14a14d9dccf612bdebfdda77882d82b6f2b6a0d18f798e5745dd47f6317c0354

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Size 15.9MB
Sample260809-3w7f5a1vdt
SHA256 14a14d9dccf612bdebfdda77882d82b6f2b6a0d18f798e5745dd47f6317c0354
MD5 7f58150684194428969e5755987e8b20
SHA1 4a169200c3a0030f9cb3b3df1b89673e898a1458
SHA512 36a3db8f39113adf8e6efa3defe99da10a9a97cee78462efa0d97c3c1ad735b38b18a0ae09ea7bdd761a561442c6af9868fd80ebb25782051d42b3834fdcad71
SSDEEP 98304:5MBLgikoO5qeLsh7HYxctomGIORuaYkDpTMBytZtFiMdveS2zwxORe/PS6/XlAos:5izOSh74xcEAEpblASA2cj
TLSH
T138F6290BFFE080A3F9B0127E287556540D2BB41E9C207DBB3154AB5F67EE281189B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6888	elevation_service.exe
6544	elevation_service.exe
3652	maintenanceservice.exe
4704	OSE.EXE
4716	PerceptionSimulationService.exe
1876	perfhost.exe
1536	ReFsDedupSvc.exe
1276	SensorDataService.exe
3016	ssh-agent.exe
1956	AgentService.exe
3656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed8b8a92957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000123c63835a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002a15c425a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079f64c425a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd6d91835a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6888	elevation_service.exe
6888	elevation_service.exe
6888	elevation_service.exe
6888	elevation_service.exe
6888	elevation_service.exe
6888	elevation_service.exe
6888	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe
6544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3748	2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	6888	elevation_service.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1956	AgentService.exe
Token: 33	3656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3656	SearchIndexer.exe
Token: SeDebugPrivilege	6888	elevation_service.exe
Token: SeDebugPrivilege	6544	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3696	3656	SearchIndexer.exe	103
PID 3656 wrote to memory of 6704	3656	SearchIndexer.exe	104
PID 3656 wrote to memory of 4928	3656	SearchIndexer.exe	106
PID 3656 wrote to memory of 3192	3656	SearchIndexer.exe	107
PID 3656 wrote to memory of 6216	3656	SearchIndexer.exe	109
PID 3656 wrote to memory of 2888	3656	SearchIndexer.exe	110
PID 3656 wrote to memory of 1908	3656	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f58150684194428969e5755987e8b20_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1276

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 47bb6c208087f3dd8510b596b9b510dcf87ea1c8a2a480c39bd26966e19969fd
MD5 519f3c257e977e5a8e849fb1496682ff
SHA1 79e88ba463a01ab81611823dfe979ec42f965505
SHA512 6ec0b0138a24001bd21146a7895ad68d0ddb4e7559148f8b527256c798c859b9f79fa1f1edd5524b44d0c87ea32929c354af2fb0103b4ba83bfea337446cf382
SSDEEP 49152:Kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIAQgAT76sQuE:83q6sjBSqGsQr
TLSH
T1B6D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0718f023471cd6fb8552522eee778d38bbd8c175d1e403deeebb13d01872c131
MD5 28273f9d7523591bf1f4b956fd92967c
SHA1 815945d25babb2ca84aead8449b623a2ea33c70f
SHA512 6c0cf314946f76d341bb2e06f50e0585f4a370551cf42100871aedfd75603df30656bf5f4360ddcd22bf004021e1c9d2c8923527cffaf689b2e85de5eda6dbc3
SSDEEP 24576:zXYfDtczAjAfYLH8AcevDN0FImbwQuq3Wia7gD:Wtc0AQgAT76sQuE
TLSH
T16575F12967D408F9EC67813DCCB28511E673B8A54360E7DB03A49A661F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7928f3ff1c4076c216f4c2e7592433e4f6729c128336ce291fd401cf53a57470
MD5 cf31b93c9f3f22439a2e986e1f2d6b79
SHA1 4a08f97526c69a5d0d3c65d9dcbf07e8f5c5afef
SHA512 72acbdaaa99334f959f8327d04b2fbf820273d32c8cc2e4fed2989303ddc866d56e96b55b93ad7d6a8fa2f88f5153ecd5313d5697aa4b0c741924792fcac078c
SSDEEP 24576:s0Le5ji0hmxxrMOAfYLH8AcevDN0FImbwQuq3Wia7gD:sPji0AjlAQgAT76sQuE
TLSH
T1D285AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3dfe3bd628b300bfe7c93f7622784b3ccbfca74e2db41fbd24ef17cfd1e472f
MD5 9cd7cd5e606ba739df5d41edf4d4f5b9
SHA1 2a97e390e6cb0aa23092965eee30f49d5931085c
SHA512 0f4ff93909690817206da59ec571faf5058d7442d55a53acf78445d8e0cdf8b4f50a3518dc90232679774ce85f60738f1735a62620babf07044c4bdf3761e19d
