3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
Size 3.2MB
Sample260730-aevf1sha67
SHA256 3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16
MD5 5bd243418235c18aa709715cecd4c3cb
SHA1 d7901f2e7ec087d5930f855f5ff06495abfcdb18
SHA512 0a2a16f433a9e13e02476582695252e74c6b42233b5ccf57d4859873b37672eeb51b9d65611354618ff835f818fd2271d5e04358ca73fbc87f91124754818e84
SSDEEP 49152:WT5KdQcqomqoXu5nEMcSVr2sRSxT1MlzrXJhBHkLNiXicJFFRGNzj3:WTrv7q0/xjsnC7wRGpj3
TLSH
T1ABF5B032B782C0B5E9B301B2496EA75E146DBB64073449CFE3D41E1E6F306D26A3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5136	elevation_service.exe
892	elevation_service.exe
3020	maintenanceservice.exe
692	OSE.EXE
5264	PerceptionSimulationService.exe
2880	perfhost.exe
4072	ReFsDedupSvc.exe
4552	SensorDataService.exe
5764	ssh-agent.exe
6100	AgentService.exe
5300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80c7cfc183806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000749dbc8db71fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008018e18bb71fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000079e1e58bb71fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059bcb78ab71fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3d3508db71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd906f8eb71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc1f78ccb71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df57508cb71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5136	elevation_service.exe
5136	elevation_service.exe
5136	elevation_service.exe
5136	elevation_service.exe
5136	elevation_service.exe
5136	elevation_service.exe
5136	elevation_service.exe
892	elevation_service.exe
892	elevation_service.exe
892	elevation_service.exe
892	elevation_service.exe
892	elevation_service.exe
892	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2688	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
Token: SeTakeOwnershipPrivilege	5136	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6100	AgentService.exe
Token: 33	5300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5300	SearchIndexer.exe
Token: SeBackupPrivilege	4072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4072	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5136	elevation_service.exe
Token: SeDebugPrivilege	892	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 4696	5300	SearchIndexer.exe	100
PID 5300 wrote to memory of 2640	5300	SearchIndexer.exe	101
PID 5300 wrote to memory of 940	5300	SearchIndexer.exe	102
PID 5300 wrote to memory of 5584	5300	SearchIndexer.exe	103
PID 5300 wrote to memory of 6080	5300	SearchIndexer.exe	105
PID 5300 wrote to memory of 1736	5300	SearchIndexer.exe	106
PID 5300 wrote to memory of 5076	5300	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3020

