2d0a5953395bcb2e592d89fe301b5028c94376f62f4f85a5468037d69909a968

Analysis

max time kernel
151s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Size 5.8MB
Sample260809-xd9wmstepc
SHA256 2d0a5953395bcb2e592d89fe301b5028c94376f62f4f85a5468037d69909a968
MD5 219fbf35e019f3850c505b2caa759f43
SHA1 9a579aa0ca338812e58ab71640ceba57361d2e06
SHA512 e3e103ed91304a6c6ae843c486da45cdbbd23f8e0ff796edcd50405ec7d87392662971f88e9040cc3c6fc8060c1f00d7ee67c7efee426d3361c692f60983102c
SSDEEP 98304:Fm95TeruiEFhCy0hNXvKz//rW63DxJNmobllUgfqPXppEIe8+aLm:Fm95TeAkCz/rbrUTPbre8+aL
TLSH
T1B356E131BB46C072F9A201B056ACABBA446C7A341B3909CBF2D01F9D59719D37A36F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5980	elevation_service.exe
2868	elevation_service.exe
1016	maintenanceservice.exe
2548	OSE.EXE
4584	PerceptionSimulationService.exe
5640	perfhost.exe
4384	ReFsDedupSvc.exe
2124	SensorDataService.exe
3028	ssh-agent.exe
2904	AgentService.exe
2412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\444af6c623e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe32e64e2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058f7224c2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bc73d4c2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f2cdf4b2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f95ef24b2f28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dd3358d2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008453ed4b2f28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a141d34d2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe
5980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2904	AgentService.exe
Token: 33	2412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2412	SearchIndexer.exe
Token: SeDebugPrivilege	4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4136	2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	5980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2780	2412	SearchIndexer.exe	100
PID 2412 wrote to memory of 1552	2412	SearchIndexer.exe	101
PID 2412 wrote to memory of 1124	2412	SearchIndexer.exe	102
PID 2412 wrote to memory of 3160	2412	SearchIndexer.exe	103
PID 2412 wrote to memory of 1652	2412	SearchIndexer.exe	111
PID 2412 wrote to memory of 264	2412	SearchIndexer.exe	112
PID 2412 wrote to memory of 5564	2412	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_219fbf35e019f3850c505b2caa759f43_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc73bf476dcfbceb535f713dfb2f8116ec13fc9318d793a3bfba4ba48b5a72cb
MD5 bfdff3c040d8bdab887b19581684f6b5
SHA1 599de5a71619f7cae0c9ded5508f632cca68a30a
SHA512 3cd48545427b24fc784075f02edf350552ed0c040bc83e49c91a6dcfe27adaee38c2bcb19c27aedb59a6afadc384d1054632ee1c003f37cb5d8eca348503954d
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4Q/lFTjN4:j3q6HjBwLm
TLSH
T1BED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 765c982bc2b3658de52111a2dc093260630849479ae888a11ef3b125a2f60825
MD5 5a52956a405245a2414faa1b2b54a380
SHA1 cc34333a3be78037066f106b620704199d82f4af
SHA512 821b1d52cf372aedc01e86a3b16713165ba291735f7236a226dec7243bf74301139cf54c9274134a3a183fdec636b9fa3ad6f0461648139dae492e814ce948ce
SSDEEP 12288:g1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:2XYfDtczAnnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T12565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d28d0f93600642a2ef36d18c94414b9995251a56a2d33b6dbf65e11b138583b2
MD5 c4d7405108279197d6a3eaa863727049
SHA1 d534cce62ae8c449f19ce459efda8a8cabfc41f2
SHA512 bc72de1398abf59957fafd758d6da75b63c13ecc05c11eb0fe41d90b249b5635eee90f64f5e59f8624755678ff5b7ac9fbd703d0034c70ceb47fe18695b3cdb8
SSDEEP 24576:Y0Le5ji0hmxLrMwnQ/tbw/2Mkjy6Fr7g0o4:YPji0AlpQ/lFTjN4
TLSH
T1E6859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5d7fa0859743f4e54aa16d598e4cd79aaa85c8d31326c497eed080a9b2086b8
MD5 7b86f9b37bafed204a81361f1b1c5518
SHA1 e28097fbe18dd9e54fbdf476eacd61ee20f8e05b
SHA512 5ff019106bd4cabfeac3248a6df5587530896911c4c43bcca702177d4fd5a232a52629535d24bd8370128faf0ebb63d8524b77090643ffcb1d470e3fa4d81dd8
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyuGnQ/tbw/2Mkjy6Fr7g0oo:2/ezSC6vUzPvxHjy1Q/lFTjN4