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWn6q8wyuEAfYLH8AcevDN0FImbwQuq3Wia7gD:H/ezSC6vUzPveHjypAQgAT76sQuE
TLSH
T1A0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e67a2bd5e2c9791c48fd3f851e34fe3b114007a3b40897b54154f445f4afc327
MD5 ce9719211e2605ba6401199ee78c0b39
SHA1 5842de551abda30db08b6a9951d8d730fce40875
SHA512 4b7485d062e16a3ecb564752d619427736359168f80923c9161e9755fc0a943d20961cbfa2081298a84d71d8a9d930523788c1e29d3445ea644ac2471ffa94da
SSDEEP 24576:ZVbqPb88hv/l+YvAfYLH8AcevDN0FImbwQuq3Wia7gD:ZVO88hXl+MAQgAT76sQuE
TLSH
T18B559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 762dfba49a112cdfa2fb74329742bfeaf569214fbb25072ef754f90fe86ab26a
MD5 513c39f511548dbb79ec6c3d3086d640
SHA1 f128153cf90293cb8ee9add112189830b191b2ff
SHA512 02724b1a3c54c02ed7eb3852c4d49fe6488be4dbb6c1e022432deb38a502e00113e5d0dc9732e601f4c15f93397c36d8e2aae8d82c7b4deccb2f16f0284ca47a
SSDEEP 12288:3LaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3LaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C35523578A4C70EAFEFBD1369CBBA5B963D1BCB88245979A01063BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 31855ef39e7da27069cc693c34927f16fd82bc325673d21bf2686ae1bfd8b4db
MD5 e3f532a6f1cecfa3b268923effa565ef
SHA1 97433dea4d3fceeeee09955c69935c3d5ab26f27
SHA512 3525f5943f8611f4468b454fd05b965a60d98dcb4637c48a342a4faf664085db2685815ce49048fe68732732c5384da068778856e7b29d51ace9eb7925b1dd05
SSDEEP 24576:UJIUnAfYLH8AcevDN0FImbwQuq3Wia7gD:UJIUnAQgAT76sQuE
TLSH
T1B875CF3BEE28FCD2C67E8D795A918600E7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec7fdab17d05bd11b8c9c12eef986fb86786b97bb954824a3b45b527644e1fd4
MD5 defb50644a20ecfb0e8617547975dfe2
SHA1 d06ef393fb0c1e02641bd81ec45fa4ed991aa733
SHA512 5a3c830bba8eac77f0e331b51c7f3afef2c1614349ff6192fa5dce651e0d0e114a82de8bea7392875ad340dd3f3eb69625438c26933a9536afb6aa26e290f4bb
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:2QvGAdlCEL8c/DRNw5C5qGsQr
TLSH
T1E1266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 22035afeca619e6bfe860ec771eab3e729c11c339430dcdaeed8505f8b313eaa
MD5 d68dcac9211ce28026b36a73c477535a
SHA1 d9a9112d811f848b5e77e7b278cd379d7ec5d2c4
SHA512 7bec153f34abe6d863119b9284e8aac5831e74b69e0428f7d5d4878e6fc3d3a1980916fccb3b039fd90f2d7d21c240a1688573e37582aecdcb5d128e5724a92a
SSDEEP 24576:b0ewsAj1AfYLH8AcevDN0FImbwQuq3Wia7gD:4lj1AQgAT76sQuE
TLSH
T14275E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bc956afd53befdcfb596c75f6127a15733eba7de8e57ab173ca89c53e504c75c
MD5 c409af06ca7c7214cf77fd395e65e4fa
SHA1 f8fc0c51113cfa87b4165d2ae9adaa8727aff059
SHA512 c6fcedc40a399e9e078c1ddea655445962c33a61244e4b23600f0a61113969c491706685c29f12c40fd9dd9c8762f9a21426e709f5deb91389f173ed8cad7eba
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQj:XUEtQevvqc2W1cpV2tI32
TLSH
T148474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23e5c06301bb69d630135943a504cc008b933ae6d3ca63dbb679bbb9e650a7a8
MD5 2b76c4ce0a7b8820680878c04034a32b
SHA1 7869db93d48f39ee2b14c1c165485bc40eca8551
SHA512 9e16d6cf1cb5911aa1317907b9adc94dbebfcb128140f47644a941d73fd86c18c5000896149799781dab0d596c33ddf482f8ea31c243e94033760850a4c5a873
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zVAQgAT76sQuE:JoquVjnmNqGsQr
TLSH
T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fe3db6c59a63cf585dd5cd8f56fb6dc305b2fadf5029e2332d81f5ac3fc63a93
MD5 9c62998cce13818f405ac74f7c1de30b
SHA1 24c24645aaf1b5ac160c06a4449f81f184dddb10
SHA512 4ae9232221291dfbdfd51c3624e9576afa34c12e6cb8da45ba4c6e57cf598c06b26d6ffb5a2c5b2b9d102dbea68d4c674e7dab65120dd5a592fc6d6cadb7cf52
SSDEEP 24576:PAhGL3IFoiwtA5l7S53YAfYLH8AcevDN0FImbwQuq3Wia7gD:PAMUFoiq5IAQgAT76sQuE
TLSH
T1F0359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 221b23226841316549b58e4154d4c3f0dd63924f96fd786632c30bc74ebd6315
MD5 ab31584b685105a43ebba2c4241cf83a
SHA1 890881ebb7d8505db6f36be99a6c0e2d34252824
SHA512 6faa5b672c6c59ad8b8dbf69b80d0f175691286b1b81e0f64413085dc4b343aa21540f7ce2261644f2627a166c69f4abbf89e9bcfc82762ea23318c43b3639fa
SSDEEP 24576:iwu4OWJAfYLH8AcevDN0FImbwQuq3Wia7gD:iwvO8AQgAT76sQuE
TLSH
T1E065F14676A81CF9E9A781398997C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a889a7c49f8cfde0ea227c845f97823dabcdd741b28bebe17491ef89f83eee27
