d7541a0f03c41b8ac670be362235a474caf604c831fabf1ef4f64117805bad4e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Size 1.6MB
Sample260819-qch8zafc32
SHA256 d7541a0f03c41b8ac670be362235a474caf604c831fabf1ef4f64117805bad4e
MD5 892d0fe9e21db2bcb706609bca13bab1
SHA1 2d7056b2bfca3f67c077c5bc4ebb4566421a1f4f
SHA512 c336072fe9129b875db9ed4ecad334d52c82934e388f62caef3c00ff712cab0b7c5993222f9481c533bffe333a859f41fc2061e1b7f046a004a2a0d3a23b1a84
SSDEEP 24576:SR2DdnfEgsaUInwtj0sVwRvXkSHCytY4eWLiaomWDkySo+7MjpiRqHmLqfGowKuN:S3gsHmowRvFLWDkySOiR9Lqfh3uN
TLSH
T1C185AF2037DA8536F6B211726E7C966B503DBD620F3281CF62D84A5E6970DC21E37B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4948	elevation_service.exe
5756	elevation_service.exe
5668	maintenanceservice.exe
3320	OSE.EXE
4372	PerceptionSimulationService.exe
1004	perfhost.exe
3752	ReFsDedupSvc.exe
3540	SensorDataService.exe
5440	ssh-agent.exe
5448	AgentService.exe
1456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e6318435238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f8d1ba5db2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000272d5ca7db2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059946fe7db2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4042ae7db2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feb6e6a4db2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000712399a5db2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058466ae7db2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6004	2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	4948	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5448	AgentService.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: 33	1456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1456	SearchIndexer.exe
Token: SeDebugPrivilege	4948	elevation_service.exe
Token: SeDebugPrivilege	5756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 6116	1456	SearchIndexer.exe	100
PID 1456 wrote to memory of 5632	1456	SearchIndexer.exe	101
PID 1456 wrote to memory of 4972	1456	SearchIndexer.exe	102
PID 1456 wrote to memory of 5180	1456	SearchIndexer.exe	103
PID 1456 wrote to memory of 3488	1456	SearchIndexer.exe	107
PID 1456 wrote to memory of 4468	1456	SearchIndexer.exe	108
PID 1456 wrote to memory of 1452	1456	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_892d0fe9e21db2bcb706609bca13bab1_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5440

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2688 2692 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2688 2692 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f8d4d930fe1edd37e121c27199dbd419b214f9d112bfa8f4ef070358a2be1d62
MD5 dccdb5bb211a5eff868e96dd854db593
SHA1 4b6ce8157acded87335a1c3108b3e4d54beace20
SHA512 08946b5d3bc178e37b736d341942f7c31899cd79b9bc832f8570be1f17fb8f8967cfe558d9b049e9860f952ad33a79110a71efa2e89b24d6f0a5df6728e4c853
SSDEEP 49152:jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnvySOiR9Lqfh3uN:B3q6sjBYFmfVuN
TLSH
T1E6D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 34af536389f758c292ab0803b7c0006e7383da4ca512dbee729d0a9e88550cd2
MD5 92e973656b377e36bc1ecc5032120979
SHA1 5b707bb73a3ec52c8ccd72628835d063951baaa0
SHA512 f4db6fa235bc83da1d50e6383e5e375b062ff8de85087199e27ecb656c4db4c0791dc98c6e263a2c7edfcd38a0d14bab8851a1935d1bd8fa5b48c75168f95db0
SSDEEP 24576:xXYfDtczAWySo+7MjpiRqHmLqfGowKuN:UtcBySOiR9Lqfh3uN
