9a9fdbc55d923cc7b3f8ddf20b25f840738420ee1ae7044b94cee05cdc9a455d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260805-jphpmscm5w
SHA256 9a9fdbc55d923cc7b3f8ddf20b25f840738420ee1ae7044b94cee05cdc9a455d
MD5 67b82196a3caf702fcffd71a7acce129
SHA1 ee48e7acac28961e5e59c51591c17eea92cac853
SHA512 2c53d9c31e10651fc5747af2daa32ed510e310024afdc8d928969067df928aa127de71799a22d35287ddbc7c9a0e4eeca866ef6f5a59bea01a2833a981c4f427
SSDEEP 24576:wMbYBJ1KZtRBygzbyguaBcTFD7J37ZE5unQ/tbw/2Mkjy6Fr7g0oZ:kPctRBJ9/iT1J37q5uQ/lFTjN4
TLSH
T17665AD2277E59035F2B367319939831499BABCB29839840F73DC662D2F706918E74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5372	elevation_service.exe
5392	elevation_service.exe
3044	maintenanceservice.exe
6504	OSE.EXE
6400	PerceptionSimulationService.exe
4836	perfhost.exe
4800	ReFsDedupSvc.exe
1372	SensorDataService.exe
6236	ssh-agent.exe
4588	AgentService.exe
2796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1210f2db957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd82b61faf24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e37ea20af24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008710f063af24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c678ff63af24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ec00821af24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5372	elevation_service.exe
5372	elevation_service.exe
5372	elevation_service.exe
5372	elevation_service.exe
5372	elevation_service.exe
5372	elevation_service.exe
5372	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1500	2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4588	AgentService.exe
Token: 33	2796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeDebugPrivilege	5372	elevation_service.exe
Token: SeDebugPrivilege	5392	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2924	2796	SearchIndexer.exe	100
PID 2796 wrote to memory of 2868	2796	SearchIndexer.exe	101
PID 2796 wrote to memory of 5376	2796	SearchIndexer.exe	102
PID 2796 wrote to memory of 3740	2796	SearchIndexer.exe	103
PID 2796 wrote to memory of 3760	2796	SearchIndexer.exe	105
PID 2796 wrote to memory of 1772	2796	SearchIndexer.exe	106
PID 2796 wrote to memory of 7020	2796	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_67b82196a3caf702fcffd71a7acce129_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2604 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2604 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:7020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78061e9f6b1aee001b80b5f3380fb5c3712983cd516de6690444cb85b121b615
MD5 33c19ff94d73675c99eea3fd576bfb53
SHA1 8cee565a9b0865ea9778f64e8a3a6761a2ab12fc
SHA512 ac70f54c47c1d7b8a505277995329678c8ca1a45eb293097e7a19e7bba60f0b4de062fc903e073a84ff16425cd0450b22439a375f277ac353742f14745385871
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxngQ/lFTjN4:Z3q6HjBYLm
TLSH
T1B2D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 164d6a54c045feb332949f81bf4e772ae724db6a87c52212add7ea9e8f85eef8
MD5 a00144e94c25a67c0f1deb10c9b8c744
SHA1 0ce29a1fb15da26e7e09089d6e5afdc5c00e1b1b
SHA512 08a6051c06a191bc5f99368116ee8ec9e1fd2a4246fef9fc8b561589bf9cc9ae198616175bc69cc394e26cf726202257bb13502736d66d49fc18528a3fafc4a8
SSDEEP 12288:31XLsswWkxy2lRq2czA3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:lXYfDtczAXnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1CC65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8b713ab7744e1457df347e8ea8eb79840cfb559a60271a2a5ae4bcc9d32b6776
MD5 2da60fa2e0ce0a2af277eacd325f04d1
SHA1 5f04c966efb3279d41e7fa5fb987ac59670320f4
SHA512 bb608970a4d41222e1410917a2819fe502229ae0d180a01aedf00a266624c2ecd93d45e34d12fa4cc4a03192f93d7bfd7e78e994690b57677f4f0e3e63b730c6
SSDEEP 24576:d0Le5ji0hmxLrMonQ/tbw/2Mkjy6Fr7g0ov:dPji0AldQ/lFTjN4
TLSH
T129859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dccfb3f982245453520ba61d2ae5f16f50b61f2f1630e4cb8370ffba5eed5d72
MD5 ca356b048f3bf0afccbd73512714051f
SHA1 7b4b55e4f0fcd25916a37f50c10e861bc4d297a8
SHA512 455e359c550d972a029dab95e3ec70f482b7d0bfe480254f29c5dd717199ae2f51c6987e21da3399993292c209ed68cd9d913d0955ccad79719f7fb1cd69d369
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyuanQ/tbw/2Mkjy6Fr7g0oB:l/ezSC6vUzPvxHjyRQ/lFTjN4
TLSH
T1AB755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9bfdfd3a4a399889af38fe97ed775cbb9a43240a639fc5bdefaa9ce4a65f0153
