6d9874818d360211af25149395d9a01c7ffe467ca680292e167dbc2aa7c0b609

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Size 8.3MB
Sample260803-ffkk4acb95
SHA256 6d9874818d360211af25149395d9a01c7ffe467ca680292e167dbc2aa7c0b609
MD5 a77a6ee38ba960686ad8b19bbc706481
SHA1 b46b51fe0cbbca4030620a8f6f738adc175b8dd9
SHA512 80a2257c2154b7e81711303d31fefc35177ff63e5b1e330a2897ac4c1d09d319fa058dc26648d25f0b2db2e9e1db27846ae4c2cc1131cb030f9dc893b96e1c67
SSDEEP 98304:XPi1IuJqZhGfeZ1fezbapHFg02aqbutcKCd1xjv3bgam7WqVZhhHEQs7wRGpj3:Xfu6x0zOZezaqCtcKKv+VZHXoF9
TLSH
T1F196BF11FA01C039F8D202F687BD8BF9E97D9A24077560C753D46AAD9F305E23A35A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5484	elevation_service.exe
4288	elevation_service.exe
2716	maintenanceservice.exe
1916	OSE.EXE
3640	PerceptionSimulationService.exe
4320	perfhost.exe
5156	ReFsDedupSvc.exe
3636	SensorDataService.exe
2908	ssh-agent.exe
4496	AgentService.exe
5984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1d0f071b5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0b44a8b0323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8d99dcd0323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9f3748a0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004808ddcd0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
5484	elevation_service.exe
5484	elevation_service.exe
5484	elevation_service.exe
5484	elevation_service.exe
5484	elevation_service.exe
5484	elevation_service.exe
5484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeShutdownPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeBackupPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeRestorePrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeTakeOwnershipPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5156	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4496	AgentService.exe
Token: 33	5984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5984	SearchIndexer.exe
Token: SeDebugPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4120	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	5484	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 3604	5984	SearchIndexer.exe	101
PID 5984 wrote to memory of 2880	5984	SearchIndexer.exe	102
PID 5984 wrote to memory of 5960	5984	SearchIndexer.exe	103
PID 5984 wrote to memory of 5552	5984	SearchIndexer.exe	104
PID 5984 wrote to memory of 2548	5984	SearchIndexer.exe	106
PID 5984 wrote to memory of 1320	5984	SearchIndexer.exe	107
PID 5984 wrote to memory of 2072	5984	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2824 2812 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2900 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2824 2812 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2900 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 87e5c728d50ac72ddf031881318fc74d5560c22bfe769d1c84d65bfc22a08785
MD5 275a4622a9156dc196c505c67216a41f
SHA1 658e6bc1b6a88d768778757ec2de6f1e75240e04
SHA512 1cd89b3889ce187a52e878a8a1356593042c71989644c5252a4265150896db68347e0ce003a98875454efbbfe5c9d97820ae39cc1415abe7311563b9fa862a76
SSDEEP 49152:7b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnqLNiXicJFFRGNzj3:J3q6mjB17wRGpj3
TLSH
T192D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4d511aaa7508976e50dc5814b78cd0aa01d5be04ab6406354f414e050075a7ae
MD5 8d264d8ec84acbe9dee3f01787d185d4
SHA1 c99cab2ce22cb9bf6dd1b1cd532e78665aad43ca
SHA512 65f2b363d3be6871b560c4535c5a7602a32b63f04f4c5b8ab7233d1f0b346dce880d9c34114b1b06b9ad0f39faa3cff7bdfa42ad0d4ba26b5907973c55dd4348
SSDEEP 24576:PXYfDtczA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6tcwLNiXicJFFRGNzj3
TLSH
T14275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a22c4cb12e4406a82a707a72776273001f76290e8b8f9617f68fa96916cb5f82
MD5 8c8072bc91fab0c886aa2de6fd5da3ad
SHA1 37b3d089497e76498766cf1011d2cc878ad7e766
SHA512 9174a8f856afbf3275bead7d7870d110a462e968ec74fa4d12f1a22aca64a716cc267af53ac2ae2c62e5a64933f2a986b11865a55b7230a594d57fd8d0b03543