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9a486529cef89f33fe361dbf25d7ca018785087ae0affb874fade4afc0114ece
MD5 040b03ba69aa100493a2c92432c96cf4
SHA1 5735cf037bc9844fbb7e1d959baf6f7c1318a848
SHA512 0c5bb27a3418774ae19d4bc641102313af0fd8d8165cc9963caf6661016b06c92fc8b05ca68db7e219554c8915012abb55d4891edff5d73f7bd82c180962f1a4
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZLNiXicJFFRGNzj3:N3q6mjBu7wRGpj3
TLSH
T1D6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7cc8c4e5dcdaf25914793eaae551cec1f4b433fcc18c9d53cb9e8867390b864c
MD5 8108263c9f0bd5ad42831cdbd34a5a9f
SHA1 d8357091e4d84f4b288284f14414ded9dc76ab69
SHA512 c84cf1007dd58d39a856fb44f3fa94760d49cdd3727aebc07e09ace44c3c1580fc1c9b4515c722730d53b069cb2800ab699f8995f4971741d49a1c9d2a3af986
SSDEEP 24576:jXYfDtczAS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mtcrLNiXicJFFRGNzj3
TLSH
T10E75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1d9ab0177ceb490f7e7ae0dd2d62ff2355fed0a793e9dc2f91fbbbd0e925b62f
MD5 4349755101f22a6f1d73f7d27d6c5e4b
SHA1 371f14742365937d37c1675e282f754a0cc26f58
SHA512 9195662a6622b3257739105b23e18dbbc3e94781b794222224020d77cc03bae07ec4d454f608e75367dfa0ea168253630fa6cc380d8ff0340342a1a93c2d194e
SSDEEP 24576:f0Le5ji0hmxhrMB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPji0AzYLNiXicJFFRGNzj3
TLSH
T1F4859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 030b1ee725a54a8c46d547135bb12bb281d0ca8d55df9f2b83e53af40d24a902
MD5 e3340b1187b4995cdcb92c726c40242f
SHA1 49a8d98294baa6fee7b2a48047fd381bb11144c3
SHA512 65bd7e98a9b60c02b239ff77e9ff88d0504e52421d478cdf7c87645222c153a9cc36a566b83c25300d67af89b5b9014cf7ddceca0f2efead271ddb112f194690
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l/ezSC6vUzPv+Hjy8LNiXicJFFRGNzj3
TLSH
T1F8756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a67e7b035971c18b92da83a147e153f06e8f17c31164daab4fb8d62664c5f4c9
MD5 68182e06df26554e7e9dfea6a195d8a2
SHA1 cc9e69400b794873327b286289baa700a34f7bbb
SHA512 63fe05dc1cc338d610ac8879589d424c79634d836de3dae6425561d0be723752cf16f9d53709aae01b95780b263c660ac2de7a4830b37ad2c05894de46f5c6d6
SSDEEP 24576:FVbqPb88hv/l+Be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+4LNiXicJFFRGNzj3
TLSH
T1EF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 32aee56f6d965d05afa0ef16d44290dd02f798684cfc2e2113c6b13c77894ddc
MD5 6b26d7123809096bb1f95f4de5367ee0
SHA1 299bfb3eb2985da370656b621b78402b4bf5d2df
SHA512 7e08545b00907c993752e8cd55f8c61032b00fbc617660c574ba49b2deb5ac16e324166ce8d5719ce1f382fa9abc2b4e913edd54cd25def40d9d41d60cca518c
SSDEEP 24576:XG9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
TLSH
T1CD5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA17CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 23009c01536abe3c8c8bbc38e1676c5720918a79e8d423c69d075e3f7a9de3d8
MD5 40f1112fbe476a8a3fcf899848608718
SHA1 619b38873a9d2f268919862b126b7d46b6e51070
SHA512 6df7491a22fc898f567da15c55fca386f8592c205b8a68302efd895d28c5728ee010c369028f11b27acf95e0c1ef6187f338d7d2554d78e3123f31862e07179b
SSDEEP 24576:PJIUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJIUmLNiXicJFFRGNzj3
TLSH
T17175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 144d4113708a0fbfa81c20911226bb16e3e8aca29810a70159d74089272ff513
MD5 a8c0a246c40c912f6e0ff17f652750a4
SHA1 580c18c7f7f8db5f7a532e50a670a968d5cf96f4
SHA512 328bd292fa3851a3a67accfd734c9c439070ef5845a346ca07d4ca14e56e86ba43f710cf0c18bf2fd18cecab73c4bfd83afa4bceb6f46b6ae5acf899f450100f
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THY:uQvGAdlCEL8c/WRNw5CL7wRGpj3
TLSH
T1B8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d77826b57c364caf25a61d1fd5f02ec4b8ace6c3fbff525d79b615813afd954d
MD5 72751727ee75dd96c5b1bda62fdbbfa7
SHA1 f38ebe7199da75c7b2fc9ac13742d29f8cd4f803
SHA512 5c9f2b5644b64c893116faf787ab0351cb7aba28b475ca5904de1b38c724ac500b4b3a7f2db9db35d04cac6038c5ed9396f9067d83eec514e14bcfe0578f5b3b
SSDEEP 24576:GfewsAjI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ljILNiXicJFFRGNzj3
TLSH
T13675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1e0824f4cce1cf3a9475b7817f60bdbbe09f9f40a1353494d56b17f24c32ebaa
MD5 cec815a77e1f81ea846fbae73983c40e
SHA1 1bebfe0d4378dcd3611f27da261781de281ce3bf
SHA512 08a5c7bfa31de994d8bd1b552c49f44c534673a5d80de61028eb4198bafbe88e0953fe810e618bf63e5a1d18a7803f4727c4ecb6ad475820a273b83f4ea29c9d
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHcF9:eUEtQevvqc2W1cpV20I32g9
TLSH