MD5 658ee4954b81c9395eefd19796242a0c
SHA1 85a640d0e8cb5797a7c11c6ecf42961d9672e192
SHA512 92aa99cc81a87d0f35eb97003c2b8540193a3f603ad25b00ccd13df437cd3c6c6d7baa68c7d4d49c86fc5cf7bc72738f37c23dbfd9a2a39c8edca8d6aed49d57
SSDEEP 24576:OVbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0ox:OVO88hXl+8Q/lFTjN4
TLSH
T10B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 637d5c0e740ff45dfac9a0555d860cdb015025e45bc60df0b5db9738161770f2
MD5 c194d8979b034f48c924e7cf028e77a9
SHA1 9db0c0b635147c0669489aa305b7efc97cbc7aa6
SHA512 eb8f7aedd75e92b77b4da98fb6982d2a2aad222ff0ffde67515966188d484add72c3f61d703a2c2e732f847cf63293911656789167344729edca7ddc50ea7ba2
SSDEEP 12288:2z0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:2zUnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1745523696A24F897FF2B06B15CC384826B7B0EC1BFD5AB4E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2cab58401b25e22ff067261327b44b2c67d2487874a43a2308f9682256787c1f
MD5 2e9dcdc2c083078cfe84d44a8cb2ad37
SHA1 c6faa02344163593b2ee7f4c1519acba03f6bcd8
SHA512 91f7c66e1cbd72c61d94c02ae8c65f27df5157f048f9ec619a5156cb6b60d100473da2850b2237cd3bf8b267eb125b36423cf5aba2d532a42f1dfca57614e923
SSDEEP 12288:beBNUbTVO86U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:bJIUrnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T12D75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 272e6921b432e28cca4bd32c65dae97431f73939dd9f1ab91287399023ee62b2
MD5 825a7437b6fd6a6d951882f91bc073e0
SHA1 a3c30ff709c56243305312b03206721bae10e5aa
SHA512 722a65812ced5f2976427ac28bcc1a2472b94238fcfe67c77b306844ae2d68a740296d84b8666e7af2eae8295e44356e4eb35418d8b8f30465ff1e2bebb68159
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:UQvGAdlCEL8c/yRNw5CFLm
TLSH
T147267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 120cbb9f1e19edff2d03eea051d165ccff1db967cc86ed1a9efbfe2ce104cf00
MD5 0f0e64ec7e024108cf54ab8a8667dc58
SHA1 0e016ee8d4d008ac317b15f39bcae067f0d7c480
SHA512 d2992d946f99f02af2e7f2359eadf92e46971413a9a9ba28b83acecf13f74c1c166321f61c2b77457d5972c7b34fb00d8842e7ea38bd9d10288d66f794b6e2f1
SSDEEP 12288:1AwSfxL/2Dc39DLLmt0LDQewsAjtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgg:WQewsAjNnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a3bf6c42756038fe1baa5b58308f5195c29c4b85e0d94f3a472a8df283d7ce80
MD5 7c43dbc8cdaf66f18299af068d98e6d3
SHA1 d7b392b77e5ee6d3ac85a8ea13c74209a06b645e
SHA512 38a6c610160cbe5ddbbcfc645c36387d171979099f7d8b0db84dc827b7941b3a31d7d0b2795510f2ab95e6a75609e0eb58362fc0fd3d2560239b57f2f7a3eabd
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:IUEtQevvqc2W1cpV2EI32
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 828ed3d277e6f0fbf0e8b5c1195c9e877abe818a750dc3c34ea1e4927429ad76
MD5 73d258cb6c8a389e4c32c15274e18450
SHA1 5786eec4fa24d9219ab4e0657e5473de9610ee18
SHA512 58527ec648c0e4c1e4e29c32c151108cc22a90f67713e7ddd5011d3a6365b787c1db61b8c4df9a6b387b872c27e7953b8996e32860c497ab761f23c5c9c2ecff
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/ztQ/lFTjN4:poqtVjnmpLm
TLSH
T127D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 41d21c041e5784ace9a49192b15a72f868b7c0995c8e57629dd277dfaafdada2
MD5 465348281750b8a0c071168b419c0c00
SHA1 36f5cda6833134ab680f2dced68e854d34b1b62b
SHA512 0dd14dfd14e868257484a4161171014b3ff8991e3d29f6bd30da2239ecfb9356e51d2ba0c4c4e868578d4c31e5894a598aa2fbf16200fbab51c63171ed9b54d4
SSDEEP 24576:NAhGLJIFoiwtA5l7S53unQ/tbw/2Mkjy6Fr7g0o3:NAMyFoiq5+Q/lFTjN4
TLSH
T1A535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b4b16805158f5a1fc74719314d0ff3a72a1dce47d1e4fcda1a49f7eb92d2e4aa
MD5 58adc9cc958214e70fad50f15922672c
SHA1 2f12e12a58a043a59c09c888e3b45f039205038b
SHA512 218423eee4dc78085e0029f8254f585f2a6bce2d4e0a0b11251a67e01e30e2223d4981534c71f311923fc68c7816eb7e35090410a2bc9faf270500134a273bfe
SSDEEP 12288:wmw5HEjsChN2BFgl0WDm+C6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM6:twuHOWxnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1A065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 45bff8009561259554ca3b1d8d30298bfd5d9a1739bcc7649ae4c6488c2d9e86
MD5 84068ffcd3508197b3fb386f90087e51
SHA1 bb36605b859ac22c01629a927b12156be16e76d0
SHA512 b20044ba93a189d3e5ed4a28045edab1d68e0ebe2bf0925eb5526b33105c5e35ecb8195ed26cf69de321d6beda524f7fbb99335eb86bace3bd2b568229d3fe60