SSDEEP 24576:A0Le5ji0hmxhrMi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:APji0AzrLNiXicJFFRGNzj3
TLSH
T10D859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cabc5129cd3fafb4cd3ed2dcea833c85cc89fe9400032a91e4d7cf988215d9e8
MD5 57ea3181024514299b08063240ec9d10
SHA1 f9bfd688ee661552781f30238065f637fbebc83d
SHA512 f8a726668d4e7d48a26bb305f2c634a3e33681e1dd79ce81cec8869683250799dae14e302b81d83fba1543357680db2760ee15e6e12c2ceaceae5e2c4d99971f
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWj6q8wyug/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:D/ezSC6vUzPv+HjyfLNiXicJFFRGNzj3
TLSH
T1DB756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b949981d05fc7213551edad185adf81f01500ea2c86335c910f498156aa7a8e9
MD5 ee838b4cae6347159ee7686642950a28
SHA1 9e4a253bbdfd4782f896d5a9a90c77d748e4aa6b
SHA512 bfa82242103c6134be161e7c7b0cebac893f934637976f60a3dbd47766126a41b7e0756f7fddccb9eff7df1eaebf1f639d01ba270906a13a22a245e506df2379
SSDEEP 24576:hVbqPb88hv/l+Bl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVO88hXl+LLNiXicJFFRGNzj3
TLSH
T114559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d3ee1a28c259a4ebefeed643ab5684b18bb7016fac4f92fe42c5984412187110
MD5 6065076391064764be400adcba507d7f
SHA1 4db4fddfd630483b9a1226d5ee8b4f3d6eb85fc3
SHA512 c5945c68c1d308959454ff94813a0904a92c8695889b8663654e23544c75321dcd4a2187617f31d9e1efc9f36fbeb68698286da093df52b0f5fd24926aedb4bd
SSDEEP 24576:qGO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ILNiXicJFFRGNzj3
TLSH
T1195523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1fd028b1c3ced1f65751ba751d2685648a028ff38a206b2e5d5dd9643d1838f4
MD5 4dd5d8cfa1938b87b019594d36f6e3dd
SHA1 64af3085806acd95896e76b06481cb762ab5a1ba
SHA512 6bcab3b3e6292ef6cdc6456cf83da0852a9db7d0764df992c343a65bbb6a5fd11770cb3001611e1f21cf0c1ed7d7e8395b76879b4defdc54f513c8b8065f5ae2
SSDEEP 24576:xJIU9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJIU9LNiXicJFFRGNzj3
TLSH
T1E375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ae368d72cd7531607ef4843d108f50effc33f8bc98c328f646809fcfb805d438
MD5 a85f13ab9f453b7495559256a25b2857
SHA1 711e48719766fb7db1a7d1dced3a34ef8219aed9
SHA512 039207fd2806b10c995b39d66634cad848ae3376c95cf2a51c714e3a25fedc3415f6be8a5c1e6d9ce3771c77e8f37cbfcdddc443788fadf4f6a2377002a7c467
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:OQvGAdlCEL8c/WRNw5CQ7wRGpj3
TLSH
T143266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b889d6887d5b21eab19144057be069a87c021ad3ff8379848431bcdfda8231a9
MD5 36f20daeb025b3d980e7f6701405f7c2
SHA1 da97fe7bfb7bcd7a13c119bb89b42aa0f7d76cb7
SHA512 8447402a97b593b38c77bcba631ae3668c2c36e9e941a1910f8f996808a899c99a9006b21b0b020d3cba5ba31266fe00463d2707213ea562fbb1afe11a410320
SSDEEP 24576:/fewsAjb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HljbLNiXicJFFRGNzj3
TLSH
T1D575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d8d5db3603dc32436615fb0fd5ba3e95b09f707f6a227dd9bdd65df4c187404c
MD5 888002cf6e8192dc3b22b583d0eeb157
SHA1 03670c589254d5e6a339891a269100bd288edb9c
SHA512 c7d6fd3ecc8c7e655ce654e26c41af0b3eaa6241070147df6c4a7bbb9ae81a4c12582a1678907b4b2bf7f9c1c79ae906ff928d703dffa892142038e076a8831b
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3F9:ZUEtQevvqc2W1cpV20I3219
TLSH
T1E0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f19d964a0a27aedd54c16a84c41ed1eab02f03ab62ab546ed05d7750a2dd7840
MD5 2f5d9256b98a50f697130054ea084452
SHA1 92eb62bfc3f313aff9c6988f721e186db173396e
SHA512 deef178a7248469d463000de6b5b4c05134247f14a10697dbe1dfd7654c2cf1428e725958f0db4d6cadb5107365da80b95fe3b5c2ad7e623154886b0a9b8fd87
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/z7LNiXicJFFRGNzj3:Noq2VjnmU7wRGpj3
TLSH
T171D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a6e39ea636cc04167200ab280dedf1d5f583f044f3e3d1261e8ccb6f83504d29
MD5 68713fe0ad360294ca08af028dab3943
SHA1 05401742cf5f2061b1dc16dfd37cc462903dae07
SHA512 7f5d26dd8dad92d83c2417dbb59f9722892dc706a7ecfab91c8d0df93d1a174d414a968b70e40f38cb49d1a992d08033d7d9599269506de66e57879f798142a7