T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d086632e4a29786a47b62f9cf39e199d14799294342c34a7a673ff720488c8e2
MD5 a5c70c751c3787ff8d8d1a86d4fe1a84
SHA1 ea7d5e1a4138c453a17dd7e64f2d499b975a866f
SHA512 24014fb37cfdc7879f100ebc80494d80f14c7dbd69cec80c2ebbad1f27a210e30a9f3d9c3b9b8c80fc3516be8e48b81a8a89b48a8864a3218ec57ee81724a658
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zoLNiXicJFFRGNzj3:eoq2Vjnmv7wRGpj3
TLSH
T160D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2374a17df4ba193cf52b28b712828ec1ae611c7ef6febdbd34bb3048323eafd0
MD5 fe174c2cb62bb4fffea9d1edf7e931ea
SHA1 6bcb038e693ed43bdfeb33c1f542add810289b4e
SHA512 19504429b178bed60898500814a3b9b7905c7bcc0214b551a90728258c1687cc35194ff45a90445ee6fec6caf2aaf6a5f578168f5b4c1c90b31b612be9ff28eb
SSDEEP 24576:PAhGL6IFoiwtA5l7S53P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PAM5Foiq5fLNiXicJFFRGNzj3
TLSH
T1E6359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 344e29b5903383fcee2476a6556e9cb0cdc50eb0012f086877c2cb227d838483
MD5 1c13ed64490a0c36c7c1703a5f601f59
SHA1 653cebce6b4c05aa7e118db85d5da599c6b22bd1
SHA512 1be46171cb10af652632670fded0dc7da8dedac05d4c732bc2aa705e2b4e69759ff44d4d00196bd93f8a7c45bc9e6846915eedb231300605dd41232fd1abcc40
SSDEEP 24576:uwuROWc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uwSODLNiXicJFFRGNzj3
TLSH
T13B65F18632941CF9EAB641398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9e42a01cc718c0953d17613d1ae06f8135907354080b64691f1186abbf992887
MD5 ac0a25a62f5a54d3acd8a5ed3b5b30a1
SHA1 0aad3da270a467df10a8d20f66e3db38e6e20874
SHA512 9321bdee24175c957df2d55e2265ebe67bb83ebb8902b32f7ef5a28fc50935a2987c189e82b78317f057e5fe81adb026976190b3361781a8ec1fd9a4b7f8456b
SSDEEP 24576:nZuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
TLSH
T16155129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c7459974732d1add528183dc4b1c1440773a35461e09c6937e3de95f925cc8c2
MD5 d28bc355b9790a0fd5a0eadb8debfcf1
SHA1 1f7966903ea604265f8f068bbcdb3a06e6ff372b
SHA512 6922828b584cd46b9b7b6e3b09a09bb22f8366d5526aaf45b00512318cb6a452f1fbee0fde2da602ce8b10eff2a225d7148926adff76072f33bec0cee6d6db50
SSDEEP 98304:dQRQyi36YOcPDLvw2gAf+PN367wRGpj3:UQyiKanX+PNeF9
TLSH
T1C9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f86cc71985d476e34058e290ddc633d5e604f2e5dc15c4eecdcb82689e4463f7
MD5 4f484d04289ce8ad3382ca581d7ec75c
SHA1 d47e5ac62e7cf4bf1a0203520a021738ba4d7fc7
SHA512 41170b3145aa2b13a4dc00ce0ef075e3f3b4b531e02acb13e09fe58422dd1d9c74d603b6ceb9a7649a146ef78279e62f377fb9c252635ea26bce4cf5ecee3bbb
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN367wRGpj3:dQyiKanX+PNeF9
TLSH
T131667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ecc7e5003d57d232f119a45010587732d8cd73962b647191fe0ac1c9e732ca39
MD5 06fcdcea48f7723e92f082980981e4e3
SHA1 029ded9debc516c5df40a7bf7d40bdc12927924d
SHA512 720101500a71af7e0a7ed91c104b155827a000f438c4755d2358c946fec6bcdb22a0f5f013c9a8aee3379aa067971bcc5e8b59cd3a5dd78cc752829b8592bd97
SSDEEP 49152:/68Qg55nhkeWu7PNU3/YLNiXicJFFRGNzj3:5thTRc/Y7wRGpj3
TLSH
T108B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6f574e5624226deda67b018a64d3be48fd5c652e7bc539da5ef33a3f5a157b44
MD5 4055a102e15e282ab9f583d784e293e4
SHA1 e1dfc562c17adca5f5f7ede0ac62a1bf16b0c9a4
SHA512 824a96b23f9a020ea64d23b08d6db9f9efdde21b363feb7989a41be67895fd72617bf4b82692303a137da3f1d4be53a3141ada6797d88f6c8b64c1eea31814fa
SSDEEP 98304:Ly5112gYy5azzVvU69nLKnhZ97wRGpj3:mLIHRWhbF9
TLSH
T1E0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a5072be27521f06cda4aaa4cadb56bb616d7391307bd24f3b49076fcbd0befc4
MD5 8bd20c7df006bca7c5aa27423d81ba46
SHA1 bb42e1efd14b80a14e3bcfa507cec9d3ecff36e6
SHA512 d187ba58958fa311a3e7f919f59e7fdfe7a6f07d0b22805b5ffa2a1fb9d785378ec497cdeebb0a121199b85c85558a75c31f5b07dd9a3a3f53b0454ff308d8bf
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxLNiXicJFFRGNzj3:Nu6JmIxd2dx7wRGpj3
TLSH
T114D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 964ddc8a3b84f4125216a2b26007c89bf9cca67164de4cb3f4aa0f4ed695e52b
MD5 6bb5f869f250b7b062939ba79c50a92f
SHA1 335cf1f914b890913742dcca785c6f26da1a863a
SHA512 c67da601053da9e84eb18a8662ca92d15b7c431778e787e690f7d2984f54e0b468d1db2d22531d9990e06bfa914c56a45cfb4618ab7553e4971caa1c6f6d7329
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4xGLNiXicJFFRGNzj3:lmifPqRv7wRGpj3
TLSH
T13CB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 695259640c6bab6b7329ba54c2f1aa4ea8b3514dd04bf0670023d022d8a1b21c
MD5 2b0c250b730208e93222ab28c5170975