SSDEEP 12288:LXZ1IydGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:DZuQnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18355126937A4B0FAE6674278CCE28646E7733882677183CF2754026A5F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e3efcd997e2d974a76da84efe9c489fac01691b637a65f672a470cec68c6dfc6
MD5 a5c62c8c41368eb9b4f30cc61ca6ce23
SHA1 486cbab252163c7fbbd001737889636beb3bd5df
SHA512 ac4bef79dc3368aff840d9715d6be15536a0ba2367b8bd1283c30e16497b59aefe40126604fa2274cbf49fbf1efba025fcd9c4a2986433bc5da0c8d6d9d76d4c
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:1QRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T130667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 02ae1a4ef1022e93d8ac6f33f8249e9f92b6b1a6272338cf7831df876bedc9ac
MD5 c1aef82b46f71652830478e680081209
SHA1 ede756b92e07f7e01abb48ef049fdf20c50f8982
SHA512 fbf797e266f0f07815cf8a778d739cffb65d04178e95674b85b82c4743f8835d1bb6a9ef041b7c1cf43d759f35e3abcaa32b51d534e2f2ccc324d0b8cbf97a3a
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:aQRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T17E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5d278b5306af2aea1763a9cfd31503b2d710e8a537e13b25e7065dab595c55a8
MD5 9a5bdb6fab86e8df8787a3d58caffb0b
SHA1 b77c9ba3b9444bc2b1c65fc3683f0f81f0798526
SHA512 f5d570713522391e813f2f6ab3fc14e4b8d46bed0b803905bb40222fe902b2aa4124b3069ee313828284aa82e4f43e052cd20a2d7e6263321475f9ce65ec6404
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0gnQ/tbw/2Mkjy6H:v68Qg55nhheWu7PNU3/dQ/lFTjN4
TLSH
T1F0B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76e929e725f237b8343c3cb5653e98f7049a7f754a0890c95f3c5e5ad58c5ed3
MD5 124eb29a1fa7a62ad49523934a2789af
SHA1 a51476eb5c4509f4cd74a73e76a468cf4b2fc27f
SHA512 ec0d720c3dcd21b51e5ee5c9e608faef697d5987399c9868b1b863ef19355947278226bd6cc00b37aea793f9c39f8e7c6eb19c913655affbea90be8fa581f194
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:Iy5112gYy5azzVvL69nLKnhZHLm
TLSH
T18B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9b2bb941e96e9f4e96544780a3fc9d1d1f4bb5801450cea3f6b963ad69ddb80
MD5 b3e7e1f301f3f7349caa64732c09cf99
SHA1 66281b93439605c5fb41eb09a16d62aa11e01aea
SHA512 d5d69abb3ac734a85e9816cd64649eb400e6ddad872b01ae168bec6b59ba9bd7c1480d20c459ad2230f940497730d00f87573463284506cab7c30ab45d8576a1
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnQ/lFTjN4:cu6JmVxd2dMLm
TLSH
T182D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a0c51f01fafa742b91d37b5c6c086030e528d5e73e8129d7f4e381e636c71a7c
MD5 b50d612127e60082a8e1505663f89ee1
SHA1 d35cdd6e3474acd7b30eaf1264cff8e843aa319c
SHA512 034c10b3ffcea8ead2fcba903628c2f8c484a95b12994791b7cd080779351e25d2b92f778681cb2785b4193768138ea68cc8d10b157c611fe4f67f62ee7d4766
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xLQ/lFTjN4:dmifPbRpLm
TLSH
T1C3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ba711af4c9c85009e70f8090340de58bfae95902c9222d41c3edb3cb67f084af
MD5 9abb4d9cfcf6562d3ad5d2a4af1304b4
SHA1 81c8695f8a9d70876312a7b06c70bcf034e054f0
SHA512 dc6e2c54d0310e9818e7906661b772f25a8fcbbaed5cde94e419f81f361364442e5762547c4bc16f07ad441e5b76195ee40d9eb56df0a9697c583738fb0e17e8
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqQQ/lFTjN4:k5dKTi61jLm
TLSH
T1B0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 25af0125c273ec4be5f1a1978aee01e84cc9cd1d94f37c28bdda625efb3f3199
MD5 0d6b4be46450fb29307540ff86180a96
SHA1 e4030ba1bbaa8b2dac473a6d98b3fcd5b576ad50
SHA512 4365a597d881c05c178be99bdcb432b8d3f72a7bd3799b390dbc60858a1f433e593e0b96c7ca9adb0228c9462d9909899f3d9f1134a94dbdc4233bcfddd6d7f6
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wXQ/lFTjN4:jX2iyphNLm
TLSH
T19A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8073a01acb36cb606bb4fc69abc72ff0de845f3799ba01fe7cdc8ebeee1451a5
MD5 8b3e2949ea4ce5fd506790496d387b5b
SHA1 2a48fb4ff68a0b17d2b65be470f818a06659bf76
SHA512 4d61dbdb4258160674d6a2286deb1bf34fa1308517deded4dc3b3c1e2a996104f179386b34a7a774e67905826891dfa9971ad71be32822b47a0b72da7615c192
SSDEEP 12288:p8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:p8nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T13C5523697964F98BFB1706F18C828182A77B0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c67b7b492ecc413e09dfe6c1e41098dd159fd47ffaedf73136c39a0b989c7e8c
MD5 aaca216933c206f9ae2c25174a2e3b9c
SHA1 1124884d3cc231d58b19e5e354bd3c2311ab72f9
SHA512 5d32a8c088aac34a4f4f8a637d7421b59db56f63932a75f31d37a3a6274e5e13ebc64d6d44fd1f82868ef91c18800db6eea2b1253cc7f2970db32e6420cf6d59
