLsswWkxy2lRq2czAhG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:5XYfDtczAUPIhhb4GTt6AUpkgAH
TLSH
T11F05F12873E508F9ED67817CDDA18506EA73784147A0E78F03A4DA6A2F336D45E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 59a548e3a8ac76a2e9e0c5ca7a329efc6bc6ed8cd777cbe9c46cfbf52e90cfcc
MD5 6e0807a226b756509c86e6e8376bd577
SHA1 e4d2b4e2c5c3b49cc4f3206cb2e0cedcd575484f
SHA512 39742610f298be5893f41c41b2ff24f71a4ee1de694e50180b8d309aefca1949ca1bbfa9cc8ffb93c6988adb51f90086ace74d497eabd0aa20c6f523d45db9df
SSDEEP 24576:c0Le5ji0hmxxrMZPIhhb4GTt6AUpkgAH:cPji0AjaPmhb4GTt6nCg
TLSH
T1D0359E16F6748735D073C0B9C5D2A68EED7130825B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6fffff7d6a9ecf604b9b1ce9b0ab6e4425bcbfea56f5163687e869d505f6fd80
MD5 e28d4046851c7c4b8a239e91358b550d
SHA1 de1a89cb38a04e82334dfeac71f753711d55265e
SHA512 25a42ad063348a91d1433008d3e3a40f4ef1092fc0f39af40443f29305300a53cac72f79d2cda03ef72ee92937db551e3a7508781d15be9de919e617c436dd20
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyuLPIhhb4GTt6AUpkgAH:A/ezSC6vUzPveHjy+Pmhb4GTt6nCg
TLSH
T190755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2bce8df217ce41374ab55146c706f67067c6d30e2df85bffe7076d35984225cf
MD5 b20afcf50f642ebf8ead2625d41b5e0d
SHA1 6aabcb05d4cf4d6a6eb35ef1efda45907c4d397b
SHA512 beab42f0286576ade42cfe0685df8c6e1ac0d7c306a263b65ce5a01bcab1faa8d24a833101f51101519a21d223e44026fea25191776f186d62ef37418681f0af
SSDEEP 24576:hVbqPb88hv/l+YwPIhhb4GTt6AUpkgAH:hVO88hXl+DPmhb4GTt6nCg
TLSH
T1FA559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 edf723cba0de7920a1c8617fbd71a915fdf3abed73febaa1aafd63a93789ed78
MD5 dc4258d7ba3731ee95d6770bc11bacc5
SHA1 5c3c9ee226956764a0b02105da3dc4508f995382
SHA512 a2ec545a39be3052ee8a5e2ff1332d7f1cd6e17e558e797c48f28135c36cf0977dd7fdfcea99024ca9f662498c8939ee7cafdccafed657e7900eefabf4b49964
SSDEEP 12288:RLIG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:RL1PIhhb4GTt6AUpkgAH
TLSH
T1A8C4232A615A84F3D33905747B88654BCDA56C4018C7E35FA458FFBF32B8C92EAB2447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9da44a4057853dffe6a75efa9e5cd2d5eb7cf439b5bc2e783301367b7ddf1dde
MD5 f9fc2e3cb753d710fa88698364507b5f
SHA1 a0738d91ff90f7e165b62799788eeeb53aeed0bd
SHA512 1982c61ce54d8591fad18e998c064a93f6669d8e997e503d9063aea6fd554b8d9c840f7b730cabd9fc0d276c3267dd97093e615b9e73eb957c07d35802179a18
SSDEEP 12288:TeBNUbTVO86UNG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:TJIU4PIhhb4GTt6AUpkgAH
TLSH
T1F505CF3BAE28FCE2C27A4DB86B918640D77278704B52A3CBD164C34EDE235E15E75C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fa4da8b740684015b5595911e94a2fb00aae6bbdf7c34ccd5d03a50e4fc2b110
MD5 274f12e105619981aee7fd6bafa502ae
SHA1 55ea919a5a32b3782966e4133d7aa11bb095c586
SHA512 2ad741a9c7fda41d3bc7e0ba135665424a136555416c79a2bf63db2ae01143c53ae68aded53f1133ea3d59d29dca3a70778ee2fc2928de084e5bb157ecd61edd
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:DQvGAdlCEL8c/DRNw5C7PmhMGTt6Cg
TLSH
T1D8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f38216b31435749868bd82d0aa7caee1e16bcd7f3fc191fb84cb478b2aeebaa4
MD5 ff442356bcecb500105fe3d8efb3e451
SHA1 1c0049c17802578df26c1081dfbd1712f23d775e
SHA512 ea3af09e23721215c90be397066d9c2f4b206b8c19e52c1eff370cf17e58abb3ef4616c6afad9ddc6adf5e782a4dc8c3dbc795dcf943aed741b5754a1d735af9
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjzG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfp:E0ewsAjKPIhhb4GTt6AUpkgAH
TLSH
T1FA15E031FA74E032C37F0DB12B25C716587C79204B921AC3E3A89E9E69706D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 466b9b2406d1d5d855cbffa7bbc10decaa3d40f5b422f96bc23e8003e3fd28c8
MD5 f18ea1b35248c0316ac8c04b7738b907
SHA1 2722155ae74a271d3d1a1c807b261ad05ae9190c
SHA512 3cbcf442b70fb86eebcdf6b3799a7c7eaac38c3081636cdcab4c404372d5a2d778cc5e0e81f0d6a84813cb82d8e537cfc2408770a0411fde7c15002d8ba49974
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHCPmh7Q:DUEtQevvqc2W1cpV2tI328eQ