SSDEEP 24576:OAhGL6IFoiwtA5l7S530/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OAM5Foiq5ELNiXicJFFRGNzj3
TLSH
T1B1359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 915c61be06f8ea3ca87420686df47efa613379fbfe4ad285e8ae611dbb743b4a
MD5 5998302207e3d6e3ab47c5024f4c9670
SHA1 59a4fc92e656004f8b1d50f3e3fccc046b6a3d24
SHA512 1b458e2518c6364bd78d3f26e2beaeb2f86e4a777dd6bee95eb70228d6f8ba9b119a2fc689b894cc8427b83949d0893390fc03570b9727a191dd3d2c2399029c
SSDEEP 24576:3wuROW//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3wSOYLNiXicJFFRGNzj3
TLSH
T16A65F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4e8936a22cc4f62088de8361d85cacc7cadb7652f1ff8d48b51e5b6af64ea153
MD5 01d1e316f09958ad5f0e062762acb202
SHA1 edc7e0f90b0c399af20cf5f44ea3e280414cd640
SHA512 c0261b2b52ed8ecd76b6b603a8bffa951ed067ab693c1216202c27d79de9789e24686de16b020f8683b38f60d805fd2c74f15d013116de5d07e83a67f60501aa
SSDEEP 24576:wZua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T13F55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 275ffd46538f0c9a192d0ca5c699a3f7c1d341ab019fab062851df9c63fb016e
MD5 4db9ac5c3d6c092fb3bf1064f7e57903
SHA1 c603c4b2cbbe8e3679aba69ab1a3271ea709e653
SHA512 83e13c8a105f2064f47eb7510423e0dca2f58fc48db8897951fbd37941f2d4a76885ad131c92638a31608ae422fcae9a7ccc3ad2d9c126f772f78791717b2f61
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:WQyiKanX+PNlF9
TLSH
T142667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0d8fbaeb23a91d7102f1387a35a5832af078106d3fe4a1b69e7e0a119e84bc69
MD5 574214820ef93d0f2aafc1ab1789d9cb
SHA1 680914a631b1b754d72740c19b176e29b221efd1
SHA512 bc55b4c9f33839cfa2ca51d12398fa4f10a46c21febc7daa8762fd225d97b45b40a240e7db8411e751970610c88271029e288b2c06d5c3f4b28970471b2572fa
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:ZQyiKanX+PNlF9
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3a637a635091d9d1dc8148d6e920c03f7f39f9c3160a6533c0b53628592e942b
MD5 fcfa47ec4f39bc88be8ae4730ba0a41e
SHA1 36ce28eb963d1862c051176862e922e1e5480bb3
SHA512 1b0b566c63fc762393b5c1a00d7a9f66f8f9033084e718c84f2206fde18beeec3a91acb362921b2078915eb5f0260116b4ec8034520bb37e602b328798d500c6
SSDEEP 49152:F68Qg55nhkeWu7PNU3/rLNiXicJFFRGNzj3:TthTRc/r7wRGpj3
TLSH
T10EB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9fa8eacc1608c772ec0fb7a725767ee4205b76943f14a6bcbaed22fac6733faa
MD5 e1489560a647f6df07ff5dbf413d6cc3
SHA1 ca2cfb30333e894998acbb8083496f5ce42fb399
SHA512 fad4e9acae8bc6d650c72737b6e160cf3eb77341e09726f229611afb7ea7fecab9b8849532acc6f9516144c7c2424af38757de9f6ac59bf24639b339bf429f5f
SSDEEP 98304:Hy5112gYy5azzVvU69nLKnhZO7wRGpj3:aLIHRWh4F9
TLSH
T19E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13fe286af4ddc4f9da7290b3d781077f41de061c03beff3b6aafcd6b43251f9b
MD5 13764d6dc4ecd529e591c51043d40118
SHA1 90a4ce5875267b5a2c0cb9ddda8ffed8586d8131
SHA512 2d54a23363542881793e67b14783b6a6d180a3f11ff69b934dd14ddce2a57396ba55242dc53ab21830905060f888ba704e220a746083e9b5025afdd93dc4b4e5
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:7u6JmIxd2dJ7wRGpj3
TLSH
T1F4D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b650a78d4589788c21dd14b15ed8324ef256c4e0d7429ee35f51f057ffea87ff
MD5 fa7eb26d4a7253c3644f8d6fe91ef214
SHA1 8fd7d5adc17dc273d29b28ce1ada458de64b0fe3
SHA512 304465b96336b0e3a837d7acf4f117a5ce41d801ccf9c1efba5d52d5233a0ad507a503ad17b1e5a082077543e5495de6a5583395037c1cd6c8864debe0692042
SSDEEP 49152:A1hpsNoJpF1A67U44CwH7R4xdLNiXicJFFRGNzj3:AmifPqRU7wRGpj3
TLSH
T17BB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 699408c33bd10a5c5b8cb42cb1d783ede7731120f4138695a3b66377db9f8107
MD5 e70d98ab803eac31d6ae387ae946c118
SHA1 d7bcdf364ddf543d8f700def4c7ec4ba1f401906
SHA512 9a0b61b112477413783097ecca77219235e435bd718bc3b6e65243a458f180eeac4e4f02bbc1702a9a411f03644e3a8aac6ae999f7d579f3c7cc1adfd55942b5
SSDEEP 49152:MSuZQIY0Be2KkRVtOnks6NMHqaLNiXicJFFRGNzj3:u5dKqi61a7wRGpj3
TLSH