MD5 651b97ba4c566e73edf16a76f0ae6eee
SHA1 8b3b8483d7047399fde440278dfcfcf6c26c39cf
SHA512 7d6bceab208ecc78e204fb48505fc9e0109c6749ecb2f990264783e77e7ffff0e40a5cc6566b66b67ffed5657dc5c2ced35bc5936ea971a9908fc4c7b1b38a1c
SSDEEP 24576:FZumAfYLH8AcevDN0FImbwQuq3Wia7gD:LAQgAT76sQuE
TLSH
T1DC55125B239830FAE5A7C139CCF25659E3B278A6532183CF0215079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9da0f51a348da37bcd2324917f3819381b7adab30e247d3430b518aff8cf0c0c
MD5 4bdaa3cb3111428800d7771a60d9e01f
SHA1 d909c200817a44a3c473de9ccd336d40dd57d855
SHA512 9772c978bb563d40c39795e963c6ee60ceb5862d4982c1ad26d89d6a6f7628e2ca8d1636cefca6ec8957fca27e6a97134122d313839c53c03a8ea4f906e17dcf
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:xQRQyi36YOcPbLvw2gAf+PN3gqGsQr
TLSH
T17D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3de1ef674aa5f06895c484c6ef9e948a764e046974b3caa77f441bd4e7823d6b
MD5 fe4a8a52b89d30b0e0862fbfd95947cc
SHA1 f7ec5ed19665469727bfed16cd5006fac2650a58
SHA512 19c9a0f74c2424c879b7dfe0ce9d5d3d4ed47b416511f2665081c44c1036f6aae60ee7dff31900b4138cac5f73e4c649bd4656dbb84e59ee62035e0ea469dcba
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:BQRQyi36YOcPbLvw2gAf+PN3gqGsQr
TLSH
T16D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a0034aca4bcef41effb372694577d4d48322e84f9c39949e553997881d70b1d
MD5 80ece0c0b6db45427c12d6bf9a4fcae6
SHA1 3f7c32007a96d4d5e33ee4b576d7a2c6ca7c4082
SHA512 805ecedac551840575cf3d716be23885f531b48179972e24ffb345803f1ce3d819574da8cc4841be25e68f649096a244dfedf3d65a3e4f6ddf31d885adf8df65
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WAfYLH8AcevDN0Z:M68Qg55nhceWu7PNU3/lAQgAT76sQuE
TLSH
T1B0B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6647c0cb064e9f721f0caf0b3b0b6b97c528877ded0cfac9ef2239ebc8c1a705
MD5 c2bba02ede742f004359ebe68f74f51e
SHA1 3374239a6291b9480eb8ce9a6199613fa7f8450b
SHA512 6b03664982ed1e618bc7fe4891cdf2bf98dbe9fb4370420fe2261d9a9baa312aa7ec0eb6819b435a78922d5c9bfb95745563843f3e2f71216bcc57c18a8e0975
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:Cy5112gYy5azzVvt69nLKnhZTqGsQr
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c4d47cf31ab57f05627b280d3b73a593fb87612ebc88238e7e32bc793163cd65
MD5 27cb3fa6586f5f3558d6559593bdd399
SHA1 2b2130aca433d50769b87956a66b31038db44073
SHA512 46d938609dac491c0354341781a12fce4eef569b3c0e878171555f7ce53fd740f8bb0ada1cf44cc0281ec3a629a72b44ffbb2dbcb337b0d5113d1d8f2d829ff5
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNAQgAT76sQuE:/u6Jmdxd2d2qGsQr
TLSH
T1A2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f52c13ac593b148d7b4915993970344ad1f82a4803554d9e1869bfe649c1c055
MD5 588cd82a3a33c19cf88dac7aa4cb95aa
SHA1 65f64fb73b48cc660b456ca45f2760b2b674b735
SHA512 54075edc0f7b6756fa26569d5c1c657eda763f578a1074fd2a4a3f9b749cd00db29329c4ca107407fea27fe48726c74ac2bb4773117e9cfe42742b967c3ef6dd
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xHAQgAT76sQuE:fmifPWRNqGsQr
TLSH
T125B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ed33dfffc896f39604f48be4fe99050b84da4d300d2fbaed9676c56aead67583
MD5 9d64c5fca2252685b302e215e942c9e6
SHA1 dbb7f40fb81937b48f7ca1a0611861be1baa9582
SHA512 4d0ec71b29373213841823f575268030fe31c9747be3667d77a9b4d0b12d37cdc723cbba48362691696ac3a4b19320adfcda9da40911957e04cd9d5edf55fda0
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHqmAQgAT76sQuE:V5dKii61/qGsQr
TLSH
T19DC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 598c2b9855fa6a43fa8ff9c25007dd699cd58582cbb43ef80287aa600be59aa9
MD5 f77edabce1f157a43d66192d1771d129
SHA1 4d6addb2217278392269970b881c9f8c0678707d
SHA512 529d1c42ed49d5c626e6c4cafb25be59f9b32a5d43da46222399a29db49175c9a708af551d84b7d8ff20def453d47dfd7b181a1f9f95bd39319a66c733ac6035
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wjAQgAT76sQuE:GX2imphhqGsQr
TLSH
T1A195BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 88c4d961065f045a0441137d226bb8b2b555c820180ed3553991eea544b7ee06
MD5 7103eca9a04cdffb4c2e5c4719a913fc
SHA1 fa763695223e3a74df595d66d3c3d0ede005ce35
SHA512 fff7b3c64b5dc1848cc5e8fd67113049e1d0848b84254b75feaf9efb0978fb4a65933d226dc65aa277535a3a71c6bd59b3832ccfe6da45ffdd3c3f4fc8916547