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 54a2bd5f03f4eb5814915092269ce0ef290ffecd27679e2930f10b6bbdaa0656
MD5 da3303fd225d48e6cb632fd30118bcff
SHA1 1a49be520645338dddc472b2ed8994477c3d0a92
SHA512 77480c2ed8238d49a3e3c9a2503861620de6ef1dc0415783ebcc7540f77180e48413f5ff81b8f093092688f29c0577cb1e31ac551cf67ada817d96730a777a76
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zqPmhb4GTt6nCg:XoquVjnmfPmhMGTt6Cg
TLSH
T12FD58D0976B8C2E4D1F6C37896A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 af7cdb2a737ca7254d86a832e6fea1efe671955468f67b9a9e734b18f52f56f2
MD5 9e2d2683b0312a51dd24c1f58a8fbe0a
SHA1 ecc2aff542212f7788c6ecc0a02bf9d16e2c1d7f
SHA512 acaadb37711648a849841798efe5e3aaf71445fcf5f33e57242981893234f12bcf8b6127d59e6305973b9b763da77194ce127d6772553736d82ae2a8b84a9b8c
SSDEEP 24576:DAhGL3IFoiwtA5l7S53/PIhhb4GTt6AUpkgAH:DAMUFoiq5PPmhb4GTt6nCg
TLSH
T1BE35AD81E7F945D4F5B3AAB8A9B68171EA76BCA55E31C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e519811d298b24e777120aba58337b4ae94c933d1c09f3f859f3afa7ee73f033
MD5 d6f2422bba1daa5c5985acc30048ef3b
SHA1 5ef2094f9f197c733b845cb5353a1c8e7ac99711
SHA512 f2214dba482262ffbe9f5f00b1e7174447b9bc6ab063eedc0d3745ec2f609e52ef32e4d067b2516678b19dcfb39039f9b1779a1cc62b0d45ed2a4a15208633b9
SSDEEP 12288:Wmw5HEjsChNVBFgl0WDm+CaG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/g2:Pwu4OWePIhhb4GTt6AUpkgAH
TLSH
T15A05F14A72A50CF9E56742388687C136EBF2BC012A61D71F1760C75B6F37661BE2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6bef6fdc7bb323624d568a358eed1e2189f4197eded7b84866428a441490aeb9
MD5 bad5eeb59742a3545a32d930535602a3
SHA1 a877ed53967f4da5f4888908818bc4fcb2c0ea4f
SHA512 3fa348873f8b40489b7e3a1e6d8f71eecdd96c2d002d775d606164dfd2e5fbdeb25750eb31b4c01f347524897e915b175b61601b64ffab392706523cfe9f7d3c
SSDEEP 12288:YeZ1IyjG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:JZuhPIhhb4GTt6AUpkgAH
TLSH
T19CE4125A32E460F6D2670278E9E4560ACB7278412772C3CF156497AE3F73EC29E36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d7d81b41940e34fe93b3d8b734ecf1eae674c89ce9a09df6c4c3ee8f7d5502c8
MD5 b7cebc315e00d882252bab925eda96d5
SHA1 f7a096b3b2c8c19da72f8415b5107a9d27fcdda2
SHA512 58b0b8ccfc29b1113a95b3cb70ef7e1487133c0ecb0d5ca65a116a58502d9a856b079dcc15e40d12fb1ae40ac192d0485082aa734050cacd3f3b3dfd0e21451e
SSDEEP 98304:DQRQyi36YOcPbLvw2gAf+PN38PmhMGTt6Cg:SQyiKa/X+PNMPmh7Q
TLSH
T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e70ec94a68e0d824f9ddc974cd182d91b06dcc87bf0a91991f8695fbc30a2a8d
MD5 541c7dfda011dfe24e6215fb8f20a874
SHA1 d024b170284ff293f18eef1655cf6aef55f1d90c
SHA512 1305c971e8e5727dfaecbf3e876460dd3ca0d31fcd9ea117b321b0fd6103cee0db4e66d638d9ecfb14af78c5081efab0a25f23e1c7a5255b73b20d1a6def0c6f
SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN38PmhMGTt6Cg:LQyiKa/X+PNMPmh7Q
TLSH
T1EC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c33dbb371c08c7a08c7c477c0e4eb2e956259058c77479304227aa59ba3ce1e6
MD5 b9d576f5c2738c14d9ec9c3e2662365e
SHA1 bdf557604f49743d5c57e096f61a5f554edbe812
SHA512 c8421deca1b3f3b44748c3ff998b73c7180b03a99824074b1e0e67f2a700c1aab15a531f209add1983fd60a42948da1d35fd14b8bd35532764825005c0ca01f1
SSDEEP 49152:y68Qg55nhceWu7PNU3/aPmhb4GTt6nCg:wthLRc/aPmhMGTt6Cg
TLSH
T195B55A33B2F600A9C04DE1769F4A872196D17C718FE1E3DB8515731A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4bcbb80af35afdb95d157123f8fd31531ecf51f4da3d24819edf0ce17e2b986c
MD5 b0f1fe002781f5cdf8977cc06cbf6005
SHA1 9ef0bd19bf28bcc09518c6da23e22ddbf73bbc7a
SHA512 480c4c8e7cf4af1760487cfcc55aa0e4b5d021296a20b6ff92bbe11c966c9dbbeb12bc64935a0b5329bf9a70691ea8c8a87cf2e7482ed734bbad805f85122d09
SSDEEP 98304:py5112gYy5azzVvt69nLKnhZ1PmhMGTt6Cg:ELIHEWh3Pmh7Q
TLSH
T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e9faff94772b85ae74d838f343d3fe284c8adfca9f577ffd880966aed88ea3ed
MD5 4a182dad01782d525b10f13bdc4dcd71
SHA1 1197d40a73f47e776a760adbc550011e7cb16849