T1ADC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5b728aabda3344c6e269827f21fffab50d7a34e57148ce9eabf27f68543cb626
MD5 c95e655d0c443c4da8d8dd44bed30fa8
SHA1 c6dbc18a7d6e2e7b7f4eb3aa7766694c8a463a38
SHA512 335dc62aeb9ffeea64f2ed10cea5240798b6af28200f0660e6de76d83580434947c93d76c8a1553910375aeec559abd2fd141ec95745dc2aef4db1138a1c63f4
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5w5LNiXicJFFRGNzj3:oX2iWph47wRGpj3
TLSH
T10695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 347b30d63104b5cc75016ce318012955e2028b692dedb3208693f9ef730289ac
MD5 01a07f767d5d6d7c826c4904d1e697ad
SHA1 725e37b931649332cf1f27366e034c9563bab424
SHA512 a7ef70163b8dc9ee25c7ce3ef1f9164d762501d6077d455e87a9f0463ecd0076c7f11eecf7cf91623b798b4189722cbcbd74bcda05a077392f47225c803917fb
SSDEEP 12288:e8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2b97e06beef277c95908d39606df9dfb30ff989e0882d39567b8b076976bf32c
MD5 02db276c1f130ab55e8d03b8596cb149
SHA1 46d25f24bed00c3cb10b39e83be8d961e4c825a8
SHA512 cc44375b0748eacc2061119a601a8d7a2e759500fda4fcfe63c15fab514d05c65354d5f4862b5c4e990ee8c0089a49d05a2b58cc8741569030017dd94f8d8516
SSDEEP 12288:wziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3548955B1FABC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c3a86c1694100bd66817c9d00147d98145bce97223ebef366f51a752f5c5d889
MD5 00b3312f13839a79327bb491bc3bd5f0
SHA1 7030ae0b2d4b66d5fb5e9ba56da12746da702f04
SHA512 e24c004eaebb051409862033da5865491d1b5032af9242756e42c8e24ad36bfd178920bf2ae36bca0a5fb4311a31fc9d289d7c8bc1e17a88ff76c5352dc8cba8
SSDEEP 12288:hpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 691e55249039bcee083642bebbbf2b18bc62ac9efbbdf98a7a16c35c509c32cb
MD5 42d77d000bccdb354de680cf36cb18b0
SHA1 30a8c8d544e346f3de6b8f47eb36217013ed88a9
SHA512 ad87546f92ac74275d9dc9b726e1ed170f5f37611b09e2168b0f38cbd4546c3c27c28fdcc38f7c82299d330729930a32bbb9f1f3efe954c11ab729b7884b28a5
SSDEEP 12288:VVyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A552392168900F1E9F9803DCA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4ee6f991a9a019b3c3dbcfd329f7f024411160ddb68d951eca0af65a15178551
MD5 85ef5ba289e3dda49705dfd829f80fd6
SHA1 6694f1b188079ed9c14e186e226125802f498601
SHA512 55b5df0db4e1b593a5a4b587679c95b8aab687b918364d659deacfddf52f81bdf33ad977059b6cc9facd6d406dc04b765182fa109183d1da279c1fdebcd85079
SSDEEP 12288:saiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b837bf8fee04a110ebac04f7c72f53a27bdd7335cfb8721c754bd73982104359
MD5 3d8eec219b6f27bcc52d7b452544238b
SHA1 f2d16c1e0f482f25f39345686466b1422ac59162
SHA512 a0bbaae1ecaae94888c256d98787a9f8fb1643e60a4bb75aaa14331543502d0ce13961c894713407576d4f8bd171aa1cc7a55717d12c46ebf331cadb630b4918
SSDEEP 12288:7HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D3548955B1FABC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f520b16ee8488fd29252556e67394d5f3cc87495965e2961b5ec9f3cc232a8fb
MD5 7616a5b4c6bbbb74c1c4b3ec62ff11b0
SHA1 84e12ca0ae7578b21960d64cfec7b6df49029075
SHA512 3cefe5d4fa4d6af3e40a2e49e3bdb291b9e6f810f7882057518e0de09e3df9441232da967b77b75ad1cfc008b1a347fba3c8d791095ea1a2b3042d4e68c14033
SSDEEP 12288:QbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e82556cf9cdee607a186a5dcf8c0e74e44b995ba3ce48bba3baf15247ed58c25
MD5 ee6a2542f34b26d6e7c4057f9a2b81f5
SHA1 2a371d7a5cb1119e44119129bb33cffa10d5376d
SHA512 7b221d725c61140d704c8c8e822bd1ce181ed7d5c70b0176a136641fda723a7e4d51820c2bdb9fc3e53fd9077d9f234dbb9079fa0aee038f168f137f381f270e
SSDEEP 24576:BZM3zFVSOn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BZM3zfjLNiXicJFFRGNzj3
TLSH
T1B0750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4d05113a9128d6a382797c168a308ab54e7733828bde00108002e3d5b06c3561
MD5 b54d8bd0babdc125d6b0c9134e4131cd
SHA1 4b2d056a5fc88d2e28d57a079085ab7956d038f0
SHA512 38a390d94499f4d9bf6321c8a091dcc45a4b0d2e8db547a1f83aa5d9d423f81f7fd71e9c7614232e6bed2a742d3af57650aa574bf07aae2635a6293bde14c288
SSDEEP 12288:F4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 60267de778af3c6450d357143dfcd14ad9ff91d97c1bf77e7f5b6a24eb111416