SSDEEP 12288:B5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:BJnQ/tbw/2Mkjy6Fr7g0om
TLSH
T11E5523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 37a1223608064d5fe93178e5aefe4f256f961dcaa0ef1b4f151acd55ee8f1324
MD5 ae8c15fe481f8e44ac4c47acc97f24b9
SHA1 1befa63a8fc1991b1368917502aa74d8a1005ed7
SHA512 3d6c4d93885003a86415bd30163849ea7a278a5ba8de3868ae5c94f3699a966804ef2c0b3eda87f1250398079373e76a953d44f4e69b8a50063461425699b9d3
SSDEEP 12288:vDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:vznQ/tbw/2Mkjy6Fr7g0om
TLSH
T13D5523697925F88BFA1706F14C8381829B7B0EC6BFD1938F7B482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ea244fc3869e50d60e24433f354e52a02949cc97b6f4b7a2498fb4ffb7c6c732
MD5 612cb33a7c29897299a8a2bb4cc59713
SHA1 be0acab68ba63db3f34807fed68d2e885a6b483e
SHA512 0c0c58203915d2c8952896cae6a6ecb63a6f18ce85287e0028f534ff111706edcabc723691d8ea8a8ea233a32e8e1182686f73dd5c685efd11e353d373cd5d11
SSDEEP 12288:jVOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:onQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1C05523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 57bb4f0cb9ed76d92e837c09aaa9c39b410031b3038dee9934686dffdf572f52
MD5 63bb86db3e35e7312c5e8a34cdcc30d1
SHA1 b592b1dbe4dcdd30ab0e8d0ff47ac8d4079a0477
SHA512 7292695beda717139d5526dcea63d2125cb1004d9aead88fb1d7d10fa7aebbf94f38856819ca839d3f6f367273da2430e73599cac1894cbcd722ae05886ff062
SSDEEP 12288:MmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWbT:MGnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1B65523697925F88BFA1706F14C838182AB7B0EC6BFD1938F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d6180c780aa9734ff5c4e6e3d44e0d3728156fa33fc7f619a4b2a21207b9fafe
MD5 911f912dabc9345474c0eddfa0fe61c1
SHA1 636e9adc624315a5f98b2b090ff30f1a099e1d63
SHA512 799aed225a6f79698a3d15f60fdd2173307834908e4cbe3ec00a47fe059c5862a8e5ab58b3779bec592a44224582ee6a5cdf5131772ed7e149bd4c8b70484745
SSDEEP 12288:gVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:g1nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1D75523697964F98BFB1706F14C828186A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b377ef4883a13e80d5bef7bd0e3568bc999090adacb69fdfdea8b15f03f865ed
MD5 136285869e634a6c29e33c803e645916
SHA1 e005341005b4cb91d4111b8ee2476b2a0fac8a15
SHA512 7dbec3fd134dbbacd66e319f1221bd77a612aa57c20156726c926791253c06a8d214210fba5817b4f561e20996d28c16d2b2dc9bcef98f940dee9820279def36
SSDEEP 12288:/xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:/BnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1FD5523797925F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 078c64eda3529ca805191504f4b960bed4e1daaf9e7f36031b9dd190afd56491
MD5 a515d495157b173537197525c01820f2
SHA1 9d19e53dea466b0c78455295b93e979322bb2a23
SHA512 39834096742cc0744b34f5e2e81ef29ba7b9b9ba6a6134994be198e5c76c5b53018e54405489587cb4633db667fbf9e985067f527442d1d69e4a34190804e6f4
SSDEEP 12288:yiZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:VZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1567501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 93245807702e8b1a035d468a44c4de4d4ab7e3209a25cb4ae2145a713eda0e90
MD5 517fb338029d89ab0a1244369075662d
SHA1 26aa5e929390e5b5a82d2968efe9f7f8a353b6dc
SHA512 cdc04d9581c35f762bcd097d219a169a72c59943ee033a88c6083c18271d994220b860552c5188f78514675bb3ebd869d082fc789a1c2a99b6dd5baeda395e4d
SSDEEP 12288:CgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:CAnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1265523697964F88BFB1706F14C8281869B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2649a4bb56fdcf0d6732d2fcf37659a777fdbd685006c739b08b128c505a2b09
MD5 922d1fa473538c4a695fd9166b6a68f4
SHA1 62ac959b14c2add74a5027fa96b2f95a4450a48c
SHA512 0409a5d985b8690a4b9a0e61f2a7e386dc4f66aed16f8039e6cb878845fa4f90b9f98b7356a07304e18dcdb0097abd25ceeffb0825b2f58f9d207087da611a63
SSDEEP 12288:WkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:WEnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1815523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f5ec8bd059ba3649e47373ed1fe659946c6f87bbfb3f865d522939a3b7399ce7
MD5 23d28faf2d891b38e81c3a5c29a51daf
SHA1 5b0501755c7edda4ff9d1c0a514c4e04e897afb2
SHA512 89380f1f668be4ecadf957569e6268dd6cc7e5cd5b897a8543904facdccaffb86a22d0a8893934459eb16663f64b31ae647f01cff60cc31e401cbc9b1fecf855