SHA1 e7b05ac297feb7c041a9a46ee506f354f5e9cdfd
SHA512 7cdb1ec002fe7fba2b1bbe14197e3fd9239ba689b1c8361a9a55c2d4a8acf5656d6ac8716375b6afaa6dd4622aba64d5ead7f648f3558809b22eea5f6ace65dd
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHqJLNiXicJFFRGNzj3:+5dKqi61J7wRGpj3
TLSH
T143C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b3a5bce6bfce857a21914e8f7699aa6f74365f1a20be188d39cc3a4b251dadb6
MD5 d018c39bf19671f98787679789f4818f
SHA1 01bec0faace6a65b8cbfef9ed519640cba15aed2
SHA512 d0312cbe3e6c99a81c8fda64ba3fd9ccfad799b2adab3e01051381513056fca563342ba4fc768a506260f4abd5ba5b3fee86f1a8cac2ff2d8e6d36c60ff0931f
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5wSLNiXicJFFRGNzj3:2X2iWphj7wRGpj3
TLSH
T14895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 92078d1b2a9e41d6eefb8999a6f6ab8650e3dde9ae6bcf027e27e90bf2b3665a
MD5 20edacd67f05ed06050a3674ac7214e7
SHA1 b83d1b56de69092a88df9ae83d722503dbc03145
SHA512 0aaff8d4861e07ad5ab22717745578ed4339b9f861980ef7b89bcc6b27173a2975b9b4d856d88ce1cf8e24d4227deb87f8357a95d14541bcf2b4027b91234e5d
SSDEEP 12288:gZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D2558955B1FAFC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fd35970d76a4c7ef3b35bec4b3c296268ec9b8d3f83c52a37d238408bb49c2ff
MD5 dae7aaf1561299da08efb13e4d8542da
SHA1 c196efcfff8fd4580976892df1f4a6f8e9852d49
SHA512 f9c5e5495cd4325f999e6d7df911d6b45be3a6cfc476161ec6ef29058933fefa63100c7b45993e3da5c39cd2306abc80188e4467e65b6821b117f841a4b1b7b6
SSDEEP 12288:kyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D2558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 219045f20a67adf63523412117768f3a4ef9f5adc151c13fd7ceb84b682afc9c
MD5 bc34bfea46a2878cbf122af4693151c2
SHA1 c5fc75780ea36b61449a9f7871f60bbce8b342fe
SHA512 2bc1fc40ef679746f3a2a917ee954842256a346d4f98255d955de9f301bd140c82470b01d9bdc88303c5b6ecf761db717e26e9716390e48f7243d836832a9992
SSDEEP 12288:lkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a2c89173faaf1808210fa1a6f5dbc08bf00210982c2b06262cea5baa942660f1
MD5 ee9aa848dabdaf7e5ea563d118a2807f
SHA1 5212d9b68129512b0d3563dd8c6272565943df8d
SHA512 f84e360d3ee58549e7ffc743f7f96585878a940ca47802245894a3808f77bcfb3e1c12eff5007da9a949ea93a776e74c6110aa0ceaa02e7f0d1fe6741fb25a4d
SSDEEP 12288:fV7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C7552392168910E1EAFD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9d201e853ad41243e8893c9b731d279bd77c8271607f19d8120ce5117271c3d7
MD5 e061d5e01e201591a3a85996e1db7d11
SHA1 26976c9909eff8bc031c63c3599796c64f652fa2
SHA512 b42a11ecce85a0e2f2e024f68966a56194928347497aca079a3167c1064dedc44cee2e185a554a9cd42bc4853a04112d33ecea42612b77161410cd28435bf459
SSDEEP 12288:QTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5561372bd42b8c13450e3ae33b78bac7075cc44ae4aa60683b2589b2d2a11ccb
MD5 cb25f7f6033956dd50f1edf8e02011e9
SHA1 85f1722dd825303c1d035f2ff1bbb6fe91136bc0
SHA512 34790dbfb358794c15d543334735ca5a26dfad1cda4a5ccf1da877cf0b64505d13271d47fe8dde5d448916a692151b5e8d67b69ca45c9a4b03a44b1138ca20ba
SSDEEP 12288:TGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D2558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ac384e375c22d7ea6942897ab2b5e107295bbff8a7fb1b93381bb5df5f72f489
MD5 7777a9a2f167424a3016881d2c58e461
SHA1 10092a104f2496f1739d7a6dd954fd4c21f40a86
SHA512 55911ebaf1a39bf40c3a9b277ba85451a788fcd0c79f5c662a2c929b60f216eecb19e87f266fc5bf74cb7b55ed4c50dcb03217add4e0c9ad4ec9d4ccbd24a558
SSDEEP 12288:LqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ls/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D2558955B1EBBC0039C6354428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f95b66d5417b5c86c5148458a42e1d1ad5f14e50edcc253f09433cccab08ff1d
MD5 0a69f82fc8cd4debc6a92daaefd5fa30
SHA1 a0a086cddf44989111aa561e1b4353f8e28bca91
SHA512 903374c8c78a1469e57e9acb9c9612c4354f0193a5f345acc842939b8a9b312909aa1628b2f4ee2a1df061ba5a36d0297d5df38c622a3122c8edbe28f79fbffa
SSDEEP 24576:UZM3zFVSO0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UZM3zfgLNiXicJFFRGNzj3
TLSH
T1B2750295B39018F4ECB7813EC9258815E6B27C1A4B70C65F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b297c776b2d20421b9ac8da79757c26e66db4e7cd7eb994d947fac27ab6f9c8c
MD5 e83a8e83d32836b3f8ac575c0413223a
SHA1 67751a690e9f77e6fe9c8f02c7608e164fd1b04a
SHA512 0b215a6d7b7e4d1dac9ed211eb19de1aec5cd3ca12f552883e367882f78e796fd29138a1e2f7bd63d6e46fd1628d003bf075cdb987652d6284dd2522685549ea