TLSH
T105755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ab6d875113ab2626e9791e07ff33f6c16e67cac05acf5a8bb80629adca5da177
MD5 045b7c9540783dace1bbfaef8aae3316
SHA1 d0fb513b35b96b708554732a44f3908d443a99a2
SHA512 8061f88d45af3e963dbe74b8283de5287fa6c2b38b745fbdbf197e9e4cdf88ee95b11da7bade38823fce88aa7c8790ab71ae0b4567c278c6bccb3aafd61aff3e
SSDEEP 24576:8VbqPb88hv/l+6LnQ/tbw/2Mkjy6Fr7g0o3:8VO88hXl+sQ/lFTjN4
TLSH
T13F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ba20401597ab8e7872c320157939f514259b7537405d73532dc176d1563d962e
MD5 69a7a1f6d627406544f6c5c777a144f8
SHA1 453bed77eee34a7aefa81c1349a13cbad42fce69
SHA512 ac138b61ec031e501b60bbd499fbf3ba5f54702133266617da115fd568b78ce3f7965411e877d977d1fe6bc119ac1b4361a1ebf80c8d16e98ebf8de90e058f35
SSDEEP 12288:8zUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:8z0nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1BE5523796A14F897FF2B06B15CC28482AB7B0EC1BFD4A74E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 80274b5e90fb248036a6ab102ae8a4b53ad628221b9ef4a022eca935597c6022
MD5 f5d13a96213f3c088f93dacca97b8570
SHA1 efee9e7844bab44c573fd9ff90ba4e3831111496
SHA512 deedd90355738bc94d7ac8701a6cf68ebbc0deebb2100c1826a5641d8ad5ac18844e0ea849ee311888eb919196fcb39da8776b3a429ec682ca4b4a0e28ee98ae
SSDEEP 12288:weBNUbTVO86UTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:wJIUDnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bb64d1196f7dbc65d77d791299bebbb385b1aadcad0e83e21208864161da944b
MD5 c893aec038c7164e492c2979771d4c6f
SHA1 a287cc8a6020719fb9cb581f6f98b3beb12b2cd2
SHA512 3cce07f485c91046f948f344595bc0474060194486a66c51c25241e3933dc1944239bbf3eb238c24e9fbbebf04a87dd67f98d937a5e438fa361b47301dc52cc3
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:DQvGAdlCEL8c/yRNw5ChLm
TLSH
T18B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b3efc3663ea07acae2646419890eb1656f3e89ad4fc84eea2817fcf78633f57e
MD5 7361eaa5289159eb02d2c333fde91f5d
SHA1 35505b56389ecdf3e4c9525095f86f0572c1faa6
SHA512 bda2764fddc0da034e237796ec4f6e17d554ecce8c38f6f16bda5a1354b653664f5d09e2df62411c5912b628b613f8168bdc0685a19af98ebfe54c6d5392d874
SSDEEP 12288:LAwSfxL/2Dc39DLLmt0LDQewsAjpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgE:0QewsAj5nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T15D75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 58c81871e3e4d98d97f64608eff6d8a0eb6a9e7c91f393ca34fc797f08af989d
MD5 0a301edd414e7f98d200084a57dbafa6
SHA1 6464cc9ea863cf1e16d3be560c0227638dfddb73
SHA512 b58b5991d2feb186f1ee9c0610d30118cfa193c4e2f5e39c09876a7056014a85845bc327af2c8496738d06b225f834994274561faafb45ac936ed5e6a52ff336
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGL:0UEtQevvqc2W1cpV2EI32
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b5203e63bd52c3b4fe3ea491856cc8a563e8e8af9783b31533382f15f81c0317
MD5 b94b6e7d418b80f55426fbf644d9f009
SHA1 2e3c631a8c12bee7c084c39557b426a5ca8bd032
SHA512 c2cea60382e4a850edb1fe0e744bea101e21652efd076c8145947f0276fde24bfcff0dce15b393f9916614389a7ecf53089cda9f19ddc790c635015c2847373b
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zZQ/lFTjN4:foqtVjnm9Lm
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 af2e96b26f1f3c105b3d4347acd76ed0af46ab30db3ed3310ff1f9bf16f54e45
MD5 e3b9eb13a010f84a063f22df23ba7884
SHA1 0676bc0e49941068bf24eafc8255967d037a14a7
SHA512 7affd9cc973024cf758259fa225fbb9e954c87fed60cc91a97f8c20d0926ad38f93527681ea0599d740d50a7b1e47e21c4faf2ad19a91fb009803fd98ae06d97
SSDEEP 24576:+AhGLJIFoiwtA5l7S53SnQ/tbw/2Mkjy6Fr7g0oK:+AMyFoiq5CQ/lFTjN4
TLSH
T11835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1e3a51b89a56463ba7518c31d3c241ab457ba115ec58751cd8f65121e0fce9c9
MD5 6e0a36d82e409926a920f6942e47ee5b
SHA1 7dd5623a27c499ff329e1298c5fef9e2d0b73171
SHA512 d12349c837bd37a36a4e2fcb73223f9459ef36a1be55563cb09f3f8ba4e7d3acb00c93ed0cfeaec93be6523b7ea816aa1b894bc17a3dbc9db69e58ced2e5c4e9
SSDEEP 12288:qmw5HEjsChN2BFgl0WDm+CGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMg:jwuHOWVnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T13F65F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1c9fa2e0cc8042cc0a54359f767e857f8977b7a14edf603235037b90fd350946