SSDEEP 12288:ySAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ySAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11C55235B594C30EFFCBAC1368CB791B9A3C07CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 db89dcd36b037999966b60107f555a6d5039bf2a656a63f497f257d32fc7923a
MD5 a617ed692654f2ed8e955752a1fb165d
SHA1 949eabf0a7cd20b5e88d1ac1b78f3aec3bcda400
SHA512 ca2b6ecbbe24449a97d09767ba1b2eb971cfde6f39421fe80ec6730adc7a83b3e5d0e4aea5945ca3e7f85943ec6c400b7b86412c546d34c65c3d4a7bd21c32e0
SSDEEP 12288:bxAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bxAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13D55235B594C30EFFCBAD1368CB791B8A3D07CBED346939A150A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ee85a9a68254e9f3e19dae562ef4784b8a5a806bdf67ac76f664f7356042312d
MD5 97825213af4f1b2d8422319db834ceae
SHA1 1389332e4b782508f70ed697082e6d5087989188
SHA512 c8bfcca24eb04a39b3c93cd183038740b133828c2a9b388739b5fdd19c4158aadfce7f7d23027a931ab3fd0352f5722d7b04db50ef0c3770a2a90226e1257885
SSDEEP 12288:sfAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:sfAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14355235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150B268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 14f6417d439f2d6c2514f85b4c1f8d243404d957795cc759e9254b3ac9af99f4
MD5 db32fc49a473a7b4f3ebfd5138770e00
SHA1 acd10b3a6c7c297fe94afde7e79bade569eaaabb
SHA512 6e4c99562f2e935241eea0db9eaec617d190d21868bb1b7d36cef65df9651159b8eb6423323addc2395207c37e496f8f371bb41d44ded353f7811860bb871b13
SSDEEP 12288:+V4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A4552357165C20DAECBBD135CCB39179E3E1BCB9931293DF06051A8A2E3A248D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3afcd906dfb47440b3c24949bf8df924ccc9ef13ef435b5d87946dd99e9f2225
MD5 dea3dd508a8f9cee0db7a211ed7e1a0c
SHA1 58c1c2317755bcd3761ac55e42162bd28f2cdeef
SHA512 f44da4ee3ee39926fa6af65befb3656c984bb3f5162576903e3b17e2da74b95a123f51f9f1bc63973643f7cff4c6a65634de40414ebc807aad5950f3a5941403
SSDEEP 12288:RAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B155235B994C30EFFCBAC1368CB791B9A3D07CBE9345939A150E26897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ccfd49aa7576562f2ec547d27dce3483cc4218aa94e82d8b7d0917c8c76ecbdd
MD5 82810335c68f0a6a3ce3c46a95c84f1e
SHA1 a60d5987a350b4f68f3fbd7efa7fb7eb8c28135f
SHA512 3a6fb5478b34f7ce4b7b09ceca46579e3e878e6f7bc0c50bbc43b215433710baeab6c99b473593be89ad1634927cb42a2623123d6406477a3f8785afe7cfde2e
SSDEEP 12288:oNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:oNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B594C30EFFCBAD1368CB791B8A3D07CBED346939A110A268A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7028f2bb690c5469a213f316595df79f36b4b3b2444f8e99a20d193a49d67bca
MD5 e74426696eb10b87ba4869e4278cc128
SHA1 3d2211b37ac570ff96e1fe156a3097576c701cad
SHA512 fb3109f4ae3c6ebd8c86fa361a02f48376702c38bd8592fb127e0458882539c4662ba39526c620f63da41ce8ca0256eddeb809fb135cbd4802ce386949e524c6
SSDEEP 12288:V5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:V5AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D055235B994C30EFFCBAC1368C7791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6ba50c0639688be22df066068cacabaeff7abe4536a81764d3c7a5921e2556c3
MD5 a41d4203dae4954f54420a1c27b510ff
SHA1 2a3473a2331152c7b49e3f9698f0109f33353a66
SHA512 eefd655d6604d3533aafe4ec093887b77f57f3d2b073e5330b66afd7a3923a93f0529fc9e57c5a56e6d1cd50494cfc3950484432c78b41423e5d3a2f93420eb6
SSDEEP 24576:HZMRzFVSORAfYLH8AcevDN0FImbwQuq3Wia7gD:HZMRzfdAQgAT76sQuE
TLSH
T191750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A4366B6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 855f4d443cd50f19469a3b3994b2ec723acc8306ec0d470e3140958b0f6b5123
MD5 ad8cedc0f931edc52aa1ab0e241f73b3
SHA1 5e164a6ad700e6bfa7522112112d7274236a99b9
SHA512 3f782d366297ea9525b514cb61635d437a6156af45b5c4bbb9658ec819be945946ce845db3a180ba2aa4f0ecec8ffcc6543fca6b539e62934d44970d67831628
SSDEEP 12288:12AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:12AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17C55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 770c7bc67d103b54e739ca3c6a2aca005037937d165349cca7bb2d10cb1a2eca