SHA512 ac0330448076da0545be9d94fa62666c0a1dc9b6b87538c61cddda7820f4f3c4bf0539b42b5dcb7fbf16e4b5a659912f6766c14e2c0dd7fdf33e14c30e0dbfb6
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxPmhb4GTt6nCg:eu6Jmdxd2dxPmhMGTt6Cg
TLSH
T13BD59E13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 12e1e9d51c37aa2257962f9493b63bb773f7b4cd2b896a8ee5b4c2391501c21d
MD5 8c99f52f428886dc992a23ca9498b231
SHA1 e3b926ef029fd81c532a8ad832d4eedfc39f0d91
SHA512 7a472d47a915f740c6827b9f1fd9809eed5167dc88037b37b946895f610b7d154f2da11efd887b792ef72af56a99d0619d7baee8294133941e51eb5c8219b3de
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4xYPmhb4GTt6nCg:cmifPWRfPmhMGTt6Cg
TLSH
T1E7B5BE13F2D900E8D06DD17887569232EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6f2b3cd4297fca43ef081beffdd8ff818ca31b9bcd4317abf5903e7f20476058
MD5 b467e0185ec57778f6e51b23a7f4a55c
SHA1 5708e5609ccadf30780b4b60926b9b7b5b7cd8b7
SHA512 2872cdf4c0cb066dd8781a4a39b01b18b277f8d4de106f0d24be4f3636a4dc45430990d037b7a9501b1283542b747b23d6815b053835fbf3eebdb73ffb014608
SSDEEP 49152:tSuZQIY0Be2KcRVtOnks6NMHqhPmhb4GTt6nCg:j5dKii61hPmhMGTt6Cg
TLSH
T1C1C5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 57cbf6498e9866667e980a12339e48c7eee578b2d734722cf90ccc73724ea917
MD5 3827a7f68909bfbe4df4910e082947c5
SHA1 521b45262e0bb294919c47363351095e2b6da82b
SHA512 0bf5e37a8eaaf4d76a179564a3242824d62eea7962cda8c8507aaa9da5906886091b9eb359eed956618a4ec4db172ab96c3041487fe714d1d811e1ca6c3385ee
SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5wUPmhb4GTt6nCg:QX2imphzPmhMGTt6Cg
TLSH
T11195BE13F2D900E8D06ED178C7468632E962BC150B35A6EF0A90B7562F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5a1e01238825a9ab6b110e2e9549178d98255a0cbdc8300e11a7f64a865f4751
MD5 1e09f5e2aeed1087c330407379d8e052
SHA1 376b01603489d85d9f038976c05c4393be9e230a
SHA512 1288853724e28b8b5d918112c6511784a26e764b8d24417b382f983595410aa595f2e810588e7e02726c267e69c92d4fa5b389670f2ca0eeecd90bddffbc6978
SSDEEP 12288:/QG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:/dPIhhb4GTt6AUpkgAH
TLSH
T1EDC4231D745B85F7C22401B4BB84224ACCA96C4068C3E39F754CFB6F77B5CD2E6A2889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d4b0f2f6f6e69d5aa68bcb42b98ac00f83d1aab7a60fc60d9182f4177df793e0
MD5 b958cb3db8c58f5e128adf79c06047e5
SHA1 10e1d6f1c877bdbebcf3a6ee3d189aaad49a43b4
SHA512 fec374970ba6600f45e6054cffb0004998c9aa5bae50a12bf1c5e4b3a5eeb284a9a90af625229bcf73d5a94c338d8e7efb734ffc7890544dba6d990b04489030
SSDEEP 12288:/3G+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:/WPIhhb4GTt6AUpkgAH
TLSH
T1CBC42329746B85F7C22401B47B84124ACD686C4068C3E39F754CFF6F77B5DD2E6A288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f40c9ed392cb472481228e6458732760e2160ff98ee19f680bbaa3e59e4d158e
MD5 efd7076646c96e1844d410e424f100a3
SHA1 90ab0afa9058ec612d081ac8a8e7a5774f5cc65d
SHA512 2f7925fb775b63138f5d12be28ce1568630f62a9e8295cc0d696a38ddaa14554e8a9a91f6b8955c80487fbd3ef9723a04a49626342f21eb80e7121d5181b559c
SSDEEP 12288:IVG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:IAPIhhb4GTt6AUpkgAH
TLSH
T12DC4232D746B85F7C22401B47B44124ACCA86C4168C7E39F754CFF6E77B5CD2E6A2889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7e0bc4e20d788afc666965641ba9b266ce70baec01650c69f5aed128e13706cf
MD5 1b7fc6d74fc443ef2a02625191a2e673
SHA1 5db6937f33e20c24e138a70db7f57199b66dc504
SHA512 c79be5aca94405434ff8b62ee129918410101627fd60bfbf81d74db77135795bf6f826b3bf12ed18ec5afc2b0584198b8487842194c5d37c96fa00ec1eecd47e
SSDEEP 12288:/VGG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:VPIhhb4GTt6AUpkgAH
TLSH
T178D4231932AA40E3C1358274FA94510ACEB57C806993E3DF6504AF6F3FB1ED1EA71D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 336fbb07c5dae7b0b4c6f09e01ceb864fbd373fde67c654cef8acfe48f00096d
MD5 2ef5487e8e5dc04c8f9e96e111adb382
SHA1 3406538defdbaed1256ce5e2f7c3ad373ba59481