MD5 3472b3b7ef5feec0e8ae1751332739a5
SHA1 9384e449c4464810259940f9a6382a9a8db9499d
SHA512 92094921bec3c96b8ad0068285c045ab45ff1fd9c71f9c0b68a8013c2e9763937ccb1cd26aee091fd0266eec40fbba9cfa2e38e517de6fa2df50c43e355f354c
SSDEEP 12288:7XZ1Iy5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:zZuInQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D655126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 98443b464dec66064a6dc7d29b8bfe686d84fe5ed7ff9ccbe9c1cbee78f3a869
MD5 db77583f08da212c1afd19956ae3d580
SHA1 5b2a92718aced4a29c337a4d50d595e3216181e8
SHA512 040cc3003b2ad564f5cabeb263f8a14d1c19f26fe514fe68a1ad0a44639404f3cf077c7a71d7de1e4e2e49f66623abca85017b33e40badb6fadbcde26ad957d0
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:RQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57622f4f076aa79bcdaa470ca7e5a66dddfdd0312b94530b037a49769efbd3dd
MD5 525efa56595ba9b770cf11b67216944f
SHA1 f14580d24e11c104f391f05bfb7c0f990570b48a
SHA512 6c1eb547eb18f3d12f3b40b50e8fcf33073ae917856285e06abea52c9d3c6ae7ef461bc064b145c2c215f63455528624ea33a6d24eb8e053c35dcc47b2a7b260
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:OQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T185666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f136b99d0b7619fee420be9baf922c87d07a28bd4c1b07352b28ba8246a27e58
MD5 9341238b599c31c6cc4e7cb7eaa8aa40
SHA1 f911cd0f8de3d0e1bece724f284ed69de3b127fa
SHA512 75f5daf2adf42b71e282098b0989bcfd0f7968c3e5f7af3c73b7d230e4b7afe59ffd4bd7f0086af8cc80b970d4c9fb0e66195f1b4649cbd03cb3c065903382f6
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04nQ/tbw/2Mkjy6a:D68Qg55nhheWu7PNU3/pQ/lFTjN4
TLSH
T138B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c3ec990c4ae1f8c85aa22de012c1d76c7e418f55c19990f34db8fc1951b2fea8
MD5 5b81772cab121b0b59fd86056c467155
SHA1 6c15bfd95f3e6aa4a76f1592f8236c7fffe195d3
SHA512 e49955e1d5bc7431053a27270788aa8dfda44cd56fab82a907cddb539f8a3e5915c967aa46af69c959c0454660fa4f40cdd08b74460027ee15b22fffcc4ec6f1
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:ty5112gYy5azzVvL69nLKnhZnLm
TLSH
T19C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 025f877e9a958bd12a385da29846fb4ce8cf34bb7bc880536bb4e7aa8de8dc0f
MD5 57ecd762ca6a6bd808374ec1e527a9d8
SHA1 00551d7d10cfef54cae8df2af18c582a5af664c3
SHA512 c589459c249f3ab369070e31f71d6d51dfa160dea70b8952a51d50580b185a65f2794c5faed99802f0d3cf7603e953d9e3eaf4c034c35e46568e6eef868291dc
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXQ/lFTjN4:ou6JmVxd2d8Lm
TLSH
T1DCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 adc934b1f5127689f900a7897edf4a1024e6a57e45ea51c1c7bd9e13d73760ad
MD5 c089fa8d21d87486b68c435fb2f7c45d
SHA1 bda60693803354aed9a8f74e240c6e98dc422bab
SHA512 364ab36697ffcd6bf5a644b15a1188bc19a9d72be1d1cf73954c415fef10d2d31022e116f1dd6d0f499a0e5566005acbf73434500894d4b8d90b7d9e7df1a2ce
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xjQ/lFTjN4:QmifPbR9Lm
TLSH
T1EDB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 95ca4ad746efe38d258cff99a3c3c988787790a80c27445d14ee47cf69ded8f9
MD5 1e29ccb9290ef492a7316f63c7ee9d33
SHA1 f0db1c9a021aca213716b08e2183701ca5b4da7f
SHA512 9b0f70ff7ac26e914544c63f7ca6456eae3980f668bfba08770d8ae0686f5488f6625a7934b45c6b14d34ad0f26eedf773f58591d6d87b3d15f805ee997e6656
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqIQ/lFTjN4:/5dKTi61rLm
TLSH
T18FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 17e5aaadd53b9eb484968bb65a4ee80ca0ae343712ec1979ed686fb477a3539b
MD5 dfc9ec70cc461c1fdbce4283e7a2b1f8
SHA1 73c196e29030031809be694429a8dd5672618c29
SHA512 8f2cb33c2cd19d64c902fd697a3829135d16f65ba294e31686d95a2377d33e35c5100f790b0350e3f41f4af09c019744042abb72095a31a21ab0aa332777ff01
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:cX2iyphZLm
TLSH
T15F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c309fac860d1f0f4263c8753edc820768adfb20856524a23f51372625f8051ed
MD5 5c8608467a1b677913c853f4e7d3ed2d
SHA1 1451b179c597b9a30b115aa1711c1ed72901b865
SHA512 f3c70c50f6bc2447dbace57ec634446f69dc53a048b6dc8fbec67f3f0663d24e23e3201651f31ee28d7331b4a635a4d3781039f6d2aacf3be890fefb6c299fca