MD5 7e13da054eeac89ab664b4c3398fd68c
SHA1 3ba6354483049e8fa73322ad4e8972585a5e0c42
SHA512 148db1e1357256dd34ae618a8ab1ee99c7384c47e06fe3e49d863ce0db54d54be5d235927c79d91d8520d9ec2d32fd9f12a4174f0a57d6a7f2ddd09f8bdc65fa
SSDEEP 12288:/UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f1562baf55e30853170b13f3e52b95b9d30247db3c2112bddb195b41dfce8b8f
MD5 df848e09c115cbf7c39c20cdaccbd77a
SHA1 9ad8ea949f844b9df8cb91fa5ce125c913cfeca5
SHA512 8b8ea879d319bd6a7e3a497e680176c71917724d6754715cfae276e3f3c1f51d02636242a375c94d9e6c0c61471aa78a46754fcd9db338652fc24f93c7e311ee
SSDEEP 24576:HzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H4LNiXicJFFRGNzj3
TLSH
T1DC650247629530F9E17A4139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 209cc8111fafc3cd0a1ac3e63418b1e016e31e4ec64abf9c099c22a90ea22763
MD5 9030e3face7df9d159277423a4e7470b
SHA1 8522717b2f53f64dbb8c662817971bbfc1dfa0eb
SHA512 01097a86d76a808889ba387725f012f9d1c3fe6049e3b773ade2494d74a3472313894b655a9e8dd009904a3bdb5b6130c1b94f239cbc519af15ca3027d035135
SSDEEP 12288:F4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f269ae58c5c8504959f100cbe4ca334554196c05ea101b2148a5d6ac7591d326
MD5 40845ff1e73cdb96d975aea1fcbe0314
SHA1 4ae61778df80bfa62acd7ca3fefa96bb113142bb
SHA512 c82a2d39510a44aa390df22c6011ed979ed543be605fd74286755c5c42e8b3ab41e3e61d49b16a969f3e8e292506fc7bafd39649976aa5b92bef15944280607e
SSDEEP 12288:H4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d9fc7cda1da5dd33cc8ee3294a9fde9f92863f87947d8d0614a8fa1bdad3dc8c
MD5 107b3066b8d191179a4cbbdd02485bf7
SHA1 5fc807a35cbd95cf02c059660d938c4231088dc7
SHA512 af98328c87c020d55e02faf07bf17cf0ae5358bee488d585cb0c8bc4a55c90fe78830ef2f2414a91016f73d18c83e2c02edf8a584eb8136abd86a19d4c5ce53c
SSDEEP 24576:FzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F4LNiXicJFFRGNzj3
TLSH
T1DB650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c2f8517104b97cca0e15e25ee9ceb08684242614fb8f79eaf23bc5595be3768d
MD5 2bad78eb5c323cbdba481f36a10188df
SHA1 c7ba6f206d3464de62b8d27264a09a9a84feb75e
SHA512 eb5dacf5079235d9f06e910a516e09f6709d21b9f884b9b42a8b39f1ee4ba53ec3769b7132522be3878cee5f1955350e48e296b5c352e714b808ba226cc071e7
SSDEEP 24576:tT8aLl3z0zDF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tT7LljgLNiXicJFFRGNzj3
TLSH
T18B7501A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 48fbf9eb8cbec483b89b025b8853d6b0c186a69edb61f916c817d496ae12cb2b
MD5 159eb6e2c0117a734386c13c9b11cd19
SHA1 e5382bb26d8bebe9f30a5b4a0671111bd5778465
SHA512 a3fb26d810862830e01442f1d0d60e885c1032034c4050341471b84046e71aaf9aa3444d2cd9f03b738793b44aa72862edd878182a0ac364d593373f8059f5b0
SSDEEP 24576:H3rd9CHKy7GZx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Xrd9CHKyajLNiXicJFFRGNzj3
TLSH
T1E985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fe12b60ae16b70c4c5c6b334c237ee7c87fe0ce40638977744dc54d529e99c58
MD5 565bad871717873b952a61296202982d
SHA1 f3e0af72a9adc61bca933572483d2a800dcd875b
SHA512 9a9b8873c39abc010f8f472c0f71a9b65f4cd2aad258b7ba10b4c3db3c2238da55cc42a34dc27b2a5366727979e2066c0d5f533060c88addb88adc7215cd7d03
SSDEEP 12288:KJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 959b1bcf43e52bd11812a692b4705eeb20d55bcc1920822c4e98a38ae4284787
MD5 69ece03f506b0a1308c81ac517320344
SHA1 b1248af4e718ff1b9e23ee54b9c27cc574f2f25f
SHA512 68e49ad8d2972cf45021b881dca8dafd90fc35d5583b15828d5a65c2947b2beebf08f66474323a0538dc47e86c0d2eef6a7a75f93377d3a4e0788f6f1b058327
SSDEEP 12288:HfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1845523D2548945B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 39141baae31dee5054868140182e419714a3b241f21a51c2021df28aa97d4dcf
MD5 d8c522ec49c87a8e7db09638407897e9
SHA1 671b4d1e906e8563c5e36c85d8a4b400bb4454ea
SHA512 3472dadb99f512de78104537d223ba14eb009b4787efe666278ec6b692a07458da2ca98ecfd547189a134d91860fb287981623aa743a72ed650cb967285b89ed
SSDEEP 12288:JeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ad24d066544e93785fb495abbddd38395de6af7a7d8e6d7c477a058e6281397d