SHA512 50becd7aa3d4f97d135b50ccab1715f1a287daf53768dea79622c8855c3b6346bbc762e43b36ed78a32f5f36e91cbe65eea63984de13005e85fc3d2f05c4ff48
SSDEEP 12288:ZeG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:ZXPIhhb4GTt6AUpkgAH
TLSH
T1DEC4232D746B85F7C22401B4BB84124ACC686C4068C3E39F754CFB7E77B5DD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9eef880a1e6f0cb8381bb261ac70c807106998c66f0b19d34d61bb2f46dea91d
MD5 289579fecee8b9e21c4752dc04787c32
SHA1 d48f92bab8e8677f8d4f27f74f5b7d80972b6a56
SHA512 838dc427643165a46684e339d3591f3d517b4aabb74f00a209a765f1b98e49125d75409f7fa3a8f66cb061d7ec47ca167c82e3dff7f7f07d16ca75ff68a54a8e
SSDEEP 12288:0bG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:0yPIhhb4GTt6AUpkgAH
TLSH
T18EC4231D746B85F7C22401B0BB84124ACC686C4068C3E39F754CFB6F77B5DD2E6A288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 01d25da96930b4630c35bde32ed92634867361f9a72ae32f25bdac33d651a042
MD5 188a696049582705384358045cfd98da
SHA1 aeaa2ec8cf2ac33ce0d7305516b02a85a9018b0c
SHA512 ea9721ac13ca961f7d3931dcaf95e6415232cac79e7ad37d61a4314c148c16601fc87a382e5f2aaa4c78c5cbd998ee2917c32fabecf07971c8a48b3aa369b592
SSDEEP 12288:EvG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:EuPIhhb4GTt6AUpkgAH
TLSH
T182C4232D745B85F7C22401B4BB44224ACC686D4468C7E39F754CFF6F73B5C92E6A288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d980b37eada8c877b5bd682ae9a5cbcc0e0320a6db7b7e79da06e816e82e1bbe
MD5 c9dc8537b3309c4fef24ef7fceaa2af2
SHA1 b09e859c7c2455565953d02355e06c6380019051
SHA512 178410687f2c96439c6463473158748348d5f4f7e94c882d3deecf631021e9e753e815a4033ea97cfb32d686492260cf0409cfb56e58347240f628a40a51c08d
SSDEEP 12288:NiZwbVzzFEoS2cPvyXG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:QZMRzFVSO2PIhhb4GTt6AUpkgAH
TLSH
T1AC0501A9B39008F4DC67813DCD558906C6B27C590AA0C71F13A8376B2F737A15D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 50554fda6da985ef3231983cf660ea2558ec6a964cff5c8d1dc71058798f101b
MD5 bfd209c28e22dba0c8daa606a25cd5f5
SHA1 3c64d015289cc8aac5824e70b47344157b7795fa
SHA512 b1e1391c5174f947bfa2d348738a8ca569bba376bc0dce81c5008d70fd5f7282749f8b5ed4555f4d1f308caf1fe3c490701edb88b92230ee3d600a82ed831b26
SSDEEP 12288:UcG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:URPIhhb4GTt6AUpkgAH
TLSH
T107C4232D746B85F7C22401B4BB84124ACC686C4468C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b69761cb912c1bdc9597d8dabaf6dddf4a3e3b568fbc0a8ab5451602234b22ef
MD5 03329a33007a043f7a5d5d8dd11b9be7
SHA1 72b76a9497d4b25a4ab2dac48680882dfd2df1a9
SHA512 1cde8e7e07a255dfff662ae857d39d07556d5313db8835d81e2207e798276a79a4ace77e660388ffd7d636d321edeaaa4c4c1f7967f71ed2aacb7f3681068559
SSDEEP 12288:14G+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:1lPIhhb4GTt6AUpkgAH
TLSH
T1E5C4232D745B85F7C22401B47B84124ACC686D4468C3E39F754CFF6F77B5C92E6A288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a7adc0961e4c05bb6237edbcefe67d35d6b859a794299b84af2e1cb369640201
MD5 ef998a065e726d84ff6cb3ad73024f59
SHA1 9335f4f8cc1653616a6843d419e66c23bc36633c
SHA512 4454f94e6eee54173b63729dc354e00f6378c23b8328219cd63610eb906f925443054a77a57b310e2099d3bd765ffdf0122dd2055bade8b2688fe05f055b2d44
SSDEEP 12288:QyPz5L8jG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:hzy6PIhhb4GTt6AUpkgAH
TLSH
T195F4121B72A620F9D1364238D9911A06EB717C310761CBAF17A4477B3F37AD19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5baa3d5966366569755a2333bcdda80860e5ef025b13af80319235924437d427
MD5 207ceda071201b169b1a5c5ce1f249d2
SHA1 66fb1074f86809cf12ff1a2d76feeab1b1831af7
SHA512 9fcd012a9ece957d1cf82979ad76f12b885c17a64f933f1ff15f18e089f1941c5b5ce7f1e182d1cf648ba5091505ac5900318ce2d96b98f1eb538c50e30fb2af
SSDEEP 12288:wcG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:wRPIhhb4GTt6AUpkgAH
TLSH
T170C4232D746B85F7C22401B4BB84124ACC686C4468C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6a8cd41b2c12480b80d1b8c901dac7bee67810a1f88fa372f656b17de120fdae