SSDEEP 12288:dViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1795523D3558955B1EBBC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3ce2a80f3db5ec47bcc9d6e20caf7b53ab2689cc67666adee70ddd3c12bc5556
MD5 05e8816872595f9ef4e5f4cc0c65179c
SHA1 69dd4c1b68196b355fd13f5d0d1f1ca5eee8657d
SHA512 fbe0de3d61645dc7198397a46d30a7924994cb9d022bb84647f1d5f04eac6e7530d8c20bae45fbca69d3a542c54218bf0d8d1752d27df9c74b9759e38450a2f8
SSDEEP 12288:bBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1EBBC003986754428F5881E2DEB5659E3E2083E1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e9cd2cc6b49fe580b3153c853c6e73963efb42f1bf4717479fee578d80103090
MD5 e6de6b8e504c525cb408e862defd4c52
SHA1 6612125a425529dd1aa34adc0af805970780821b
SHA512 b60fa2dc40e7475ea7ab20c906f682d0ee060f3149aeb4ed45a10fd4604589ab1ac063eff972e39df23db148a63b9a3d1a308686cdab3c203afae36beae67da5
SSDEEP 24576:Ezy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EjLNiXicJFFRGNzj3
TLSH
T174650147629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a542578c66fec8c30f46e26c636b0baee1ec5c2543798645249074645cb94e91
MD5 ce316ee87425acb20556180394c3cf64
SHA1 3a4b3da42056643b5f859905779601a78374d603
SHA512 9bdafce5e3fc41e5036dc74cc817a443960e0848b74ac7cab550bd29fdc7f4719467dd50c03a859eb13417e297ab6973bddbc0c835ab4101e2e79be1d58578e8
SSDEEP 12288:uViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3ac4b7635cd840b166c073ae04861fccc866e007a47727a5d348f58dd598858a
MD5 a7d8053a48fa7679214bd6206be4d91b
SHA1 697009b721f397f56ae3cdda2daa7cd58e555f5a
SHA512 c719c1adb584c00db6006c3eaf07b8da626df092eb7fbf82e4f9658065f2467a8b1ad287b550c1cdd05bc47fac184cef5db8319cdf25ca675ddf9c8e7061a455
SSDEEP 12288:xViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D3558955B1EABC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4c1a15117c741687c91ba4a5458dedf3b851a6b78ad48575dbe8062186afa1be
MD5 f5cf2109514a50ce163d741eba8bb5bc
SHA1 fb9d86cc4b47d1ca9c0bdee340f258c506803bbe
SHA512 8c6eccea1c4201a54d738b21dec97fbb247c297705e49923f159e8082fa7c73c6bb6ae399fec807e56d62d14cc284c401f4e6d27f9e4962ac66634cf9575b076
SSDEEP 24576:8zy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8jLNiXicJFFRGNzj3
TLSH
T12F650147629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f8dfc444643bb6666e234bf8fa9c621dcbfc546ba4f34b404ffd7d75ffc583e8
MD5 c952f4821001dddb1b48349629a98e1d
SHA1 26720d9d89e544b7e04ec4c96be04911812d289f
SHA512 0d834c18ab0ef03d085f807527d53e318708506f8b55afb13c53d261f00779173897bef9bc9391aaacfa70b2de918990a03e0930ca766316ba441043b0eabbe9
SSDEEP 24576:BT8aLl3z0zD+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BT7LljbLNiXicJFFRGNzj3
TLSH
T17F7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0b58ebbd19d6372ebc79f6f68a1f807621f0080cd2bbad3d86a5ecd5950ad07e
MD5 56c6ff3b1b86a8d1c35a84fceeabccd1
SHA1 4b063cc0fa57df58f168f2c6137177841e9023ab
SHA512 3531c7ab4241c1ed3210f2a8d2cab6710655457b1ae763f77ea69f9e91fd7dd5d601895924ff607544bd3700a69f571f6998634630d40e0a65a9cd6798d4e516
SSDEEP 24576:l3rd9CHKy7GZa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Frd9CHKyagLNiXicJFFRGNzj3
TLSH
T1A285CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 63f10dacc2e2b7dd45c980b75194935b4e50723b7f0cd13bc16b3a7ff4320f96
MD5 4d87d52281e8d99fcc135d6ddfe933c2
SHA1 b7d8be63acd18bb2b604c2d411db1ac425a07738
SHA512 fffc0e17ad8bcde39caa2b66f844181cfa75258a616d5ac2fa19d0209103d8fc17b455afd354a0f16f80535530988af268e4a5e7d5b4ba35076efc30b872d1df
SSDEEP 12288:CEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D2548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 38c8b11743a3df80acad0931582226479188e0309caae995564ae7a5e852004f
MD5 1d3ab0fdf4a171c655fd6fb885509d26
SHA1 352ea5f0dc5e34ce5d0cdab0a711f71807908467
SHA512 c876ec866b169540db9743b09dcf4c4a0a375d57044567a1bd682914ea0673e2a8c7e96a9bd9d9e60144234771c7ce3b5882949573c453b2832bf8341ff03f95
SSDEEP 12288:quiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D2558955B1FABC003986764428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e06001a9134d459c8c5acf337354cc0c685a917ec1fed6af1128e87ab7f2e79f
MD5 c153465ba885c75f24438d5a2c784f9a
SHA1 5c81656becff3b9768a6adf77e4e502ada8ff0ed
SHA512 53b554377d6108259240f417aca206c6cb46c937ff803e6e22eeda9602e84f37a3f46a5190a49c543d7071cca84f72eb0357e9abf51b903aad20ed14cf44828a
SSDEEP 12288:EniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ET/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 20a845acd0861e027e46fc4189d136c5730a83d5278c9c6631ce30e73349b02f