SSDEEP 12288:csGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:csnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1745523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5f25d69b5324eed2ec2f0ea3fe4e4357b7b8b22306a2d82bbc2292c2afa8a856
MD5 c48e22d5e0d685bee8e5795155306690
SHA1 e7774660e1d0d99d67083dc24cfe43b9d3aef252
SHA512 783a702e157425b2e1dc5b27a602b30d7b515adb17b626087f1282981ceca8fa5b167323f5895346f75309caa9cb893f78078f478eb0a67d40af59fb2faaee9d
SSDEEP 12288:VdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:V9nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T16E5523697965F98BFB1706F18C828182A73B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1a0abce1b664010acb4fba047dcb803e22dba4db62c41db9ac85fcd0dacd1f80
MD5 785ad74ac0e2999545cae80c65d23527
SHA1 d0fb9cf901ff1f53f6e40a9bb36eeb39b705a0f7
SHA512 607d4a2f6efdd236da466c9d1609bf6bec282aad1316eab1073b34f0dbe6103383cfa84473d91a46bbaa41afc1eed641a703ab652227a3274d8bd3f304cbd635
SSDEEP 12288:ALGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:A7nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T12E5523697965F98BFB1706F14C838182AB7B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5abfe25eefb962fd73aa894c5b2457860c79de610f3d8618ad01dfe2a5d2530c
MD5 cf20fa436f69a27585a7028b9883978c
SHA1 e52d6c8e69569f08376ff92e7f5d175b7768dee1
SHA512 b4850dab84e6bff6db1d0dbe8f2d0b3c7d1de318296d4b719fb5f810ba9ffd02145a651e4d78178330b48132ab00665da8f97108f5a8c5bf9657983606554d06
SSDEEP 12288:0VyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:fnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1A35523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7ff2c40d2ddd80829bb2422144f8eab978e531e964b5ca147c3ecae79229e46a
MD5 da4bf95b336ebab60a8101f37d46ffa5
SHA1 a724b53e354a4ac7d206dc8ba22446592a95546e
SHA512 163b29e4e9989c9b0d334d3882f89661375dce3d792de7ecc9ee8cfe1a87141e4abe91b316a662360b5897a3e1133a874513c527708ddb2e3bf3bd690dd2c14c
SSDEEP 12288:caGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:canQ/tbw/2Mkjy6Fr7g0oR
TLSH
T15A5523697965F98BFA1706F14C838182AB3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a359d761f55b5ab836aba3935a6e58cb0a2e9bd9825bedd7a184288589cc9e8a
MD5 245f6ce901190259e3c459c66d58215a
SHA1 db006470f16e8f6727edf71494a192c844ad2596
SHA512 c6b85fb166f903bf004006b0b49cd643cc5c5b4fe5065ad9d171c61a0cb3bfb1ef6b90e046f130efe0dc824930e5320def07ef570910aca5a84640db8d97ef98
SSDEEP 12288:DhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:DxnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T15C5523697965F98BFB2706F14C828182A73F0EC6BFD1938F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 721b220d9a1e85156004c5db79850ab00f7fcf79e2530f64afa2d8042d9c3e5c
MD5 39e151603f1dce87da856bb26f5e5e7f
SHA1 970ccb5512e40c3a804fd300c04f0baa790e6493
SHA512 4094c7c8c47c21141e7937c721e88a7c013d8b16514b2e4620f89f6918691e729035bfdf6cc7988189b14e51e8ba02e21a11c7d96b506874f6ffa084721fb5b3
SSDEEP 12288:olGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:oFnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1885523697965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1db2e940b92bc53852001bc43a4bc14e874ba647c11037739c57460f067d61c7
MD5 25a7bef98576f577fe5e609209e5189e
SHA1 596089a8a265db3982f778e3bdfaafb1364f4454
SHA512 170135a59813be9ebd16aca38db638745591f3fe94be35a26dec571f48d744bfa4ce71d5e71824aadcc8c65000ec5f790bf816c540b8af77a72641605ed19b8a
SSDEEP 12288:wiZwbDzzFEoS2cPvy9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:zZM3zFVSOdnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1CC7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6efe53442015ff15fff296e08434a5dba3823e3d9b5bd7a44aa27b8a741b498e
MD5 b588aa3fc21cab651d88c3914066eafe
SHA1 5cf4283a2069b55ec129fe99ebe9d95b4f91fbbe
SHA512 d6d70f45c17e1d6df33f17a5fb27ebc273cf879867a91bfb86dcb453de4ad926e6a9db204ab80cb0ee8a0c2e2b0261035b672be53833f11c51bc7af96a37586c
SSDEEP 12288:7YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:7YnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1BB5523697964F98BFB1706F5488281869B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3bb6a191b032ee71db1981c0c9748abd62a904f9cc32832c0eb94fb56f3df990