MD5 c4417fd0e1d19e8074d87b6544121e02
SHA1 b534a7ca00bcbcfcc21b4e78b7e4f0718d539b47
SHA512 8a14859277762b19c4b75bb11cc05635913364061a1f4473f656193ce087302e79330bfa3ebc708e31f75f3b68c74f8fab4e0426ecacee67ff835cf11b6ccb56
SSDEEP 12288:+cG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:+RPIhhb4GTt6AUpkgAH
TLSH
T1FDC4232D746B85F7C22401B47B84124ACC686C4468C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1f456699bfbcd8ab96c0c4e95a32e05eee29bb0d301d74accabd4e24c150b4da
MD5 40247728dc96b9cecd6e8298dfc8ed28
SHA1 7cf23925dc10705813785c94ef9f2075f3b0daa2
SHA512 58807771e039d331f0ee4cf343276363a0435434ed0a2d77d232674480cbb8f00d7abd9527b1f486f5d0b5a8003d3eb0d323a019b5689e4d194a8158af52a21b
SSDEEP 12288:EyPz5L8jG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:dzy6PIhhb4GTt6AUpkgAH
TLSH
T19CF4121B72A620F9D1364238D9911A06EB717C310761CBAF17A4477B3F37AD19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8f6430c05930c8bfb682015cdace1fbd2fefc29abf21aef66efdf7970dcc052b
MD5 4f19b9518803fe1e48b5b4b98fa416b2
SHA1 28af196558b2934aa65f6e16d9b53980c9c26c67
SHA512 29b2f29c54e96a164d73acb8e716f693af7ffd218cd35cf8997fdb18b0fbf35f681b8efb9831d8cfbbacbbc10cf4d8097a62294d23b31a6cbc7c2f9fc7ba327f
SSDEEP 12288:7Cd9CWYoaLHF3z0z04PDvhlG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/g2:2TDaLl3z0zDQPIhhb4GTt6AUpkgAH
TLSH
T1910501A8B35018F8DC67813DCD558906C6B27C5A06A0C71F13A8376B6F337A15D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8c40c4f152850831540a3b66049a8f6880379e220fbf2cb2bbf1e0a058592052
MD5 cf09126e6cc9c2db778815ebd5bfb116
SHA1 39f7b796f03b496eb96719764827e8284273d77d
SHA512 10e2d45e1b3809de4715477e80de91e76a3ecab4d59b62f997d6267aed8d10e12c6e013f8ad47429a4c9a6d62137b9cb8dde54564ef9f145dad1094c38e4957a
SSDEEP 12288:+i4e7KRdTfgwCHKy7GLbbdIvyG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgAH:+3vd9CHKy7GZcPIhhb4GTt6AUpkgAH
TLSH
T17225CF90F3E414E8F0B78A35DD754512CAB67C591B71DA8F03A8661A2F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 11a1c3604153df60d8579f2abf6d11bb0dde753351dbd6508da6683701668175
MD5 1bf62e84ed47147a71d720877e9e645d
SHA1 5248cc7b0223fbcdfec5edce1f78bad54754aa68
SHA512 6828f2f0f8c8fb383b684731a22eda96684c2cced266f20985d28182fad797e714f26d5372e4cab5b8dd5a64cb36c6f16bbe4cdf68b776f623b5f870211d39c7
SSDEEP 12288:a1G+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:agPIhhb4GTt6AUpkgAH
TLSH
T157C4232D746B85F7C22401B4BB44224ACC696C4068C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6c4106eeb2991cf3004fa38205ad984a76ab7519264b417e796019b02cce5770
MD5 3cb7eb4b884296ee666405028bfc9744
SHA1 831674b03896ef7826addc42e177d43be9304ad2
SHA512 ab09d325650909a43cfc8ad11737edd5bcb8f63d18ad6e7be21a4fe900314107ab53872147fded40f2199626c88fd7de46c2a78ae430ce0a624670f4728d37b4
SSDEEP 12288:1DG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:1aPIhhb4GTt6AUpkgAH
TLSH
T1ACC4232D746785F7D22801B47B84124ACD686D4068C3D39F754CFF6F37B9C92E6A288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c2b0eaa5f7c200a0aaf270b80d1d43dce4abc31353797097368d095ca3d62a54
MD5 62d4dac3aad104199a17c2553ecfbc7c
SHA1 d8e15ebac8659259739fac1281cf0c769a90139c
SHA512 6a865e5605cd027417cff0a666c4af82087edd6556bd0731e5bc31b0eb8d3f1b3e094c0a6b65b53a716fa9166bd5aae9c685aef5b84412df2e1693750094221d
SSDEEP 12288:vyG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:vjPIhhb4GTt6AUpkgAH
TLSH
T140C4232D746B85F7C22401B47B84124ACC686C4468C3E39F754CFF6E77B5CD2E6A688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ca2a7e29186732dfcece7832ba90366703104f5f28db8a44dbd7f525e3d22deb
MD5 74b1c5d265205564bd3d31d445823906
SHA1 0216c3d4ab915668d89c80c3f7c381bd91ce8b34
SHA512 3973a28e637fe07837cc5b079da30bdd04218efb24df22010c53ccd802b205206dec9548b2128aeb0c4510703823f5564c8e051e180e35dd301256b947937a3e
SSDEEP 12288:7cG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:7RPIhhb4GTt6AUpkgAH
TLSH