SSDEEP 12288:HyPz5L8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:qzy9nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T10965021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8877cc31af1549620bd534149f48b7b5ee49e169b3bed1188338d13c8a434f10
MD5 8f78320c2e2c8ce622084410db74bf3a
SHA1 38541f69ce83eedc64a77ced438f12fdbf6d7d82
SHA512 36b22889c2febeda4b08c6cc8245705b384d1a3b81fd3535234b740b97ad70294bd72c47d5db80d030b781be024286ab102af35fbb1133f19eaa63e6fb53974e
SSDEEP 12288:7gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:7AnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1545523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 01460797a017d16556adfec7ce654eb0945e208e3c00f379191401caf05fcd1c
MD5 d7504a36094a2ec921217dda482257dc
SHA1 337d18d79f70bb32c12133d10ad107722359fd63
SHA512 e97cfd6fc262fb260a23fbc1d6af8082299056fe5a4d6ba5eaade5c2ceec1d47b16bad11eef70359f4f19f151f5fc99579963e0f3f77ebd186468e794a2d0f66
SSDEEP 12288:ogGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:oAnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1025523697924F88BFB1706F14C8281869B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 901fc83863ffabb3c65a6794502d53e21fbb280087da859c8631ef1deeaf8451
MD5 57e1570b77af60968e30bcc9d07141be
SHA1 a553c3751c7a2f7d2ce72115db25dd3306524fa6
SHA512 76a45a00ddf6e932dc8a836661e238270c45dcf9106c315699ece073f1df3951256e2d65d4c5a799fe30f9eb39b927d3fd5e76e89df4c22ab30e34f3d3f73046
SSDEEP 12288:oyPz5L8dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:pzy9nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1AE65021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e7bc042fe6f07bc35939f6f484f92fe07e83daad43973724f0032b59da127646
MD5 eaa9971b74e6c4cabc5f83f7635fa9c4
SHA1 1ed4c89926ab85509ef0a98da83e0100f687b674
SHA512 acb61387ed91ecea86e527cdd17ead615bf2b6d26efae754c4ca49818f4b568eebca457bdacc3f41e3833fab682bb1074fff3fe5c6eb5712dac28226bad5f3eb
SSDEEP 24576:6T0aLl3z0zDDnQ/tbw/2Mkjy6Fr7g0oC:6TDLljaQ/lFTjN4
TLSH
T1797501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9bc015484c4948cd63207ea7d214e71e39e0b33b683e4795af82d4a811f84929
MD5 04b94295289356a69c85d40f199cf17f
SHA1 fa9f8e09c17045cf5dfd121fda1d1fb002228270
SHA512 9f665717064edabae9cdee19d33da647304cdaae939a20349a4b26f5122a52598c4f7864f83ebbe2796ed142c5ccfa1c77c48de480f5b8d55622e7149d0127cd
SSDEEP 24576:o31d9CHKy7GZfnQ/tbw/2Mkjy6Fr7g0oU:y1d9CHKyalQ/lFTjN4
TLSH
T17685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 240d6cc81780b89e33633dfae8dee68f51f340fbf1bd94215b29ebe150ecc8cf
MD5 467b638553dc6eb103344cfa4558e391
SHA1 8755860db0b5b521a7d1da3dde62103582e54737
SHA512 e705917ca72b7b71af24ca630d1ca4f4ce3298404f61397b72b9935a0cc3197b4eae14d61239a7aab6a2a16e4f094ba31b36d2014543bd544a7c32c683db34ea
SSDEEP 12288:0jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:0TnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1605523697925F88BFB1706F14C828182AB7B0EC6BFD1938F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 567f1f592079f3291b30bb1a7abc8d6067ab746b8d847f8b5223e0972ff34539
MD5 9e6eccda97b46dbbbc54fa8a097fde6c
SHA1 b0feee227ef182a42ea3050dc47ef07ec81b2fc8
SHA512 851fe763c21a1835a78a33b2ffff42a5fd14aaf4cd105b2c66f742791ecf7df491202144c176a1b3bcd8602bd61d6707522974451ce4778324a9b04605b0cb10
SSDEEP 12288:c9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:cdnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1495523787964F89BFA1B06F14C838182A77B0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5beb3f7cbd277ce41d81751d86becf1fcd3bc192dfa16738f13ad9d0cfd53665
MD5 4d6523b993c92eef1a49547751d89703
SHA1 9bb44e7033bcc8630de21efb97d3f78d7ebe2b07
SHA512 deec9f4cd1030389dc557a4ac9105f817b6e37c852a8dcb96101561ed6132cef0a5914f9e47256a58340cc709da2aea48d75213e04a5b43d71f0a439552e7604
SSDEEP 12288:MyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:MynQ/tbw/2Mkjy6Fr7g0og
TLSH
T1495523697925F88BFB1706F14C8281829B7B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 828e4571b1d5a674959db6f310a00deb72407e231ebd58b0dbef649a76519273
MD5 bf54bcc2d16dce5ebaf4e23d537b256e
SHA1 29f844773886ed139c326137c45513f7dda0c578
SHA512 c49ed20727de97f1f0ad5c3ba156952eb3363b01bde1fc12138a7afa984b161a367b3a93f085793a4fafab9e71c2abc765e0648513a8f481ed95f05978804f41