MD5 813c63f35408831c64d99284a816f0c1
SHA1 0f5629141a9a035bdf60caabcaf206b98c47401d
SHA512 fbce83b6ce0554831912c617d032f19e758f2b201fc6cf7cbee1b20c9b13aceb65bd6cc537f575f9699a3a7854c9d8bc3acc3ebba207d5eca06ab1085d7644e9
SSDEEP 12288:ZViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3558955B1EBBC0039C6764428F5881E2DEB5618E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ef418508f147dad59a0edea08880cfe161dbf95147f76ab955d427a46577461c
MD5 1987354df9880f1bdcb491be4c6fd740
SHA1 a43f70875bbea23234369db41e1a090bf17a110c
SHA512 259e873452e9198bdfdccc2be0cf90808f5efa90055e282f2ce6dcf223fd2eb9189bc36678da1e0c468b97ce292600d81f8fbfa7fb7ed06ac8b0e1a5afce8120
SSDEEP 12288:KEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1d9794273e5e0fe69c5ba4c07a2718572d13086283a208049a8f0012e9fa8a7b
MD5 0c924f9544cdb9e8da3c465a2a526806
SHA1 579d4d2d843af6c677974958db7198b97e2dfc2a
SHA512 38addd8cef914ff22d47259b3e14988f43a35f6eb346d9435a39c97e4e923530c065b7c0e5b1d95913e643a6c5007459d373e34d5febe2815d5a8d90537d0bee
SSDEEP 12288:qNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523D2548955B1EBBC0039C6754428F5881E2DEB5659E3E2083E1EA23CFEBCF38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 534f0b8dd26b89668d1e8a35a172207ab0b1bbc304ddc0d6cbd1bf7caecbbfb4
MD5 667a30e304d5a948fd53c0ce6c2f7e7f
SHA1 a2895ca5f6837fec64046d259f92e9c3f4c1228f
SHA512 21c3ce53c2735c8e2585f83cbc62ece2d11c79bac3b75a07c3f4fb585df02cd47cca666646454f43f8e9aaedb18bdb28603e8e660a4141e8ca0675d1d8fa512c
SSDEEP 12288:LTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ln/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d2439b979aac661ea9989cf5a91547a5d8ae8e7f6d142c8ff4d9f4ea09c1a116
MD5 44699efacdad0a7caf3ee1ee287322dd
SHA1 8aace1675dce0316e2a62f5709e56068077523ad
SHA512 7eeb6bf23c6b9e2f1e6affb81a2b0bbd6dbf72937fd0c092ee9daec60311d724c0af6a29a8bfc85adc912827622f4d2177e7349f2b3864befbd67e1575481de1
SSDEEP 24576:0fwvzk9RX6wkyAId/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fMnYIdLNiXicJFFRGNzj3
TLSH
T1C285D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bba1b95956ab0f30a2ea2cadf43ed38b498da7bae0af7cf437a3dd495f0e3892
MD5 695d94b6713db1fb3d22d9b7ab5cc51d
SHA1 bea981a05339f5bd0cbd0db136b3bdbd9e3545cb
SHA512 c8ec1397041616c3857d9c159dd0d48f3bd577db0a9480cf84c96b9483942303333ce2157c282e8dd81bba620d096fb96a219ba418edf85a7599f7f9c2d5a1f1
SSDEEP 49152:zYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yLNiXicJFFRGN:eySzPa7wRGpj3
TLSH
T1BB066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 44f43b51324973c79eae09d0555e088e7280110f282a55121d9ea989e457d342
MD5 213604dd9856c473f51192a6337653da
SHA1 7d0ddba2ced1e9f401a9d26a7c0c8dfab6a7651d
SHA512 d71a2a38bbad8de66c015cb00ff6257ca4c06fd048c0daabaaa14823282e3a492d7d24e359c2a44e4b3a12bd63100203e04fe744b3604d812d5a37b9f00d1f5b
SSDEEP 24576:q47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q47JUQjqirIhCnDHUPfF/iLNiXicJFFS
TLSH
T1B765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3691b7210694d81facfe6eb55cb660df70e2c7f5d23ac7e58bbb9f0e6791ac24
MD5 b3a1a00d4cf2291fdbca4e6bc1ca5977
SHA1 d77806a07f601b015f052a8172662fa31500ea8e
SHA512 6430b5ac8a6e2f9aac8a4a0af125dffb9ff6c8d68666bd612d0cb088c168d6d31a08e98955c6817d0b843f2c51574fab1e08bb2a347f017ccc6160e787803c69
SSDEEP 12288:hpsfFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 51b36922cbdbb34172d556be5f76066d02fc35c3d8c364d82166d20a1ec51072
MD5 d2a98737ef03c5cf3b23b2e00a61cc4b
SHA1 224515190362756e2300f179fd43877e215e1d42
SHA512 230165a0770f0eeb43ec97b59cd14d73609ac89233ce294f60a03cad14c8e6d3da27263bd85277704ed37f6e798cf3c6f527f0b1f59cfff885e7ee7208202445
SSDEEP 12288:hPq7U3fGRzxEaTfitGk9FgcNIygoCXNl5Lw:hPoUPGReaTcGkTSygour50
TLSH
T140453840766BD75FC6AD40321E37D2CCA7707D41EE05AB0372C8972FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1d8c818eca267bc2187e8fc9f57413ae7fc94f081f4db98659b130118e265793
MD5 951f62568b1ad6084e44ac30b36cc3de
SHA1 ae4e9f20f5ee054d830f5b0689c0afc9d1df174c
SHA512 b66218695efdcfd5505074c6a81a0355cce23e3a705d020deb4bd1becf25e8ce964bebd4d4be1cf4f85ec4c78de9f7fa621c2fdcc3bd7f2c1e79af7fbc5de43d
SSDEEP 6144:SoF/bYhXn+6I1uI1MkEicbVtMx6DMBcbVtMxKwh+Lih7Cwgtn:k5kcKCtl
TLSH
T15F65E8806437A38FD1FB6072072A5B4DAB64EC42B7056F277384453AD86BB65B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b5ade85dce03ac5b4b0f2c3792d2636e902af77de89ef46faa062ff9942eabaa
MD5 a0276df729eaf48b3f36204357410e36
SHA1 041b7472a474cf071bca1eee7b04aae43a378789