MD5 1c3857d016e8cc805d72781ecb718c40
SHA1 554d412bd9302a76f6b1d0dc3caab7fd315b11f6
SHA512 2682351352855b4efc35605ab8c71e24b495b0de1a8551cf009a559e448035e781b35ec0a00eb3dc50af87644314acbc91fe99c0580e7980fb1fe8bbaa4a54b6
SSDEEP 12288:QqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QqAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F055235B554C30EFFCBAC1368C7791B8A3D07CBE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d8d801593677760963d745860bccec466852648ef28d91da5cbfa0f0466ed3a9
MD5 a0e4a8b6f7bb2e7f56eb9aeaf0a6b074
SHA1 df536b61a69b61cf98aaef74752b177c579fd21c
SHA512 fb4f3d07ffb225497fe9ebde3a843d8507200938763fb76faf4ea2ac78211aeaee1ce33e7cdc585a726b3d92622d6436cde2ee70d77e946a371046b9a7473d5f
SSDEEP 24576:DzyFAfYLH8AcevDN0FImbwQuq3Wia7gD:DcAQgAT76sQuE
TLSH
T1F565010763A530F9E576C239C8A21A15F3B1B87647108BAF135407BA2F376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ecd947fea6cf60215a6239f642978b6029d16ee7521dd74d0190e326652c518e
MD5 c271088a8badfe450bc1eb4a72a4763e
SHA1 99f88f26a5fa22d314c627a347730fb84b9d9da1
SHA512 2fa52afbaf90b1f510b7d4d18624d5955c22de21df75c1634e6d8a42d8b306ad2d6001353ff6f5127f6609aa4be7d8b94abfa6847d40c3d02bdf879e215b3cab
SSDEEP 12288:k2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:k2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A555235B594C30EFFCBAC1368C7791B8A3D47CBE9346939A150B26897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6ed6708d2ab55b95dfe7de8c27166fc5f7c69fd9e619d5ffb2b20c9a5a6bda8e
MD5 f01511e1a6e88a257fd2f3cb9ca5bc7a
SHA1 04e8abcf3a3f38868d32d71c350045278e4ff756
SHA512 cba9d7460303a14b00e9cb2a85c92034f9cc0cbd54df9c5e9659daf4e0c4e74a9854d19d747f3ca40340d2ec792ed43d94ac2ff79788ca7e52ab5e6e2a31009f
SSDEEP 12288:Q2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Q2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15355235B594C30EFFCBAC1368C7791B8A3D47CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 626b48a3e82ff4cac0e97ee360bbfb4385d977650c16ef89b9855f220d6975ed
MD5 771bfeed7ab3727e00371667371dfee1
SHA1 94faa3f6341eb445b62a5b49ab6f7b5c29410ffb
SHA512 d61af67d58dc58ce126bdd236bc5176263676214bbe507082c711b87db731f9de0f3bd4170d7de41b020b08a350e411597ed005334e39be51e1ae037dafe3843
SSDEEP 24576:RzyFAfYLH8AcevDN0FImbwQuq3Wia7gD:RcAQgAT76sQuE
TLSH
T12E65011763A530F9E577C239C8A21A15F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6c21bb5a49ea40a589b4b53562e24ee848cc1297cec04ef5a7eaef055d423141
MD5 889343fa204016ffa88094f42f3613cf
SHA1 e17ef885c771e60a953e674e9703831685dbe42a
SHA512 375e4acd2a2f2216c83a880a0c19b3f9fc72ab587650477de462028a0834c2b3eed3a538fae96741e00adaa4b4b1afc960547ca1b54f1a5e4482a993d9bde894
SSDEEP 24576:rTDaLl3z0zDPAfYLH8AcevDN0FImbwQuq3Wia7gD:rTuLljEAQgAT76sQuE
TLSH
T1557501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 21b14697d7bd0aee5dcd47eac1c944d3b44125d9e7140458fe6035deca0c2214
MD5 0745cb7e636e69a385cb4d1cf4857a60
SHA1 87ef8e509a8619527108f0ab720635d480a480c7
SHA512 473489b6536ebf1f4b2651041b154f4ea6f23fd0b6d2a0722c0d9606c3bd6fd3e29642fd65d3775ac947677acd1c5c5271dba5fa6d632cc6ef9d820fd5413b70
SSDEEP 24576:d3vd9CHKy7GZbAfYLH8AcevDN0FImbwQuq3Wia7gD:9vd9CHKyadAQgAT76sQuE
TLSH
T1EF85CF91F3E810E8F0B7DA35CD765511DAB67C6A1B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 791bdf708c6dffecaa87dac74150a8cb9695c18404f6d7d009a87f4026fb07e5
MD5 dc71de71464ef588404d5040f4935ca3
SHA1 76af11ea7fec7f75132936e8ef6fc9ae04a9f4fa
SHA512 e9c898dea46a1440e419b54a8cfea9d539e60a126b0f87561cac0b7944abf483af3adfa1633852c7ee6911d282d65c9de9f5c7e272f24beef14e96eced3ddc80
SSDEEP 12288:1/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A555235B994C30EFFCBAC1368C7791B9A3D07CBE9346939A150B268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a26a05570879595e568d13f6b4d15d8b93592dc82348eae4ed746167caf5c0d2
MD5 0dbc5cd9d3bb9fa1b58f1bcc9d13317d
SHA1 74dd8fa80f38542ac7b42d2e6b970a7040f40140
SHA512 ae41ba66711e9f688a2f232e606d20b9e7b27901e8f2db775c0f7961343832b0b6094dd44aee3698edd1c8b438c182cc1a6e27f047d8e5ea781e985033b27083