MD5 d836ba9184fa77a8590da0c29dee3533
SHA1 c180623081000583a0ed588b597dfa70618a9839
SHA512 bdc267482985c2a75ed002e8cce2730e619088bf301e02ac34463c3b170421a470b9c555bffb6e622bc86b6fe905ebf24ddb9946e4ff1064c7d1e2b7a5813a1d
SSDEEP 12288:dkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:dEnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1D55523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 82debf39618d2175e21cc1e51cf2d32eccee4543b43a7c06c08902a148301995
MD5 5549087480a0ade079c621475b212dbb
SHA1 6c23f311533d6d11f9df7285102d4fb209eac40f
SHA512 8c367b1841411a56fef3e7e3dcea5bdecef9c6fcaa3b34dd649bd9d9b332075f8b790d40247512e37b01af5a5e11e1712e06613fdb11987498de5a1255a29c5a
SSDEEP 12288:RyPz5L85GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:AzyJnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1E665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2be78f72da0acff98c1e575c3229dd62facfb9aa91a4e5c59779d1c8fb3f4af0
MD5 5f67cc6b22896880d717eb33e97c97d4
SHA1 c1bf610e145cde7149f8deac1eac91229d832f3b
SHA512 f671a55feffa5f9ee5fb7a84e7984ae4459b4b81a0101636a33a8910dc551a8b9514b3fc82dbd73416111d893a4ab8e772bbb185ac4a692fb220c8ff5f14cd5f
SSDEEP 12288:yYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:yYnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1E55523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0571fdda72239dd3d42ea58058896598db7a4ba95130d18aaf7d5b23e07ae961
MD5 740cd9a9eec7f08f0772e7b82dcf7e8f
SHA1 d5d9c90fb383df6ac11fd2d2654519a4879aca2e
SHA512 e7428e64f8dcbeb835b8165a6d28dab3f5bc946c4bcfd4f3a5fe488c366064a080103db03947eb6cc526e5392a843df3762cb47446adbaaa68e72b69a5ed7f21
SSDEEP 12288:cYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:cYnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1165523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8a48d7e90d745d597622b5fa699701ff5069be53340453f259bfe80dce0a9be8
MD5 d1c83a12d4439b2f87d6a994b83164de
SHA1 62ffddff85061f51c7e91f8644d5707393b6faaa
SHA512 eb160a5183834e26eb9b9f20a2150c9fd7bd738fa74bd7b39e68e2e8ae4f46b56ab5005f672b948b65c08e0e255ac22b6c6334feb1e96c0e2eafae9754720867
SSDEEP 12288:1yPz5L85GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:czyJnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1EF65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 53ed80e6fe70c6fcfb942cb70547ea6cdce0e732aa4c4a73b9cb7d60b2385700
MD5 25d40d5d0da5e187f03cb65cea793a54
SHA1 c729f20b9c41cce0a32fa9f8b1f119e17a444640
SHA512 a6c4d9a3206ee135b05350ca636df3ab9b0d9ccee53e8369fa12e8795122e54f81e13272b565e101e6043f81641b827c7fc6c10d0bfe85c1dc685471b6dcf78f
SSDEEP 24576:GT0aLl3z0zDrnQ/tbw/2Mkjy6Fr7g0o/:GTDLljGQ/lFTjN4
TLSH
T1A97501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 45da245888203c79d8c82b4b3724bc4fcf6d6ac9c1555910eec7a8e46bc343b0
MD5 f3c177a7bf6df164e8e7126e85795082
SHA1 5d9d44ebb4e46e34e7028b49660141dd424b2e69
SHA512 ddb0131b2cba63b17c9297999eb46108dd3089c6cf084a1696ae0fd6def993b0bb4291614c4f4bbe92345059d21aea738fff44cf4ee918423042b4bf71a7e4d5
SSDEEP 24576:831d9CHKy7GZ/nQ/tbw/2Mkjy6Fr7g0oF:m1d9CHKyaBQ/lFTjN4
TLSH
T1F685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3def400c8fb9a08fdfada9209e9cdae98d9b99c4ef1556df0830bb869602caf7
MD5 01f2965657480cbd97dbf6e2e24e5fce
SHA1 71fdd2bf6c8218f3906bf8ac395c88bc41f9c2be
SHA512 4d503741228a975eebd46ab77313fe3947cf23e8f60cf224d0806e66c4d789b31e2e0123f7ce04713f4189ecdd41c525762899cec04ad57b69e31fd0b7f35263
SSDEEP 12288:7rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:7bnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13C5523697965F98BFB1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a1026a513eb1c23d95e398cf8c2bd0ad787b3da81beb40920cca17fa9ade2f4b
MD5 ff90616c988629a3e35ae0dcb8392ce8
SHA1 9932b63b0463a9f80f9f143fe78a936d48911d81
SHA512 1444b177b427bdd5e403e85ea4f588f21c257d7aca0b0358302100995f13ef26d6a87954b493e51ebc416b75eadf7ccdf119e462b1f9f0cd5b6013e4861b3283
SSDEEP 12288:cZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:cpnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T17D5523797964F99BFA2B06F14C838182AB3B0EC6BFD1938F77481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19ff0e195895be49098f4eb4345a25443123c7d4b8ddca8ff3b2b268ea15d227