TLSH
T18805012977A448F9ED67823CC9A2C511E633BC9507A0E79B03E499790F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d0a7c97aed2090204dbec10a0c4609cb5b7841869c807fd1be5aafda1895f67f
MD5 13654d4d3e8dbae379316d588314ed63
SHA1 c1b60e7451d5df3276939f6020ddc4bbd1ecf576
SHA512 d5eaec09bc4c589a531dc83ac5799a18007b79245f9f005078dd6da2b6cdce77d9c2666bab66ddd94c11e386a026989030d37d1fa6d69b2188acde067541b08e
SSDEEP 24576:n0Le5ji0hmxxrMXySo+7MjpiRqHmLqfGowKuN:nPji0AjsySOiR9Lqfh3uN
TLSH
T1B035AF16F6748771D073C0B9C5D2A69EED3130861B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 19e59c7c5f16ddc25e82591e75f40cae92c917c4cb8e9d158c3190fce5ddf51f
MD5 d943e2a08cebd9f9691c134d3d97a32e
SHA1 a3da5aa0db4dee7a6f73ecec7a22de1e669ae839
SHA512 b7749e2ed04c0eb32420fdf1b3e02ada7d743e43d39ffb33e70938b939baa18433357a8708d92fff8b124d9c22105e6e427fcf5701a0383ee6f3f257fa9f816b
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuxySo+7MjpiRqHmLqfGowKuN:+/ezSC6vUzPveHjyoySOiR9Lqfh3uN
TLSH
T1B6755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 908054bb1619c82c87275fb49cd4208bcf3fe5fca16960a0439b6453bb918eb9
MD5 ca5afd85013446e9b7258460aff6dc1c
SHA1 2625e1bed19ccd24155fe6ab4a08d2ce66687abe
SHA512 5427274653955d560a2c327ba488593e2303443401d4960b1cd5a9a5c9fce55942bac204ec2a836a0b750ed61011224813132cc6afa69c8e4ab8809554aa2763
SSDEEP 24576:PVbqPb88hv/l+YqySo+7MjpiRqHmLqfGowKuN:PVO88hXl+pySOiR9Lqfh3uN
TLSH
T191559E66F574C331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 584821ec00026ef9e5d98ab46b528c4d368c238f1ccc9a91b6e9f1d72cbab684
MD5 665f2ff977a0d18dc9e055e5c4173566
SHA1 7735162b0caff66ae7ca27ddb3b2dc551a2a62ba
SHA512 350e8f9b334669890c81476d165998501faaa4b8917d5f941256b806f6020399487121e5cb37b146bb5eef4d574a9376086278e0d686fd982eeee12ab2dc0d16
SSDEEP 12288:lLSm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:lLrySo+7MjpiRqHmLqfGowKuN
TLSH
T11BC42316072CCCC5DB7B2F3053D3C911962AFCD82E81E72B4DB979BD84B4862E669907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7d8870df63ad9ac0a57ff79e73a747b8bf8c344cbded09ce08202db879f09652
MD5 dfbf2fa3a53f64e3b1b34709a3e0a831
SHA1 2f1b00461f0cfa567e9747c5da2f7b159d4465f4
SHA512 ae6d822b5dec9366e7906dd265eddb00db9e4bbedb8e5329e45915f0dfc4676d851887ba948e388803c629ead05751cc5bdecd4d894c19e2abc57c6c3581bbce
SSDEEP 12288:peBNUbTVO86UZm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:pJIUyySo+7MjpiRqHmLqfGowKuN
TLSH
T1EB05CF3BAE28ECD2C27A9DB85791C600E77278704F52A3CBD175820EDE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4503d8396d86a489fa65fee03df1a2a37084a40bcbdfd904952219e52e9a71fa
MD5 c7d0f39bc220587a840e10ea580761d5
SHA1 ef73464fe671ca6cb4f01c7f26a9f17e4ed09610
SHA512 0d2a0cb8c6b210b8be5fa919c4a62e67c3fc0e2ab45b1126184b6d8c12f66f94872c15e040304823b5e87b4b0d918fb601b1e61623af5bcde10aa35d198d91eb
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:VQvGAdlCEL8c/DRNw5CFFmfVuN
TLSH
T115266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f9d56a93916e5fd260bbaed2a4a3660551fdff79581d7a3400261c6b66a2f3f1
MD5 e6dc89c257b039b48c26012005a87f79
SHA1 4d094ce9057b7fa6e165118ea961e6b6b8138336
SHA512 32d8bbdb3c753fc3ebda3435d9f5bab4aa3a302c8bd9aea768f4977cbee1e7ad733ccdd7ebe4a6cca36d92c8200d4915e7d923d96a77f532dd19ee48a7179f74
SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAjHm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwl:10ewsAjcySo+7MjpiRqHmLqfGowKuN