SSDEEP 12288:YlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13E55235B594C30EFFCBAC1368CB795B8A3C07CBDD346939A164A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6ecdf64815b0413f0cd0660400025f0d306b17637608dcdddd477910169f0a09
MD5 54c83dee639399cc13507776f4244c94
SHA1 19f9415d64648c8f76ef7dc50c4d5621807b6986
SHA512 5a07d459ac82fa13c54eeacf7aae3707fef070b7c44b31d28f36acc4f4b013320eb944b7ee3096e74f7886081db9b5c1475bfccaeac0db2b780c25c4c01a3357
SSDEEP 12288:ksAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ksAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11155235B594C30EFFCBAC1368C7791B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 875809398c00c6b583934c58af47eefeff20f1d387e68a05625528b589c45044
MD5 133380d29680a6edc99492dd22b6b0b7
SHA1 9fb43486324e8d4db457e1e2fa9a54474d096d03
SHA512 bfe355d150c10b4c9d96df306b0baf1e1e839f994eb93a5cdd7a548e80e467093a75978b51a657d9933730815dd0d5aa0c1e8a07f5fef526ed215dc68c71f3ad
SSDEEP 12288:u2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:u2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A955235B594C30EFFCBAC1368C7795B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5f903297c6b6032d875bd7d3d2ef135c7b53f2a8645ea82936a6320cc819b12b
MD5 31d111550667032be8d9998f81bd59bc
SHA1 ecec71530e7fb1c606a5131f061e761ec98cca32
SHA512 085d7ce4a67ddf033bc9d001b6b135ee7685e9e6f127a5d6e18c97a03a9329247ef9a62d7acb34cee174f948fc0a5b19e52c3fc3d3c9aa208a6c20f4fd6ce6ce
SSDEEP 12288:2/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10D55235B994C30EFFCBAC1368CB791B8A3D07CBE9345939A150B268A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f22e218b01a3c383fbecbe29c3cb10613246fae066dc4405a89c136584cb720e
MD5 3cf809d9a60b8b22d1e6ad3df9298652
SHA1 377b099c86b7e3b4f0cd013b42dd218165711089
SHA512 e3e44c506a9c201bd8ab990803fdab32a040cce49a43d11377d3f58a335453c46b98804c08ff42f1ea5d12c12bbab1c377960c80f86fab0d279da2685bfb9434
SSDEEP 12288:2+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17055235B594C20EFFCBAC1368CB791B9A3D47CBD9346939A150B2B8A7A3E409D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5c69f60a25ca48bb173bf8fb85eb6ab4b8854e79e6494e5828a96ec892021a6f
MD5 77927aa19b65b265fc674b200b093e7c
SHA1 25d27544001acc18fe702f7c3c093873b43f0323
SHA512 4519b6f6f35c5c0ab3010bda69892b46bed10337651fa2f8f7ffcfdd7d2665ce4d57126de3ebf5e8848fc5dc29dc8d0914f0799c73f066868c0fe41d2204bab5
SSDEEP 12288:aAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:aAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B055235B994C30EFFCBAC1368CB791B8A3D07CBE9345939A150B26897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 24f61b0378f72274f15c04a3f59dc682cc081b09469e230deb10e4fa4d933726
MD5 94ddf20d72c68f23110bdfee2c0bdccf
SHA1 dba1718eb4fb3c1df5ad1b2d31d910802efcfa84
SHA512 38caa9e267b3bb7cefd9c7a09fc07d0b903c792df35f4009a56c6371bdcee57900d0b30a2f5b1aaa98b30a524105f035b2e3a1b85a151cae615bfcf0e39d7457
SSDEEP 24576:ofwvUk9RX6wkyAI6AfYLH8AcevDN0FImbwQuq3Wia7gD:8MnYI6AQgAT76sQuE
TLSH
T13285CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e1719cbcefbcd07812b4d72f48012320ce3bc2dd907c8c1979228bb76d7196a6
MD5 512fb93952539086d34c0a6762a500f9
SHA1 3779d3b224ae5aee1d1090833abdacc13c5cdaac
SHA512 f89cbc38ff57f990c43d9b6d0fc22583c629bd6c75dc290b8b6058941c1c621f16c0b46c28204bbce24fa21fd38d426438fb8d803f3287dba035adee1032f98d
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DAQgAT76sQuE:dySzPAqGsQr
TLSH
T10B066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0623e5ecae67a6491b5287e9deac525da43126ad4d4f9c610ce34ecdfdcaa021
MD5 60e5c047a4a8ada849159955b637dc21
SHA1 7fea2429d8e67e7232144168024428c068286efe
SHA512 fddb6100791932738ade544368f434c9869e30e4bcd05b6c2e42650a9b3042993abb3e47aeb9efc1337c5198a6e249c479ba000861ea01d7d4904237ce1fe9e7
SSDEEP 24576:347Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhAfYLH8AcevDN0FImbwQuq3Wia7gD:347JUQjTirIhCnDHUPfF/TAQgAT76sQr
TLSH
T17F659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1b41bdbb8ec6aaad0e3617c1f5ebe8b17ecb82be37eabc6f1b3917e83d510b9d
MD5 5334c41e528fec639a8a7c98eaf1e8e5
SHA1 2eaebf62d02edbe28289b79cfe5a9adb53a2a35f
SHA512 ec4474e4c09e152c46cdd54741968d5ef956ea952a8dc5ec851ea1cb47cb56e4019822e1aee1562dee71538f6fdb96020c2ed821f55a56dc09ca4a900fd5df08