MD5 4d349966051c3a9ffe3a42f9e1b9efa6
SHA1 f6dd8f70f9e9bc41ed44816f053de6b0b7afa489
SHA512 0671de4dcd8527d247f3e3c9795d27cd27e907544edd67877e9583fbc4eaf9b946b938b63b0e70a00b0439ce5d8bbee543e6dc0e51b5b4b789419a8e5633905d
SSDEEP 12288:GOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:GOnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1275523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 476f2a2e85962eb34aa4b69ac157d637f9497a980bf949f4e142d10b241f7392
MD5 4fe38ade3a460926ede46dd39db1a6d5
SHA1 d2102272f5aa980336418b558c9aa886fe47c21d
SHA512 939c4c676b9fbf698f413455795a2979c580d4794a387e94d433871745976d3b481d5f0b625df69aad6dd4bcbb74600b8c8f0afd0846ebf5371c2b6899f0d5cf
SSDEEP 12288:0YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:0YnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1165523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 93ba5fb38fe6972125950cb01d880aa10cae5fc2811bb7bba4affcaf00176a64
MD5 8cf6777650b4d4b9bd835d7fb2c49905
SHA1 f848e705085f0aa4d9ca0f7ba26b76aaad8e93dd
SHA512 2b058b2436adcc1f7aa27d92c91a88c4d9ebe273c8dbe0aa4347bf9addb0efee7514f9f95131f72f4cf481da71677aecbce3cde924930165e202e2d0497ee88d
SSDEEP 12288:grGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:gbnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T13F5523697965F98BFB1706F14C838182A77B0DC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4fb2d6626b7cadfd2c0309bb7eddaf3d1bbf6c744ec253bf564042717c5131f3
MD5 5c6e61378fb273a4d96c4045d187bfd5
SHA1 f247c11e5d819d6a79fcf96e1bbd999337de630a
SHA512 79f6ed2adc3d52107e6adcbb0836c8a2bbd34bf614444545924e4c22ac525c3af9191996a3d027082955bdc71371f7336f9ed052700dfa2b04be2706a2cec05c
SSDEEP 12288:DAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:DgnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1995523697964F98BFB1706F18C8381829B7F0EC6BFD1938F7B481129967C39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5a8245c55034a257e606d26747ea33e95cd5f35b1f9932cd981b642ef3ba2e20
MD5 1a13f2f1307de874f89b1cac8785190f
SHA1 b245b9ba20f58afd18193ad3aad7f42de12f8212
SHA512 3968f6acf0c7e598a86bb3287871abd916e43f34637d02da5d434f4faa932eed5bb5baa809b70d0bae95442b1442a3a0bd1d6f00d70fd3e1443915678468a4b0
SSDEEP 12288:6aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:6anQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1EE5523697965F98BFB1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 54852fff9c32cc8c8eb82795025fbcd2ea42934dea431d761ff4e58851f6381e
MD5 9f7abc8afc1dfe5fb6b20762b34d1372
SHA1 350d54c0593fb1bc82cc3b914fc60952dbf65057
SHA512 1a55c6e1e44d6cd4e20188342ba3dc388c3fb77669f9d465d9f6483fc6b3c393cd0d1e5808c0f6886e716d4d24254a4df6d9ca7a8aeea4c2ea61a19fe7030cb6
SSDEEP 24576:qfwv/k9RX6wkyAIUnQ/tbw/2Mkjy6Fr7g0o1:BMnYIUQ/lFTjN4
TLSH
T16985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e5cf000f6dbb03477c7add5002c8e12516dc324cca1cbbaab12a87f115939ca8
MD5 acfe3af3b9012c99f9c6772f4f2fea86
SHA1 84ceaa6d259e7ed1b60fcc5e11eac6e0458ec40a
SHA512 d44c32626b4c7fe094d9a069a967015e1dff8d977c7e02f1b05ce1c27c65da814e455a140eb22ec16c708404bf27a0a3738f089fc47bd229a4eea1772e27d085
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HQ/lFTjN4:SySzP0Lm
TLSH
T1A0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d47059920df4a906a0dd47de0a8325176f7a64b2083ab69106a67139c98c817a
MD5 e0e2478cc4f3c092fd02ea9931c8dd9d
SHA1 5568c90b13694dc2ababe9293d29cde41107add9
SHA512 e6db07d3820282768db6cdcf90e76f920384352042fb9b4523cb71a7410c0b5d0642d9e078d86ab13d75d46c5c13417cff99923aa4f5600cfa195686216e752c
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtnQ/tbw/2Mkjy6Fr7g0og:P47JUQj1irIhCnDHUPfF/XQ/lFTjN4
TLSH
T1BC65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dee72f313fc130363396526c360205282250c206bea40f00f918552271ab5703
MD5 8563b7f026892e09c7ff3f8f185a32be
SHA1 41cebcf561363c916960015107f161bffa6657e0
SHA512 2150f445ab17c6596186b14c03fc7b8ceb73f787a11cdb3abf79fe68a4c5caa47e65d089be1ce66dcfddc588bafd27b647b27ff441cc2919484f7e5c62e86700