MD5 74c0cb7adcd3505e67fc0ae7e1ca4939
SHA1 c4ca1b3c77dad2763f744ff3638a6ddcfcf5b838
SHA512 b016eaf06c512b10da58d1b0b5dd8679c4b40eb6b6acabebd9389a6032e24557df950ae7cad269eb9220d9c980feacfbff0359ca254502e2b5cd3af19f54ed59
SSDEEP 12288:N4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 73a899e0f04b7b4401c53adecb0317279fb95120fa34cb1931ba29161243cb87
MD5 95f3df0fe7050f0f44bf4464a9dd4b05
SHA1 a061d4c3e27b2ae6522e9f46362e2addbfa0a380
SHA512 e492bec0169add6631347c38330159cede7dbadab13f1fae78bd381e029d7eacab43f5380b29f25e0529fab1592dd2e2101361a2756d5c475eec3111ea7a509b
SSDEEP 12288:cJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3548955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e22f500dc8c7aab2886af3c4fce9bb420a68fa61b161842eb21082e1c5142195
MD5 347bf474775cc2c82412b7e74c5dec87
SHA1 1efa29a738247fc147efd173537302cd7d8f0d07
SHA512 ed1a9e6ac36d320366f0de9eba2bed9a0e0ba50ffea7b0463dbf413d64f7475254b9d760c1e5e3003230c79528a873335797146c0fbb9f443bc410e1c1084c85
SSDEEP 12288:2giJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548945B1FABC003AC6754428F5882E2DEB5659E3E2443D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d6791d9521a7b94fe22223dbc17a6896f04b6c20c8e08e37c9e2fe03759ce307
MD5 cc079b1b945c578c315acfceb9ad469e
SHA1 0e6fba883c220a682c90ec6502872846b127a435
SHA512 2a0318efafff6b6db1b327b2a77ac7420a64c2a4eccd2006974e32dd9d35d055ee92cfb6741d05ba5c0463ff794831b3b18773558e2024244e5d67ed91be7267
SSDEEP 12288:CaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11E5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 956747b9d3653ef5f6257cafe936a6931d5ad5b5acf91b932f16dabf15127526
MD5 31cf587edac4c821d740db15b76fc0a3
SHA1 4e7bc3052fd77479c520c5d386ea4847f25e70a4
SHA512 d56fdbc84cb6d299dfe34c54d3a11f966bd88c92464d419547583eb83c56acbd888e16ec57cc1ef45037befa23adbd74812b120b28b6f793f0a1e968802aac2a
SSDEEP 24576:7fwvzk9RX6wkyAIu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uMnYIuLNiXicJFFRGNzj3
TLSH
T11585D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dea330c7583247fe2b3438a18401fc08c6036f52984eb21630717a522e9423ae
MD5 8b7908d4bc13998c945056568c9d0a83
SHA1 b0055eb4981653a0ffd9c38b5fd2fc222761f33f
SHA512 b19e22156281ed8156d2808a4aac8968ae1ac0fcbce03c2366cd8743a112ed1572563d38ce835fa9032cd617238144fe4be55a9efc5e53577bcc3a7f4af16d52
SSDEEP 49152:mYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZLNiXicJFFRGN:pySzPx7wRGpj3
TLSH
T1AD066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9bf92384b9bacc47ff4a717194d903f7c8eaa09bf0dbc0ebcbe9b8b50b2082fa
MD5 940d2f88f61e49e2674fda4131cd363d
SHA1 f2b0ff1543dc29416689828fc58b6c7f230b2996
SHA512 185464eda7e9a2cf721766134c2dc1fc90f6bac740ae3fa47d93947f63a5b7a53ec6769783052074632eaafe3a2d3e8c5158fb28ce4bb5934f5b5aa90f15af71
SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l47JUQjqirIhCnDHUPfF/JLNiXicJFFS
TLSH
T16A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9ec093c3e6319bdfa0686cfa613f4cb2e8b2b9d90b97d48ef28f6d95753aad9e
MD5 092bc05ba0290df0365b3d1d92c3cf3e
SHA1 0dd67788811a7f2c960bd9e50260f79fc4b2e1c8
SHA512 986b613c80dd3582f293d304d2fe5b50a56cd8e5d69febc613f7566c289a1797a1a20add07b7c371a2bba95f7197a003ab7696071af979def71d76acb6a7f635
SSDEEP 12288:6psfoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ta/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12465F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 921eb67d43fa196b8dd16b719ee5f8f38879832d2103ff9f41e44584312ea141
MD5 5c3d69edf07000a6c8903b5b3530432d
SHA1 42bb23c99a2e011b5a7ff2cd389d5ef2b3d327d6
SHA512 8ba6e898f2890b694279462c56f1fdae3a3cd43bd2b117578fa2f7e233eeca226588dd30aaf84f1859e33a29ef946f387a288318f652b943c28c7d9905d21200
SSDEEP 12288:AM3PeU3fMNV+oWa4XaED8U3iDnbRd2VhsR38Smba:AM32UPU4KED8uiDnb72PsR3w
TLSH
T164350640762BD78FC6A944321E36D6CCAB70BD01EE059F0772C9473FD576668BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 09bcaa69e3bda10f8e5fa01962fb2840e0e45b67171904e4598459483d1ee030