SSDEEP 12288:sbsfmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13C65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ebe094e1b2a706c9ba3905409f73110410223f361ea78310fd82e6db7445a37d
MD5 fd624d09c32829f57834ef82b996420b
SHA1 239e5c892c79bf1c1640826adc84d1dfb7b5e2cb
SHA512 2dc053ea2e2b24873b94b527ea42628c39354fa98547aebdd5cbdcf84784d9c9211a8b226d76d9839d037829e082bb096588b053a4eb519826afa79c23aa8a75
SSDEEP 12288:ArBkLU3fCI0s+LKa4+OnfuCRsK463nfdENewZXl:ArKLUPSbqfuRqnfGECl
TLSH
T1CC350740766AC74FC6A940325E32D2CCA7707D01EE456F0773C89B7FC576668BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2a15934ee69947bdd67b92e089c616bc06ccbc5b2c06779df02161196e67fd70
MD5 8a9c8802ab65746497ecae4a5951b1f7
SHA1 fd1449c8233c36222123fc9c369a36a3f4464c27
SHA512 75147bb7c6de7ed2ab4212e2fc215fb7d1c9ff7f3701fab1c88ae3099c748dd5ff540ece39da2d406eee2b4d3b721d63ac207697c626643bd67a0ed27472083c
SSDEEP 12288:5ly7oVWXGhOln5lysiZYb2WQ6+rqV1k923MRcJdIKm5g:YXGhOx5l5dfIK8g
TLSH
T10075F8815537E2CFC1F7603207266B8CB7A4EC0677496F2673C8457AD86BA25A0BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 74b22ce3f1c1c2b8c5f55f4b904400b5e87133d7fa0217d863236dbd7d89a56e
MD5 a6496f22e24c680676a9e67a96e54f22
SHA1 51c37d747ceae1baf0f9e96cff6e717114d83f35
SHA512 690807ab1d732c25d9cf413e72038309189ea8620d51ee458c86eae533b8f7e744471de2a1392bfdd6f01d4a8627fa935601ce6783f51e166b0ae0883952a457
SSDEEP 12288:a07uAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:buAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C9552357874C78DAFCBAD135487B91386399BCBC870492D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7cabd06ccc8c26c5481a2b9ea4d59a24751239e1bcb29f28a4d035e4eead3a31
MD5 227188871243a49a4dd8b4c717b31b23
SHA1 925d7cff01c4966b54745af5d03ee19d5ecef677
SHA512 32b9065258b27d02755d380ab9e9468c7dcb2de504582a974863b9b1556c24877068fc5ab518953a6d07f6d6e7fc694ce9a5c51bf5a62fbd24bd4cffc8741735
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYEAfYLH8AcevDN0FImbwQuq3Wia7gD:/gb4mBIBhGFhAQgAT76sQuE
TLSH
T10265AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4df48907892527f628217bbe2817d463c28b3bd9d4384c682b6da13fa64675ba
MD5 c8a8544e50c065109b4fbfde22ef4d5a
SHA1 2fe4002c73d25d879c60d407f03a86f14eca04ec
SHA512 206ea7607c6d40e51cf810ed4534cd2c12c6cbfc3361ff7b2dda790fc7c1717dca4552a8013907cdb2698ed3e90bb9b4110f2ef0dd3e48083d61ed183d2c0713
SSDEEP 24576:zG88u8FpJqH1bzria7/mRAfYLH8AcevDN0FImbwQuq3Wia7gD:C7ZFPqVea7/MAQgAT76sQuE
TLSH
T1A685016667E401F1D47BD13889924663F6B2B8250364EBDF07A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8e826860fa95ee353da242ab82baa30c5271bcb88517b167b06b1598b4975388
MD5 3671ca4e086382f18e31a0e92745e565
SHA1 9386a89f923e02309a068b00e19ba068d049a677
SHA512 30171b3c16e4cca789d092e8fd335701613192483d8dd29ace8a72420b18d7873d6ff48a0d5b50ce04f8eedabc607fb1394f8b29d016355cbdb824d170406deb
SSDEEP 24576:RPUr+NQdAfYLH8AcevDN0FImbwQuq3Wia7gD:RJQdAQgAT76sQuE
TLSH
T1F365E12F22AC18E5E67AE13D89928619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7059ffcc10d600597f2d36f4076ed8c52d4049e2915b36d7ad67a61d628c1f76
MD5 0d352d5d4acee4ceb80de8ac76f219fa
SHA1 500be45893115c54ba7664964c392a01eb316a0e
SHA512 fcbec93f4bc426a92ec828dc7d3b528ecea1b59777885744d9b20e7a57a410b9b69706fdd7401b14ef728aee8f28e1eb1db568704cc443b012845de74bc6f8c1
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNAQgAT76sQuE:nG05lO43b7qGsQr
TLSH
T1A1D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 776d963cef77934a629d871ff12f2978e046dfd332977a5a9a9a9c9936730817
MD5 005cc4ed47821a389c23cf5fb779eb3e
SHA1 d1b7d90454f027d3dd07ed18bccf8d87b14e710a
SHA512 6b243dccde0b1f1cf5e77999ed2e6c7006d3ac93c93e9991e6d8604a16dbe06ea7a60583bf90c8ff2e38d2e29253129efc3201fd0fe84660c6e532afbb82725b
SSDEEP 24576:Jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnDAfYLH8AcevDN0FImbwQuq3Wia7E:Za5POZ3BJt2pasx2+mlAQgAT76sQuE
TLSH
T15165AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f9d49b9c988ff587d752c93f213e6a852c8500d7af8d0d312ea6bd1f81c01bcb
MD5 15c7b3abfcba864e325a897881874ad1
SHA1 a6ae2f03da6faa9912d012b54ccd0a74f0bec109
SHA512 71c26c68e088714c4430e715286f856729a694839dce028618627745b5e881c664d4760909d22f4389d98b4494d318aba6a8f400ae84e07c9e30251325d5c61b