SSDEEP 12288:vgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:vAnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1D15523697925F88BFB1706F14C8281829B7B0EC6BFD1A38F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7d31ae5b0e50335300815c8481ce65dcbef81a771cffac24f74245d3800db6dc
MD5 3f8811031eb2c3e76f5b0ca051084cfe
SHA1 6e133d3e019d2f6377bc7a2f8fd5acccffb3bb2a
SHA512 b396fa5e24ab1b7e85f98e320e5b174a88501ababf6d47a55899197d3f7bffda28328cb2cf6977b7b16ecbde4433fc17af09e4e845967bd457beba1043709ff0
SSDEEP 12288:wjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:wTnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1375523697925F88BFA1706F14C8281829B7B0EC6BFD1938F7B482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bdd2b441bc9d13d0b9f0a7a99fd464188eaa7115b18a15a65ab53c44ae0b8d87
MD5 cb7f8ce3364c987f2399288b39070f45
SHA1 9701fd6ea5bb871875f991ed353eb32db1e7bde6
SHA512 6f667e9735c14f0cca663ea274d3eb6838b810427529ce047efcbb9b3ae5fa204a7bd8d331f354c5eb3b32763a3972447a95ea64eb0ea8d2a6ac2b227942a975
SSDEEP 12288:o4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:o4nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1015523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8decca23d85029b99cd69bce1363da1dabfeb53606b546f12f38e9077a9576c5
MD5 8476f5f773fe1915a139d7cd2a1b6f28
SHA1 9fa1bd6395bf55c2349524eb4fe55711e69c6f84
SHA512 08ae29bbcaeab4ee5014771893103be4a96b1888aaa8c181073dd276ffd46a652e52cfa2440ef7e8d959eb27533bacd9e9128520154b3e6e04a15595e019fde8
SSDEEP 12288:UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:UGnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1A15523697925F88BFA1706F14C838182AB7B0EC6BFD1938F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ed100bee2d0734bf718e01e75f49037606db493a4e90dbed66205d7b1564881b
MD5 0b5f55c374314c2be5b5cca349e3890b
SHA1 610057cc29f4e9350199bac4ec6eb9546d4cb139
SHA512 99b13bd88992ee41e334ac00e6fe1b568f1255fe296ce0435200b0aa2d6ca85fb38bc4375f95399cefcb846327bfcec4bcd793350ac3a719af9aed76063023d8
SSDEEP 12288:irGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:ibnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1855523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 f1a5f248ad2f1e8fc3814f9bb68b89683cf08e84ba68120eeafba7dfce0a06bd
MD5 f26dd33310a74f4e1a1e31f617d57461
SHA1 c7edd8125a56ec3d1b2ea3ada9c77860c78c2537
SHA512 34e75ff611fa979cdc74ae9e9210e011b9b68a643a7f037cb6aa7caac06f0ec3a88a1ab69cb6a047efeeb780cbf0839f3f96113cce3ec31f7db30b43f0e4677e
SSDEEP 12288:smGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:sGnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1115523697925F88BFA1706F14C838182AB7B0EC6BFD1938F7B481129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 23c64c8e4f54f4eaab5cac861e5dc6f5e34c3626fa14f67a44f68df1467fd78b
MD5 fc5f5a4d0d4ba5b31968c9819a797d72
SHA1 14e2b07dda515aa3b3dd3127143e3c4a23b39bd8
SHA512 55044e91b450756f7c188581b7ec45fd3383f4963ca45dce22e52337a25ee88bf39cdc23062811c1e3f6fef3fa99816b22bf3dff55c59115c3c08497b3ff6d26
SSDEEP 24576:cfwv/k9RX6wkyAI0nQ/tbw/2Mkjy6Fr7g0oa:LMnYI0Q/lFTjN4
TLSH
T1A285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 13ae09e587f09f92bf9e6578ec7027194894ef18210184295ad287f879f3fc4a
MD5 90c56e97df261c727c71224d05a660bd
SHA1 ba7d2ed374be77596806209f57803bc413bbdba6
SHA512 e772a9dc87db88da8b542cf4d92fb848bf03d68edcfaadc5264892cc7f6588c0997f041647cd7533a0b31baee9630ebc29ecb991929d8a7b7001fb74faf473e9
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03Q/lFTjN4:HySzPULm
TLSH
T156066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 81de493e8514917be292685dd6ef75b68f2f6310921f05ff6f55151513c1f8e3
MD5 9384aa3897c602c219618b1c91d32a0e
SHA1 bee1a45b4befe0498c20d86a61d4d7e15bdea46e
SHA512 a4932f8958eb4579cb090b08e5bed2f6797dc9c7839c19a8b8e90d7fe7d616079a25b12d7a5bb2dab2635c288dd495d3de66f57ea1024fa96cbf4c5a4a37f467
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYZnQ/tbw/2Mkjy6Fr7g0o1:H47JUQj1irIhCnDHUPfF/nQ/lFTjN4
TLSH
T1B065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f9be7ab1417792562d6161321c5a54541240104f80013057566a4c5e63e27295
MD5 86174cf08725f86f0a8673dcdf874fe8
SHA1 af5b2f89e20aa645143d1a00e99552cee6bd97a9
SHA512 ca5be903c35b5cf952308a8e5a96bf73d89ffa63d2d8d5f37028433f8147cbadd8cba701d35d50898d530c768d6f45855211aaeb45a1957e491eb7f8c99fd18c
SSDEEP 12288:essfwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:IQnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1E965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 edaab2aa8e92170f4ae444717c4d1ee3d84bad2c9acf9807f08a99bd8139c48c