MD5 6ae7eea49bff412c2bfc0e6905edefbe
SHA1 2d4b5470600347b95c40a0351e6360d5666a348c
SHA512 09db1379632a34a92bfcba0754d21db6b191928b0605be81d3d4d13b7fad464a757e6c57920de37d8e4ac0520718148ad32601852d5e954cab08881a10b59e69
SSDEEP 12288:7A+vIniLaohfNf0a32u+ERqoJ3M5FGzTIPAgY:7A+QoFxmruqoZMvRP/Y
TLSH
T1DD453A40A4A7E35FC9BD90374336D78DBB746C02B7453B0573848A3C9867A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7943b2f41bcdf901eee5b6b7ba105a9d2a3086fd66435e5938f113d56246870b
MD5 7d1a811e383da9a50bc199f25404c941
SHA1 0df33035dc977fa9d18b7a8b5b7b8322089415cb
SHA512 30cb22bb77bae629ccfc2205a9e5037cd9bd027b43263ee664d20b9e5b0b97c860da1a0d072da7c81482573cef58c8b5b09150a86335dec51c79c1a40334fa9b
SSDEEP 12288:JF7QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523A3468C59B1FAFD1039857A8434B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a64c8c420487e5891ca730a31ecbbb7258a40025c1dad53f4438f0e59957c790
MD5 87e8fd9b9cabc72eb83aa1527f6d11f3
SHA1 922cd04e1e2662f3115b5295988e4d3f2af0b751
SHA512 fd95e408ffc900fa034ac37243445ebb9e72abb1c7f7fb41ce0b45e741857dbe6e59e440af8e7eeaa91acf702faffec5de84eb82b7944a6d9bd34f61972786bd
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zgb4mBIBhGFXLNiXicJFFRGNzj3
TLSH
T17965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a8481df659453a9659459cafa95f15d3b241d91ae686a666d18b0bc76e493855
MD5 f8e82ec2bccb5dc9e8870e08a43b0053
SHA1 802914a692597165e67279d940cd5f00bf214abb
SHA512 219947eaacdeafb415ed13d5568687f891853302d88273bd2da6a886fe288c3076f5865bf919eacab74c345c677d96f4b2649c29d779a60604a3ab9a402d07aa
SSDEEP 24576:HG88u8FpJqH1vzria7/mn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m7ZFPqVya7/ILNiXicJFFRGNzj3
TLSH
T1F985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f229a90abcfcf85875df4c03e953e9f149d4910732e6af51e2bb533103ce3d0e
MD5 594c2efc24548547f057216a31d0747a
SHA1 75c117b1cdad0be82e0c080f2e5227da5453efa9
SHA512 cea248757217a0288e30506e0d4452ea1e22b4f4671a199223d07b30d26f0345741e70bd875609ff1a68a2c4c34ecbc5032a5b535c08644f9ed78238ccf5e468
SSDEEP 24576:EPUr+NQj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJQjLNiXicJFFRGNzj3
TLSH
T1CB65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0517E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 99cfed0e1b837c980c6782f8730cf1de294715ebf34ca1d447cebc29f7e1ab79
MD5 fcab946356d38e69e8ec902824ebbb24
SHA1 ee3fcbc5218cc0bdb54a86cf68df5b9f4f5451ad
SHA512 33d4a2997f463e2ce0a18984eb0ea23d771a45880837462ed574159c2ff3c88c998f3bef8371b55b9febcf3feb11be9ba351cd6075ec60e8bd6c1fe4482fa87e
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzLNiXicJFFRGNzj3:dG05lO43b27wRGpj3
TLSH
T107D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75c9b3f60fd6faba8a8ceace8db840247882fcb91f4b9f1870a3083cd4b90979
MD5 fb032005941654fb7a6d5ac1d1afd88c
SHA1 00af0fcb5083bfc498d174e3a00183d3b067dbc7
SHA512 09584c4d27ed74bc9f6e84ccb4d34ca8c2e5d539b31f8574f6ba1ab3c033d5a98821cbd80a75fdb14ca262d03d7e4546ecdb68a5c4b10feec8b3b7cd5ca43fbb
SSDEEP 24576:Pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnZ/TwSfVcYG3K/cJHlnFR+IGNe8jg:3a5POZ3lJt2pasx2+mrLNiXicJFFRGNf
TLSH
T10B65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 767c1c77142ca77639171cece71d571c6870bab147d57bed36d01bc92eb49e82
MD5 55a21a308aea73efa7f21beed9217562
SHA1 f09e93986fd7b56b22bf1747a813888bd32d5c2b
SHA512 9de6fc7ce11b7ca2abaf3fe23958966c96f0ff14b03aa886e696087fa183db7d09408512e13416f93753ea024216a0ab48df10475e17b6a907c5aa9f8acaaa64
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fkf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SNc/zEOVHFoLNiXicJFFRGNzj3
TLSH
T1B4858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a453f9ea03e3ac71f81812bc037c1418fedc897427a46e40f9677f782b05f3c
MD5 1e9b740460d4e49ddcdd696f6762b133
SHA1 425d19039921356942abcd861965c6abafd62182
SHA512 109d284f7a1b4bb72e72e5fc8cdfb9a7d4533090af654a56ef76d2c54b04cb2f03cccaf89d55e62daf69c17b77bb7e58d24320fde00cecf810f3ee50b0ef80af