TLSH
T1F615E031FA74D436C7BB0DB21B26C716543DB9600F912AC3E3A89E9E59702D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 243613f6eabcc8411dba49d2baa5036978c363c1afd4e5b47f967c5c27d693c9
MD5 741074e2bf2f8272450b73d67dc2c8aa
SHA1 e98394badf000a5502b27024311f559c3b103200
SHA512 bb3bd37170ea42d4a485546522812b720b385bfd815619daac64607dabed0fb520ae73a5b33debedf1c84a854287d5003a4d9015abfdca8e72b77f170274dc16
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHk:wUEtQevvqc2W1cpV2tI32
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 014bccebdb4471dae628ccb2b5b432475537b3b81c271b44670b8628c5442672
MD5 8c5fb6d794d027c7d81cc0bd55a6d878
SHA1 3cf82dfdba8ed97108f8b779b4d233d0769ef988
SHA512 06b9998a215eb30902a647349d84f9759e000a57975d13fa76135c93bc3c79fd95d3a2d051584f092c07227c66aa7b83867d2f616fde8b495f2e6fbfc421652d
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/z8ySOiR9Lqfh3uN:AoqtVjnmZFmfVuN
TLSH
T1E2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 349d18cb2c9735491ed6af62234e776a25ff0ae34f854043ff6df1970f399169
MD5 88bc7a96837427a23c4e9d54731f53ad
SHA1 a55020f3373bd221ea675fbc4a5ed10f117eb61b
SHA512 f7bf7c7d0e1321f23916b45dc89f5f1a0e27042b48e399b74d594283a080e8ed6b0d7fc351f35034f366a2025f8408e777e203829888b66a41b0d5abc99bf165
SSDEEP 24576:zAhGL3IFoiwtA5l7S539ySo+7MjpiRqHmLqfGowKuN:zAMUFoiq5NySOiR9Lqfh3uN
TLSH
T145359D81E7F945D4F5B3AA7899B68571EA76BCAA1E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5d7d8509b3a4c70886ecd9ecf9b9d0612ea12134af8622be0d0472ca51cd40cf
MD5 bcad00006ea2b11e860eec82ae26e121
SHA1 68ec00dfd2d63dc4a0aaf29881207e636395f0d8
SHA512 26cc9a531cb28727e7caf17883476d3cfaf2617822e67563a7e8bb7280a60f2cc858fb4a4bfd16f259b483d6fad3ce876b523b382186470c75238686ee81a945
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+Ckm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:twu4OWIySo+7MjpiRqHmLqfGowKuN
TLSH
T1A805F14637A84CF9E9679638C693C532F7B2BC052A21D71F0760C66B5F37261AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9ffcf22f1756ce2c7af1d76d65f360254057f66ec76a568de7ae59fd346b67e0
MD5 d91d34210fc03ab7d0db969883af00a3
SHA1 31ec6d8b69bede96bcea54b1939b835d554d99d3
SHA512 e3cc2c8d028637ff93c5e20442feb7b17d39e7f87c5c8eaf854fab75613535fae4e8c7a7e29f3cdddca138b2515359bd604dab170e6ad846a6f4f24bf9a38167
SSDEEP 12288:XeZ1IyXm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:uZufySo+7MjpiRqHmLqfGowKuN
TLSH
T13DE4225A23A894F9D2B75738C9E28601D332BC96277183CF096456BE0F72DD25E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c052f95ea5af2deb3be35b9d7a9095403d5f0ad4f6838ddf0741bab7df2b05b9
MD5 9a33026fea19ca6df793197a15c400cc
SHA1 bac741ec36ffbf897ff82d53046f695c105cd0ce
SHA512 58c2b69a1633be0a39888958268c06087c35197681c05429b526a0903fa389ea69be73d2d40b3e8160530a97d463f3647c884e55b5e737137c50ff26199ba236
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U0:UQRQyi36YOcPbLvw2gAf+PN3UFmfVuN
TLSH
T1D7666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7faadacfcea5a9235ab9d8470afe97abfb1dbf530d70e26c670d98a436e9fe7f
MD5 69636d401e12729abbe42b5663996580
SHA1 3e718461a178cfc8ba66504d8ac75d1b6f1053f3
SHA512 0c02bc1e73957eb900ca516a83e90b5f6da3c7df0e70b3fdad9f962eb2546dab8ba3b9ac85b16f388a141392cca6f15c5a0306436edcc5c70a0b6deb24546636
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U0:HQRQyi36YOcPbLvw2gAf+PN3UFmfVuN
TLSH