SSDEEP 12288:5ssfIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:RInQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1B065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 f053b68fd98878a3d07c2fec3ed6318486ecf829809428938eb8e368dd190c58
MD5 a598e9a64284a001b347eb098f70622d
SHA1 aa672712b0b0dc31f30ec396e1bbcd98d92e1907
SHA512 1ca294928ddfe563b619a459ace1b44c33c09c0af8f9eed9a43002968035320778fa559a006d73995da7f86dac0a39c5c095bfddc6b0f0eba243eb25286ca0fc
SSDEEP 12288:WXkkU3fywC5j9AIPQnb8wD5WupuivkqohPC+:WXVUPoj9Af4wD5WuYykbN
TLSH
T1872528017626CB4FC6AD40325E33D1CCAB707D41EE449B0772C99B2FD5B6659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5fc83181fab9ff5026a70df30aa07bf7b4772b375a7cd87cb4706f3b45ae1849
MD5 4ff14f0aa8f42f6f17c0e92566c3b7df
SHA1 53b958d5e17a73130a9d0d210ad2fe9e1fcdffc1
SHA512 744824c217d404333fdcbbd01759aeaab7c15745528354ab37e0e27e3d16f07efc52fb7f2febe7120c77690cb6f65e71ade52803596ee844628c52a55465b265
SSDEEP 24576:3/uotOzo+D2+bl1sxTmm+0lutbUOfEJehOVaiyNhnTMEa:HY4EH4Ea
TLSH
T14665D8405536A38FD1BB6032072A5B4CBBB4EC06B3496F2777C8493ED85AB15A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f1ce07808816107c2624d348a39ea4e88753dc5597ed8d82211d5bfbd29677dc
MD5 f8af621c20b054b715d8ee432a13dfd1
SHA1 78ffb972fd311cb28a21444f2ae4a9057d4f8c81
SHA512 d8b315f29431b2d4ee18cc31c7951ad181073c70b36f5482fd58f329d694c975de3e9966a270334dda274887699237a0645df0f79c1d938bb3040941c7a034d9
SSDEEP 12288:R67wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:4QnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1265523656668F94BFA3B06F048928111673F0EC5AF90D3CBBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6c074c529fbb6ffbb9408780441ac645ba5a3efa8d289944cf9967ece08718cb
MD5 38348aaa8a04fb4bfb3508a8ef60c032
SHA1 6e26001fc7cfa0ae341c314e3d2d3210f1b843d5
SHA512 b82d8e1a0d7b504807c2c2e805af4369022749766224d61e0bcc563bf50bfdd988a126ede2d2437b5acc9cdda3242b8056e112bbf7928d6ca7c07a7260f3dfca
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYGnQ/tbw/2Mkjy6Fr7g0oz:ygb4mBIBhGFtQ/lFTjN4
TLSH
T19665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 de124ba91af2c439c637c9bb199e39fb34fd2f7f15858f423682d65e4826af7e
MD5 0a4638382f14f3194f46243afc8c3b0a
SHA1 f39d345fd512e066b502cdc1d4a042f200a76902
SHA512 bd988d229c8e6bfb687effc3918daed928aac8b6947f345c8bb788f81cbb1d991d2ef965234807dd0e886aaf8a8db916a0f9725606205a5849a5e1372f9d9a2e
SSDEEP 24576:CG88u8FpJqH1Qzria7/mdnQ/tbw/2Mkjy6Fr7g0ov:Z7ZFPqVva7/uQ/lFTjN4
TLSH
T11D85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b7a40cb54a6ce46cbe00ddbd5e0a6765febc95a0b8d12921648b11708a50ad7a
MD5 985d4d065d3affcb839033507be208aa
SHA1 76366a806212dc9a79d6ac3535d19f22edf7421e
SHA512 fde80fe538a40c8fb812384d251d3306e00dfc8ad309a49b3f82587b8ac5dbe592352d1321a035a1e08359fcb4182b6b4df291bbdb3798a0beb0cf19a91a0bbf
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxQ/lFTjN4:1G05lO43bfLm
TLSH
T1F5D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a52944434496577146ce5ef6ba1ad6693c376b9304c7dea23590f15329fe9251
MD5 6354002831d5dc726d2152bec0038ee8
SHA1 c01479b7a8600416aa148091656852056b86c736
SHA512 de61e20dfaab19482f7a66ba4fb7f1ea5464e808082a636925163511d0c33d82c33007ddddd33bbb711bd6f7668a70f3ae54dc51c8f93f51fdd6c2a5ffb53a96
SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHnQ/tbw/2Mkjy6Fr7g0oT:ra5POZ3+Jt2pasx2+mpQ/lFTjN4
TLSH
T11F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1ad697d96c618abb0885514307b555d713d9b25f6ed7f6518e33be9cb7f16a0e
MD5 32ceac3cc2f1fe8ee14bb5d2137c3253
SHA1 3436eaf3eeee48cc134dff255c0fe01d0e9979ac
SHA512 29647c6848049edda42d9974bd322fac22b8aa351c683eac9d88087e1694701c7c1c2b3ebcc2e292c910af939ac82b30e3de073979a38e4bf1d9eadb4f0987e5
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fk1nQ/tbw/2Mkjy6Fr7g0oK:7Nc/zEOVHFOQ/lFTjN4
TLSH
T18D858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1f1f80b14862b0d83fecf644cbc215f2ac2443370675d7e171d0d738ef79676b
MD5 50f20b86b7477e65e371d8e0d03c31ee
SHA1 dc31b275a703bb372add312a4e68b65dcab38064
SHA512 20ee6904fa33b075a4cc26fd3215ff565d301781a636fecee1afb03b3399b15488d873351f611a948dad4ccc03d93ba4c68ed22d6dd3be43479a8539345e44a9
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmTnQ/tbw/2Mkjy6Fr7g0oA:D8MwBtOmTQ/lFTjN4