SHA512 3227f87a7baab00938e1c94c3a27f73202f16fc088418a8dc1bc26ef02443d5981da6c8d964cfdc1c327a86b2f609c113e6d3df355f0f722a1d26d5810b272b2
SSDEEP 12288:QF79iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F35523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6060d17ead7a022b7b395a2496bfed863da29b13b3f5956c2b42afc31da44225
MD5 89510c89f389f8d505921372e77d1209
SHA1 a3e3768e3765752ee3e5130fde54ac7b71ddea39
SHA512 4f928f46719f980aa27507ee54ebb29e0ec5cc28f2813960d62a093d6e47bf99398f21b57bf79c4a1da8f3994611db467ad1575a0f96c70e7fbf78a92d398b84
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fgb4mBIBhGFkLNiXicJFFRGNzj3
TLSH
T1F565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5f619bb579ae20cca1ad5887e6fde4d103f91bb80a4df7d0e17ea103183e4c07
MD5 e807d1d136e68709489f3d99287efcc5
SHA1 48ab9f0ccb59d2059f409c3432c4bd768bdcac83
SHA512 d27e691764ab975953cdd386f38fd7e5e38b836c79e35cac027bd0523f1e852e82140b53cf088e05651727a766d827568e46caa99efb47f651356383d5af3ddb
SSDEEP 24576:EG88u8FpJqH1vzria7/m0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:37ZFPqVya7/zLNiXicJFFRGNzj3
TLSH
T17885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a74ddad226fd3074ec5709eec2fd6e5b1fddc9bb3432e5ba35eedd5e9529a300
MD5 a586c0a33a5f81f0737639ffd79323af
SHA1 116cbca38bdb726f2337e53954ce5c2e864d26d0
SHA512 ed8b5a2d0a23279f4b27f111d948e0169c361daa3fafd58def3778959e1a2944de032ee2a6d05de8e3917acfa04175b42330fb4872d4ce2fadf99ffbaf662189
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwLNiXicJFFRGNzj3:qG05lO43b17wRGpj3
TLSH
T1D6D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3013ed864a05b4c54036a13f2310c47649b2a8d786c1abc37ff3742997f3d40
MD5 afea3c08ddfadb0f66bf3a1a277784ad
SHA1 0d4b59a34c8a0e71f1c397a4873b0bf8001891f5
SHA512 b5d10b03ba80782050e40a82854263807a8686d44fa4d146d42c0a757d26a9237ff16b9e615998c27ade4a165eec9077a71982deb7f9c41189dd6b0ff1e79bbb
SSDEEP 24576:9fa5POZ3dpyWVM50JicR2hG0lasx2+47eidny/TwSfVcYG3K/cJHlnFR+IGNe8jg:Na5POZ3lJt2pasx2+mYLNiXicJFFRGNf
TLSH
T18865BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92b32a04a34a7c83ab4b12146df201016f945926c2fc57c13fcbcc48e3148db7
MD5 2a716a33b56dddffa0aca6183fa7bc93
SHA1 496472b733012132ccc62df7e9930f4881f7eecb
SHA512 ea47d3764a33baf5ea23f5fb2345b28dd1e1a0361a43b8002d0508dfaebfc10afa769eced647b5ee262af99626f1fb96552f57ed424d69d26a718998e0755569
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fk8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DNc/zEOVHFTLNiXicJFFRGNzj3
TLSH
T18E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2a9da5500c853f190c374314a670c23c2b002f1d8a33f9711cf78456f7f90dc1
MD5 e725e651bb0d7057659e6ec478b8baae
SHA1 36ad77323ae8d0f0b3e811c8f393a7c77f5d4c60
SHA512 a3e1374119afb55e0fa64b336bb3e83c1b10f509a7b3001978382d75e2e4d856634d817f178519c8e760530c0e90b9066dad5f717fa63029648a29e1f54889a8
SSDEEP 24576:5zkNvNnaFeYhJNtmZBmF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5zMwBtOmFLNiXicJFFRGNzj3
TLSH
T1B155AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d13977cba65969dad615a5a68613e817966d0b5627acca4cbe93a8bb7a2b0a69
MD5 79ddae75843d321b1efc9171f87021ff
SHA1 fb9987bdc5df4dee553a86aa8ddb0d02ee2aafb7
SHA512 61993b202a69e22b855d24ee0c9acc1e1573f0b4ab954c3707d8575b0bf44cc0b7f58ef97e365fdf397b6bd3fa4456fa7ff9cafb7eb2cf03ed8af4febc9196b1
SSDEEP 24576:UPUr+NQg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UJQgLNiXicJFFRGNzj3
TLSH
T1D965F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 edbb0896d9d61e7b7612d8311af1ad3ce0cd09e70263bc5f2e7c18f18bcc9704
MD5 f60a02255580fe646a0245abf863bdec
SHA1 dcc07f17d9800d81deab4d9e0c2827ad7c834e92
SHA512 96f8f12ba5b841db49742149857ad43a0bceadbaf77281bdf5904f75d801a8cc9074b1a28d135dc16be28f1cf9d10e0d7531e26436813ccb7a0809b48ac37692
SSDEEP 24576:7D3FHshBIYQgAl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7DVHeBIAAlLNiXicJFFRGNzj3
TLSH
T17C75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/692-69-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/692-287-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/692-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/892-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/892-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/892-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/892-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/892-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/940-336-0x00000236AD440000-0x00000236ADB65000-memory.dmp