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkpAfYLH8AcevDN0FImbwQuq3Wia7gD:FNc/zEOVHFsAQgAT76sQuE
TLSH
T15A857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 810f5cb0d84e9524c7968390e37a969082a90cf1618d2ef96a0b48c3c34943b0
MD5 4fa114bb4fc36872f546cbfe7bfcb2ab
SHA1 c8859b47443e437fe04ca8e428f83784138a1946
SHA512 5a944237b55fff8c75e0d604781c5f276800d20f4d9aaac5b335e80edef017d4a94db16d909975666428d3d0f0e9b49746496f2a1efbbf9f8c235b48112f4b66
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmBAfYLH8AcevDN0FImbwQuq3Wia7gD:RTMwBtOmBAQgAT76sQuE
TLSH
T15755AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 98bb087c62ec5ec29b359f706dd9fc6739c557a3663452a2962dcada39778b35
MD5 bd6fc2e26adf6ddabdd34fc1864d929c
SHA1 fe8e0a507325cc8e84f611132abbd2ecee3d85aa
SHA512 bf4c802c51677a5090f3ff98ebf623140ff497bf3678f62f7e0e9ab566b616e507d444f7f5f17c266d3e0d1de99572b4a84e84157004bbee948d11620fb982f2
SSDEEP 24576:cD3FHshBIYQgAyAfYLH8AcevDN0FImbwQuq3Wia7gD:cDVHeBIAAyAQgAT76sQuE
TLSH
T12475E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1276-307-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1276-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1276-96-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1276-102-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1276-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-83-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1536-322-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1536-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1536-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1876-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1876-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1956-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1956-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1956-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1956-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1956-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3016-109-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3016-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3016-115-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3016-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3652-42-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3652-68-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3652-62-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3652-48-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3652-41-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3656-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3656-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3656-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3656-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3748-0-0x00000000033A0000-0x0000000003406000-memory.dmp

Download

memory/3748-39-0x0000000000400000-0x0000000001408000-memory.dmp

Download

memory/3748-7-0x0000000000400000-0x0000000001408000-memory.dmp

Download

memory/3748-5-0x00000000033A0000-0x0000000003406000-memory.dmp

Download

memory/4704-53-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4704-60-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4704-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4704-225-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4716-75-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4716-69-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4716-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4716-285-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6544-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6544-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6544-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6544-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6888-19-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/6888-20-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/6888-13-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/6888-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6888-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download