T1E6666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52d378f72589f144051ae8247e8a93e98cddc3917c859c679367a33fb8aa7f61
MD5 7cb8819f5cf9a847fc0abfb3bead46fa
SHA1 16d47e9f27eb84a82b296136f034cc93feba11d6
SHA512 3770b0b5e9c7fa364c1ac624d859d79ad427561258740a086aa0787b9d2f12c915c62289111a0599ff1892a61c17b2f509b4a363bece5a863afcba21e96bb3c7
SSDEEP 49152:F68Qg55nhceWu7PNU3/sySOiR9Lqfh3uN:TthLRc/aFmfVuN
TLSH
T110B55933B2F600A9C44DE1769F46873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4ee584ed5b2aa8ea7813a24ab4d4a351d8a0d46425c7bb436659d36e818ad66
MD5 446f69812353763ac7977c98bab29ea3
SHA1 229b38e1d1c517636bcc7de294b6a9becc9f4c96
SHA512 45150b1089ea957d6be45b76a38f739eda69815e41f104d72caac096b1f5c74351cd56a86eaa401a9c6cce77bb2324a14cf64ace91579b4d6e1f32278f13c746
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:0y5112gYy5azzVvt69nLKnhZfFmfVuN
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f240c089e99e6789e5577e6f5713203dbe5cdfceb84dec534b2f9a8cf88c04a
MD5 bc06dcb01303f1fbe74cf445174280b4
SHA1 ea6d927e8686884893d44e92d42e9bcd44a67208
SHA512 38b633756a16608da8b3f90efe62135f22bcc7adf0eb5e1a302c8822cebc0482f6cfe7b28c9ed4a69d0d65431b2f78af9c2abc64eb70e25b1ea4a49a6c5e626f
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnySOiR9Lqfh3uN:/u6Jmdxd2djFmfVuN
TLSH
T160D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9754892a15909ea9e7e7c0af287c81fcf0310ca021697c5d5f96a0d4dd217dad
MD5 dff0e50e30da08b17e2dc442463629d4
SHA1 58b0bb6c0d36be2db968f3407f448fb203848c4b
SHA512 7756fb9e4f9d7004383a6ec36f8bb19ba74ee1109f51921d6597322198c6255a100f121e8c9c91b85c24fa158f5069754ef88d22282073e78141b2b72e5bf7c3
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4xSySOiR9Lqfh3uN:1mifPWRZFmfVuN
TLSH
T143B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 805f500dc90f52602e57299e38f054489a0c3d3070368fe0e733ef6c0f2bc357
MD5 40ac434ceec73a628bb3a43ad0c09995
SHA1 0c8c31d9c5c272e20462235e6c047dec609ef00c
SHA512 ea8544d6bece3fea8810ebaeba0e8cb83f3c4237fe9a4e74eaf85096df2e0d18e963b247105cd8a3102e43558689816daad0eb22d1d0629771d7ce5f46d4c9b6
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqfySOiR9Lqfh3uN:E5dKii617FmfVuN
TLSH
T1EDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 009f838705db39b348632bad86e733ef11fca038fdfb2eb1bd443736462b488f
MD5 dcd5355b6c72230e9dfd5075490b2495
SHA1 b19ddf37d907f517879750e026c61b9a27b4e731
SHA512 93c1fec1339588437d199ec986d226861657d7d74ef9a353e1ca1a29cc46934d16cb18521e17def2b645a971464b6e8081ca7b32457000a60612fec8ceb8ba9f
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wWySOiR9Lqfh3uN:2X2imph9FmfVuN
TLSH
T18C95BE13F2D900E8D05ED178C7468632EA62BC160B35B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ee93f9cfc6cb5afce8bfe0eb99dc6d619a3f06cf3e61d6d4c097683ae8bd9602
MD5 37424718ef968c5890a2ee7839ab9e18
SHA1 4cd8877962ce0535f8a646f7dfb35a75236d3dbf
SHA512 054bbdcd429c9907624bcaa07534f5d8b404bc13a1b6fd4a4d46f8b96a97c0348075d4799ec1232f57cdf59cc70e6c75911e5286463c4232e495f186b6b32e01
SSDEEP 12288:w6m4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:wTySo+7MjpiRqHmLqfGowKuN
TLSH
T1E7C42316162DCDCAD62B2F308393C610D629FCCE3F82A32B5DAD757D85B4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e767437a2629149c4db0c767931842ff179b9710e3cdfb63acd4c9fb18c5f166
MD5 db23b7e0936fe60b56505ff0de3b0bab
SHA1 3f1472cd2225886618a0258b4ad65710207d6f09