MD5 a1576b74ca3c20293b0e5f64704da208
SHA1 443ee461775139939f8fdb6273ff5e632e2fcea5
SHA512 9795c8546d19a113ba26aa0939c5bfb1f664c7730ad9e22c57090a1da72de08456c55cd25a81769807352cc574458b7b71dd562b6fec806c9cd9591d6a5e4a0f
SSDEEP 12288:B7FBhdU3fDjnPmUe+xVibFOMkulkY2piyCrSt55LGrfsRMT:ZFHdUPneZ+xVk/aFuSb5LGbsRM
TLSH
T148351710B62AD75FC6A944321E36D5CCA7707D41EE44AF0373C84B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 506KB
SHA256 e30be6a16bd4e013f7b58197e32316f5d5ac1182ff6744c6128365f27efe378e
MD5 70a8192bcb593d90e1aedd8d5d55615e
SHA1 e2262885c81691be3ed8b4a4477c6f8f56f2997a
SHA512 0f6d395c8e904780bbe609b5593818ded2b48b6320ae057bf03032827e4d3ae7cfef50a009e3fffa2888705ce051c4818d87edbfaa36b5e602361ae9c01b77d5
SSDEEP 3072:/GEeak+BDm2Yazg7z7zozJgF4tPl4BBrOBT95tnEmhJt6OBtn:/GEeOBDNYEgXXOJgF4gB8BPtnE4tVt
TLSH
T128B40840A537A38FC4FB51320B365B8C7778E813BB055F1273C84979DC2666AA9B97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 75ea29291d75df9b1861e39060be27614a183a6ebcd274805bdb46e646073858
MD5 c3030b9ca0eae8072cdc6d617546fc57
SHA1 e07356f7b8270f406320c74821a38a9a97a2bdc5
SHA512 c1c35b17fc35a6151dcba0661f92a7074c19f7742c0eb1c8df84311751fd27ff643af947a9c28351cc8a37bfe9101d1f3413bab6d8aa45ac616780b9de7b230d
SSDEEP 3072:PgJjgogH90b+Ux0u8Kj1nXJYN3S4yLtSScNfXTieMXBDZUUT:p7uXB
TLSH
T1CDF330C6852F44FA34138B97C3795C7486A2365E879E491833CFD6EE66448038E6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 67ba377f7e69f71b82ae45dae72613b71b931f9c936bf86baee6a6d01d02e3b6
MD5 9108df2292af7da6b51af2a53613061e
SHA1 55c7388cb30e92a403236e2e731527b7a40bfb79
SHA512 d07d779e64e99d7af9af8a08195e5981941e9f7300fd04e48b120289e6ceefe14864cce106ee4b1ae20ddaa67ebfb2601933aacb39cc0be3baf9eb271d03a8fe
SSDEEP 12288:P67IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:GInQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1A95523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e75c44f0fd5046a46c13897392b7e7bb3854eb5b9b7f26e8104ef155b17ea0e2
MD5 2acbbc41e56c2406c98cd449b8df4a49
SHA1 b803301daaaa61f84576956c4ea5351cc1b99189
SHA512 1e602853df41d76a9f20cc1c1a1c0acb65fd8576fb60f401c29d02bc74586e5c6c33fea4fc945094d6bbe90eb7976022b0d941c64b6818a0ac2900c193f084fe
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYanQ/tbw/2Mkjy6Fr7g0ow:Wgb4mBIBhGFZQ/lFTjN4
TLSH
T1A465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b02f32e0c7c7fe633b420fc6abf065dd13825abbc566fd124e95a5153f3d5bef
MD5 87e178fe23f59a639ee840358693f1aa
SHA1 8451a3fb41213d6a1c5489a054c7ebe77cf72ac9
SHA512 afa5c882f83616dad312633d7850e5073b1e901e5733d288a213842e01b82addac10f41f8749fb2fe155b27d3ff35f8ef683ad756fdf2761387b9426782626fa
SSDEEP 24576:fG88u8FpJqH1Qzria7/mpnQ/tbw/2Mkjy6Fr7g0os:u7ZFPqVva7/SQ/lFTjN4
TLSH
T1FE85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bf6476713ec63cf81632029c8ccc43db68213754f0d3cc98f2781f8a9b959a03
MD5 6ef01261cebc199db984756a92dc49d8
SHA1 f2e759707ef1567c5aa2b3921936b4baf606bd10
SHA512 40f53d1b4bf0ccd070a4e4033fd38c39242073dc82f4b8cc993045283383df62132db0feec7b6e28ad61ed31d4a40deeb1c1af35cc5192799a91876b3cd245c7
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Q/lFTjN4:oG05lO43bPLm
TLSH
T1D1D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95dff5efc451eb7cc937028c8c4d36ad4b8f7697988a3dfb09d35f97c2357de1
MD5 bc344a3f574945af17e5ff8c1eb47b31
SHA1 86443796656dc73f921892a2124521fbcd54ac6b
SHA512 6aea0526981b89254c470b50dd64844e405885d791ea89f38e3c0835f47302333f5472a764c7f3f7b979b592bcc2fa1f8062f40831775fc3e2c8ac069a549b7b
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3nQ/tbw/2Mkjy6Fr7g0o0:Ra5POZ3+Jt2pasx2+mdQ/lFTjN4
TLSH
T1CF65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bcb88ede79534cf714d2f57b88fdbf2155b68ab3abc1cacf7fcb6ea06bb27e39
MD5 f57c91c31d38f9b04ec88a1431afc1ac
SHA1 5ff65d062bdb67425ae0dbeb561c4f8210c7bd6e
SHA512 d7103df60194b2fe3e2cfcd6df6e0035e9cab33c70376ac63788e6511f9b26b5a196358944f1f28ef9a94bd0e2e26928e7d77278f3072235e05a5d4aef694645
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkRnQ/tbw/2Mkjy6Fr7g0og:4Nc/zEOVHFyQ/lFTjN4
TLSH
T1BF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fa06a1bcc1d232be6481b7afcc5b906a3232c7f5325e65c751904702efeccd0e
MD5 24346b67651db0af58606839077e3739
SHA1 480b9f469cdfa14d34d8a7324ff3000b82fdc8fe