T118C4232D746B85F7C22401B47B84124ACC686C4468C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d338e9d70e0ec9ba621f4d3ddc71716ffad7c93a5b5e9b2d6d41f7497ecb1e96
MD5 71975e2d3c28cb57d23c976aa0406ae4
SHA1 f6b3aa9fe18d3578860a46dce505b34a23f80712
SHA512 302287962f10aa35ad97103e6aa5381439725ecb131fd44faa48f99eb593a40a5e0d33e17bf848453cb96945fd1dc419c9076b102af95ed09ce77d2fc16fd1d5
SSDEEP 12288:d1G+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:dgPIhhb4GTt6AUpkgAH
TLSH
T1E1C4232D746B85F7C22401B4BB44124ACCA86C4568C3E39F754CFF6E77B5CD2E6A2889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 c355873c16a7b2fe7c64093346a428cca660aed8dc6965dce897c0f36dc5acb3
MD5 83efed8518a16d2eb66ade19d32339e8
SHA1 9f9a48504906393d077b6db9d4b78c4851be2964
SHA512 5f98c87dc23857a703dee97feee2ba6d937f5b79ae60d31b49fbcd20483064e11090c652f85df2a11a9c26bac3f739dfb2e1e3b7e311698e488966187533d721
SSDEEP 12288:V0G+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:VpPIhhb4GTt6AUpkgAH
TLSH
T176C4232D746B45F7C22401B4BB84124ACCA86D4068C7E39F754CFF6F77B5C92E6A2889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 8557b131a442c85ccd46fb8bbb5ace20f73ee7c0fba173455807fa959b7c4365
MD5 ee779f7ddfbba451a56dbf055095c940
SHA1 61db569e4b4d388c90736b3595e2f98d9b22d366
SHA512 54330ed8507613e5fe7f70754f5f21e7d85122ae17e00986fe0a6ce7c1f6ce2d2bd6e197614e5c0ed009437cc1064834c731a7d5bc154f2d368da334b193f7b6
SSDEEP 12288:OeG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:OXPIhhb4GTt6AUpkgAH
TLSH
T1DFC4232D746B85F7C22401B4BB84124ACC686C4168C3E39F754CFF6E77B5CD2E6A6889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3291d9370d3b50d2ea74607029b82833c672a042a1d9a87d1bff39e31c856618
MD5 6b025ef7cad126aaf11cfc475c7c8790
SHA1 fa1d67738b7d1257dec43d29d4c510ddae71e207
SHA512 5ae53dec3a4dcfba9ae96fa8a9c7a16dfabff0c961df02dd9b2d98ee8a02b33ff88ea1a68026b190b658840d4470fcd283df857e312b88f839450a0824d3ce40
SSDEEP 24576:jfwvUk9RX6wkyAIVPIhhb4GTt6AUpkgAH:5MnYIVPmhb4GTt6nCg
TLSH
T12A35D029EBDC44E5E177923C99B3460AF6B178581B31C2CF129953AE1E37ED09E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6452e0f0177fa6d46b95bf7a3ec55a588b12f6a17b4822f5fb584ce6af128ebe
MD5 a5463a373914db0f07159a85df22c17a
SHA1 c677d0dcc23402ac8e562059d3d0f6effd944414
SHA512 93e8dc857804f219ccabb97b07fd33a790d582f586a7bb80513b561c10de9ae3ea55bcf4f8010768f96b9e70585e02accd057d0c51f80861296e294ab307afde
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Pmhb4GTt6nCg:FySzPcPmhMGTt6Cg
TLSH
T193066C56A16841D5C1B9C1B98F0BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5abf21084c454b8594aaa85478200ea0d52c5be4d919b595f82cc9da11a526bb
MD5 2ee6d6ff0276b07863a1c9661901c52a
SHA1 b812da4a5dd680a7d97973f645cbcdd50bcc6668
SHA512 3a2c6c70567e1e835a0f50df668f25659359c6534a9a98f3a6ab95d678a16a7633c6afc92916da9b7e30b9df56461c5f2a6c9068377c8ec9460b0a3f7c34241e
SSDEEP 24576:r47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmPIhhb4GTt6AUpkgAH:r47JUQjTirIhCnDHUPfF/kPmhb4GTt65
TLSH
T10965AE1DA3EC01E5E1BA827885154A5AEA71782D1F32CACF1270837D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 99d9430aa4b777b7706f0840535a1014e623d64a4def12bf075d03c8efa73d9b
MD5 fecc4690ec73d3665e2913c50183499e
SHA1 99c9220c243b44478ada1986dd230b61514d8d2f
SHA512 5b78a6d84f8f824d5b39e62de381e02faa2a0db64fca1838659eb58c41ee5268d03072d3e329012fb5e9f3dc09488f68f19de421c32a9f1fc248b4e2a6e2cd14
SSDEEP 12288:ybsfsG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:phPIhhb4GTt6AUpkgAH
TLSH
T12EE4F119E29802E9C02E5174DB455641F7337C1597E2D3CF62C0FA3E2F76A909EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 512KB
SHA256 9c44f0a61b0d8ae7f7fccc5828dea66eb0dca616a5dce42c3eae23e336b78190
MD5 b613b3c5038f294ac34d27fb58469800
SHA1 95a77b215be46cb9b60332e0784ee0214651ee50
SHA512 292165e85dae3e3c87f63f5f529bed2024f856ae86b8814c9c728f724b813c788a7faeb75b755eae5ab6cabe62296143f376f475edc79a045df6e2af580cd163
SSDEEP 6144:KVsBC2nac17PpPfY8xmtMxoPaJU3frkp:KyXdPU3f
TLSH