SSDEEP 24576:pzkNvNnaFeYhJNtmZBmt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pzMwBtOmtLNiXicJFFRGNzj3
TLSH
T11E55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fcd04ddd06c68626360628e6af2e777bd73e92dfd562bdc11787e60423f987ed
MD5 08c1e5c413e0809f15ce474f67f69faf
SHA1 2604ce9ea625ba52bdef3fa378810893838b84e1
SHA512 e39ecee4e89daa09f4724fd0841dd6a84c4d5ff9f1f12858cfe99197e83ad6b8ce7171eb1018c10d914cacdbaa8ed9c348551f11048f4cf9f5882c9e6965f2b2
SSDEEP 24576:5D3FHshBIYQgAm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5DVHeBIAAmLNiXicJFFRGNzj3
TLSH
T1C975E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1916-170-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1916-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1916-53-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1916-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2716-38-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2716-44-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2716-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2716-48-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2716-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2908-118-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2908-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2908-121-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2908-112-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3636-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3636-106-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3636-312-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3636-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3636-100-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3636-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3640-71-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3640-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3640-245-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3640-65-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4120-0-0x00000000012A0000-0x0000000001306000-memory.dmp

Download

memory/4120-75-0x0000000000400000-0x0000000000C64000-memory.dmp

Download

memory/4120-8-0x00000000012A0000-0x0000000001306000-memory.dmp

Download

memory/4120-5-0x0000000000400000-0x0000000000C64000-memory.dmp

Download

memory/4288-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4288-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4288-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4288-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4320-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4320-283-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4320-76-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4320-82-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4496-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4496-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4496-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4496-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4496-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5156-328-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5156-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5156-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5156-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5156-86-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5156-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5484-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5484-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5484-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5484-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-327-0x00000116F5290000-0x00000116F5413000-memory.dmp

Download

memory/5552-405-0x00000116F5290000-0x00000116F5413000-memory.dmp

Download

memory/5552-326-0x00000116F4F00000-0x00000116F518B000-memory.dmp

Download

memory/5984-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5984-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download