SHA512 1971baa1c0102936107e11589c29c0d46bdb90676ca5ac887d43e22e1ded0d89ee9c3cd18130f7e15a7e47e1e4547f30a7c761e516e776ac934e83986f531f37
SSDEEP 24576:J8kNvNnaFeYhJNtmZBmbnQ/tbw/2Mkjy6Fr7g0of:J8MwBtOmbQ/lFTjN4
TLSH
T1A955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 fc2c7286ba25a8b4d460906d49e00b762c3e63873abff0286ad7b21986c1ff66
MD5 82d5450e9638eecbd5c44de86b510ce6
SHA1 ab3c6b7c592b1e3c18ced72d450b0e3a97dab167
SHA512 7ed55a955a1ae20633c36de8f5d9502dc22df21a74c63456253a8ab413e90b25c7897fafe3acd85ff605f56eceb36e045401305152d43dd0baec5a6d4beef743
SSDEEP 12288:KHvUrBFrEjwaQFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:KPUr+NQlnQ/tbw/2Mkjy6Fr7g0on
TLSH
T18E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 75d2f7bbc3efd5174ab885d4328c0a6fa01bc5382ff8f0c5d797d1b3d7d415e6
MD5 9554a540da56b284273e1c5238609254
SHA1 c7ce2a5d892770605528dbb3a89374821c61a788
SHA512 7fa6b04bd16f6a2ca0abadd0e9dbacd08bfa799c187e7d0c8de80a93709b7fc9efce5d131bbc0325b6ca201ca0f8a9ba9ebbe3513aaa491cc5dd5922e133bcae
SSDEEP 24576:zD3FHshBIYQgAcnQ/tbw/2Mkjy6Fr7g0oM:zDVHeBIAAcQ/lFTjN4
TLSH
T1DA75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-115-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1372-385-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-384-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1372-381-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-123-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1372-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1500-330-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1500-0-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1500-8-0x0000000002540000-0x00000000025A6000-memory.dmp

Download

memory/1500-102-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1500-2-0x0000000002540000-0x00000000025A6000-memory.dmp

Download

memory/2796-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2796-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3044-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3044-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3044-60-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3044-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3044-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4588-143-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4588-149-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4588-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4588-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4588-152-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4800-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-415-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-414-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4800-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4800-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4836-92-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4836-93-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/4836-98-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/4836-324-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5372-27-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5372-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5372-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5372-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5372-26-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5392-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5392-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5392-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5392-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5392-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6236-136-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6236-129-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6236-382-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6236-135-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6400-82-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6400-88-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6400-80-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6400-323-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6504-69-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6504-76-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6504-70-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6504-308-0x0000000140000000-0x000000014017A000-memory.dmp

Download