T1D6B4E721B326E71AC2B645312F47C1CDEA70BA41FD0ACA1771CE173FC5BA6848BB5652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 553KB
SHA256 1957e586a4af1ea6e5adff94539573e688751be3ae86e9564af5b4277edb5aee
MD5 49b582321ed8cd3708361f3e16aa6c03
SHA1 673db63f9c84d2587df6e26a02dfadb184da0a50
SHA512 dbe3f6b078e982a7adc7e24be64626c61dac852eda9c98919e38a188034da33355e2ea199af1ca8a348c02da1df99d8e9d8da83a777d180058723ae39715ccd8
SSDEEP 6144:pfyDJwhlDdlp4fhnpCfIptf1stfSstxzsKxCZ6mOc/mLdqOY:pfAJ+0haID1WSszJfc/mLdqOY
TLSH
T103C4E741A4E7E34FCCFE64370736868DB7745C07B78A371573408A2C9866A7EBAD2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9edb37221a272083bd7622365b51f140cec52b867c69b4bfb1494855f06340db
MD5 000494e0c2c52364d696c455a5961d7c
SHA1 35e61626cf826d3efcfc2565c5de1b63c6507e7e
SHA512 d5f9832864ff9b755d5329051bd800351cd84c201c040cfd00679c5e0f655cadfd286abd9f301353013841f1d0645d0e06a83720466e59155c5b124b08522362
SSDEEP 12288:p07EG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:65PIhhb4GTt6AUpkgAH
TLSH
T147D42329615A89B7D13801B07A889119CD2D7C405F82D3DFB408FBAF76B5DC1EEB284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ea5a9a6131bf501a6d93f4756a50c7a17951639f0787200f90629fbe31eac2c
MD5 602d9d57c82119de959680740532f487
SHA1 16da5dc87c0e3f76588dc5362b858abdd9b529b3
SHA512 ceaa0f74c2e650ce48e9d32fb5da5a27d026f0efa0269d2e341d50ed2b9252caeb7d8007256943e8efcd0f3ea18ea02dbdaf86547489dea7aee508af490ba1a7
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYLPIhhb4GTt6AUpkgAH:6gb4mBIBhGFmPmhb4GTt6nCg
TLSH
T1FB65AE1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b9f922edbb4280227c0f6858ac99ee1bd8363dc9599ad6361acbb3786cf89af4
MD5 a388d8a9d6d531483c81bd5f133250dd
SHA1 84883b2664f020e5678809cb051daf6f3f030c70
SHA512 6dd76fa9fa6c75119fdcf75b1794e057a877fe88bab6b6f064944dda20d7b54457abd0942a2833ab5b093a2c9b9c165be30cfcab939e0e151f5d2df4219cc952
SSDEEP 24576:6G88u8FpJqH1bzria7/m2PIhhb4GTt6AUpkgAH:B7ZFPqVea7/DPmhb4GTt6nCg
TLSH
T1C135F16576E101F1D07BD1388A864663F6B2B8150364EBDF06AC8B562F23AE14B7FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2558fdaae5a03336edfa5e4abc5349614c4d54d16e74d2494aedb3c701a87a1c
MD5 28f5e1357ad40afe434f787ddfaee8d8
SHA1 035990fae4356e8843086c3d6f3cebf4239460d3
SHA512 c1f80cab157659b95cff6e580661a2e1839b1849cbfbf200df5ebd622942baf253cf8e35788ccda276b1e849f16e7c2ffbd243022d280ed73e11b616e12c6c58
SSDEEP 12288:5HvUrBFrEjwaQLG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgA/glzo:5PUr+NQiPIhhb4GTt6AUpkgAH
TLSH
T1A105E12F22AD18E5E676A17C9981470DE771B8521712D3CF02D0827E5F67EE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 38b400a46f2e44482599314158778761a1c10a0c7132f03ca0db0d425788f81d
MD5 4a82641c377488b702612bde2a062daf
SHA1 e5b2a0cf4b053122ca40958350c8122732b2f704
SHA512 25159f1c795d89a9892dfa525cd21d3c1c28fe1fc878bd711dbcdddbbb86098169ea92343fc0335efeb5fc07f49f0713659f5f602aa057bc89fe038f56a07128
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyPmhb4GTt6nCg:eG05lO43bNPmhMGTt6Cg
TLSH
T14BD5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62b7a16a6edb4d9ff923cca7c490489bd703b65588c136f33b9eb2320c97239f
MD5 6bbab917f67dc0bee6ff9ee82c14b5e0
SHA1 c1f1a4053b49743c39c5dc256ef7cf34b0d099a1
SHA512 397f2efcbca8eef4ba9c37894ea96326a49ceb594f3ade9a83ca467cf4758f5678e3c69a83568f0b805876422a40d55884bd6eec0ff073bd97e7b0bd7e2fd245
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0PIhhb4GTt6AUpkgAH:Ma5POZ3BJt2pasx2+maPmhb4GTt6nCg
TLSH
T18965BF5EA6FC01D5D179D17DC683861AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20589cc44b3fc4eaaa040b6dd16ce22daee1f1f6111e548836b6503e4eb33e9b
MD5 aef3bcce93b1221a7ca788be95060a07
SHA1 22b7049bfdbb49450e8df0c9eb7b95d00342754d
SHA512 80549ab8afe9f7ebf9dc4480325d39a224c82c4e294e20518e39842c7aa9214fa5cb25f80ba9e7c2f904a2ab6b86bd55edc9e7fc3c28f55163e2bdaf7a3cdf82
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk+PIhhb4GTt6AUpkgAH:tNc/zEOVHFjPmhb4GTt6nCg
TLSH