TLSH
T16155AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 bb9e9cb5b147179dcddb7a42e198efe42ce2499cefebd14e7e21168af9edb438
MD5 e824cafcf2cc5600d6e56d39e2a387b3
SHA1 2d4fec9c5d8950982cf3b3cbd32faedcc2d22b5c
SHA512 57f1ec214b7eac6b347b5e1c027601df0206158c65816c79b374237d1ba4480e9e38dcb969487a181fdb95a1df80f14ff236cbf57ffbf2e9b3ac57dbcdcee3cc
SSDEEP 12288:jHvUrBFrEjwaQxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:jPUr+NQBnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1E165E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 26ad1644a30df4e83942091c0566c539ebc92614b89052258e451c05e15b28da
MD5 eab87550dc59b8f7e854b5e29de8ab11
SHA1 12187628a3e8ffcef2da89ec74627f082e0aaa1a
SHA512 3f93e6386416cbd96492e697aca65537a1250573f75b0ab9e261258c28a0f417f5c41308bb90392c6bf06cc63e065f0f896c8cc59a6c9901c37a89484f28b8e5
SSDEEP 24576:1D3FHshBIYQgAMnQ/tbw/2Mkjy6Fr7g0oX:1DVHeBIAAMQ/lFTjN4
TLSH
T17F75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1016-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1016-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1016-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1016-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2124-312-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2124-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-99-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2124-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2124-104-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2124-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2412-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2412-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2412-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2412-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2548-59-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2548-53-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2548-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2548-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2868-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2868-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2904-125-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2904-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2904-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2904-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2904-131-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3028-113-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3028-310-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3028-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3028-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4136-80-0x0000000000400000-0x00000000009D8000-memory.dmp

Download

memory/4136-0-0x0000000002780000-0x00000000027E6000-memory.dmp

Download

memory/4136-7-0x0000000000400000-0x00000000009D8000-memory.dmp

Download

memory/4136-8-0x0000000002780000-0x00000000027E6000-memory.dmp

Download

memory/4384-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4384-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4384-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4384-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4384-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4384-86-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4584-292-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4584-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4584-65-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4584-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5640-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5640-82-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/5640-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5640-75-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/5980-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5980-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5980-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5980-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5980-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download