Download

memory/940-414-0x00000236AD440000-0x00000236ADB65000-memory.dmp

Download

memory/2688-0-0x0000000000400000-0x0000000000740000-memory.dmp

Download

memory/2688-21-0x0000000000400000-0x0000000000740000-memory.dmp

Download

memory/2688-7-0x0000000000D20000-0x0000000000D86000-memory.dmp

Download

memory/2688-6-0x0000000000D20000-0x0000000000D86000-memory.dmp

Download

memory/2688-1-0x0000000000D20000-0x0000000000D86000-memory.dmp

Download

memory/2880-317-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2880-86-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2880-92-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2880-87-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/3020-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3020-55-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3020-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3020-71-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3020-67-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4072-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4072-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4072-338-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4072-103-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4072-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4072-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4552-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4552-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4552-321-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4552-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4552-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4552-115-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4696-416-0x000001804F7A0000-0x000001804FEC5000-memory.dmp

Download

memory/4696-335-0x000001804F7A0000-0x000001804FEC5000-memory.dmp

Download

memory/5136-24-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5136-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5136-30-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5136-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5264-302-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5264-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5264-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5264-74-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5300-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5300-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5300-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5300-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5764-130-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5764-320-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5764-124-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5764-123-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6080-425-0x0000023A4A3B0000-0x0000023A4AAD5000-memory.dmp

Download

memory/6100-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6100-144-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6100-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6100-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6100-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download