T159857B2623E901E4F1BBE1BE89679546FAB17865173086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 935a1c8e7a28bc9954f0455534f000f59710901d9e43054e294e96f9f5b39cdf
MD5 95174be3b2636eb65c2319bea57c8b37
SHA1 41a71affef7ab0d5ed55827cb3726165e2027f71
SHA512 fadf50c6bec0e6d15d08dfe9f169c4cef7585c75f5c873be6f4cf9c824f57a8bc68a68b8ac4437a5f9b8aad73221c2280f3166bfdaccbf2bc56898a9a3a507b0
SSDEEP 24576:eTkNvNnaFeYhJNtmZBmNPIhhb4GTt6AUpkgAH:eTMwBtOmNPmhb4GTt6nCg
TLSH
T14655AF2EB6B806E4D1FEC6B49D238512EA727451073293CF5290C13F1E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 35c10238e6f7f3a4821acb8eaf8e773f3fdecc37337bf3311321fa8a0c14af76
MD5 3154c0bec30e954c0286bd22439db0e9
SHA1 288bca86a40763d1390d31d6cef57e3acf66108b
SHA512 6d18e2bc662044415bd01e2fa058a38ea3d5ea513fbd6c5f8cc9324ef99c89d46b311e277b3e97075f987beba60204c567e30c5115f0cc38643c36a9217afa36
SSDEEP 12288:nQcMxWDXN1Dp/fshBItT1IQgAwG+o5I2qLeQHZ/sG4GTtRs4Mrno2dKQ7TpWfvgY:fD3FHshBIYQgA9PIhhb4GTt6AUpkgAH
TLSH
T13625E13DE69D04E4D57AC1BCDA538A06E77138A9032266DB11D4C1BA2F6BEE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-74-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/52-121-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/52-68-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1092-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1092-301-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1092-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1092-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1652-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/1652-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/1652-8-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/1652-16-0x0000000000400000-0x00000000005AE000-memory.dmp

Download

memory/1652-0-0x0000000000400000-0x00000000005AE000-memory.dmp

Download

memory/2632-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2632-86-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2632-321-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2632-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2632-124-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2632-80-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2688-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2688-97-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2688-303-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2688-91-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2688-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2692-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2692-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2692-306-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/2692-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2692-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3684-109-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3684-103-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3684-127-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4244-300-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4244-27-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-25-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-19-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4436-122-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4708-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4708-119-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4708-130-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4736-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4736-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4736-43-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4736-53-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/5104-57-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5104-129-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5104-63-0x00000000008E0000-0x0000000000940000-memory.dmp

Download