SHA512 4fdfe590f29231bf0f4f97c392f827d025e3d280ea038c801f6dd8498a48cb142a985c1b391b71b1207f02190b2557c51e8d12d6d9d90c0495e7bceaf8a10cd6
SSDEEP 12288:ybm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:ygySo+7MjpiRqHmLqfGowKuN
TLSH
T1DEC42326162DCDCAD62B2F308393C510D629FCCE3F82A32B1DAD757D85B4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 cb9efa937178d5f7ea01f7ed0e5c00536ec09afd6ff3935d176cb03fd3834d70
MD5 eb61e7dce10098a1a4bcd1538a432a46
SHA1 c9eae961451486f55d06c2f92727fa5fa5f99f99
SHA512 eda645e2e4b424ab4ab5585701cfa03bd642d6c9a3bf5d462715e5d4ae18cc9cc19259a9a8ca23e48c7cc9e064af3381c9fa9367956bb1fc64b4a5f983adaa29
SSDEEP 12288:chm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:c6ySo+7MjpiRqHmLqfGowKuN
TLSH
T146C42316162DCDCAD62B2F308393C650D629FCCE3F82A32F5DAD757D84A4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9093fb39a7d42356205e6e4f141fc39981454ce798aff270f47cfb4acc00293f
MD5 1443d77c3617e8560b1c2f02a7200cd4
SHA1 4744f5763b2d9efa1e3fd96304d565f22acfaf07
SHA512 81d43ccda99e561e19983cbf8268831db00c21375ecc0da3af436b9fb9e4286cc4c57619f8678a59538a758e98fd97c9d8277646ca5f56fcdbe23f1c114ee3ed
SSDEEP 12288:/Vwm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:LySo+7MjpiRqHmLqfGowKuN
TLSH
T192D42316172DC8C6D977AB34C2A3C510D33AFCD93F52A36F4E54296E4DB0AA16A38F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 da7c6d656c6892a798b5f195abd3c70068a2367ef3f3b26051f091032656260e
MD5 b58a278c4baf3b786c7eea5b6b9da8dd
SHA1 f50c820286212b0dfcff742f02efc85588d256c2
SHA512 3357cbef31782b4e98c09ec6ce17d5ff422bce706c887c0e3fdc0a6b8ce72c51c4734ae791ed591bf0eb629d39d4d17bbbc30573f51a9cfae3a31bf8943d2f81
SSDEEP 12288:gom4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:g1ySo+7MjpiRqHmLqfGowKuN
TLSH
T1B6C42316162DCDCAD62B2F308393C650D629FCCE3F82A32F5DAD757D85A4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fd1b90f4ce9269d6592aa2f0aa8ff1aa182b93418f58ca21aaf7616552d30988
MD5 7f72d6f5e5677ae04039741d2cbf0d62
SHA1 030b1d81e594f4ff5dbd8eb7acf5e44d4e4ecb85
SHA512 2e780f8e48e6a4f57155d47b36027edf2a79bdfd71a4b30e94125797ade568b842a141f74d300d1c13ad47b7006f5b5d89ff5447c68bed0fdbe2d400ac5c96ec
SSDEEP 12288:6vm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:6EySo+7MjpiRqHmLqfGowKuN
TLSH
T1D5C42316162DCDCAD62B2F308393C550D629FCCE3F82A32B1DAD757E85B4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a7d25e3fc5b45c75e5bd1a53f47ddfbe78c8519803abe8e594c7ac47e29f567f
MD5 8d35f1febb6067c2edb4181c71636557
SHA1 33bed8339a258fb106c34feecdc2cdffe1a56a4d
SHA512 07803be45f02733e874cc59fa8968b8980aedd14edbf8fb07b0284cd6c900d5a349f1aee0acfee8a02d662147bf41dd7eec34e25182b9cd9e2f97e09a689c35f
SSDEEP 12288:PTm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:PYySo+7MjpiRqHmLqfGowKuN
TLSH
T181C42326162DCDCAD62B2F308393C520D629FCCE3F81A32F5DAD757D85B4862662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8b7de8387a8256ac4c662ae260f13eec6d95cdec06e760bdd7edbc7b811f5560
MD5 27bca321b6e2d00d4e5af2de3620cd3b
SHA1 d249e2d7404186e8d3a6f50ff63aa1c18fd1b875
SHA512 acebeaa85d033005c40050b285e497a1e29371fc81611dd44c68f850d0081f9f331a6611c123a4597fbc67836b52ab6a28266020171cda46fc08ccf745fb9416
SSDEEP 24576:RZMRzFVSOAySo+7MjpiRqHmLqfGowKuN:RZMRzf0ySOiR9Lqfh3uN
TLSH
T19805019573604CF8EC67823EC9528905D2B2BC5A0BA0C61F07B8366A5F733A11D3EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6958ca0f053afb7c90abd1995fe47d1bd6625c8dd6b19fd530180cbdfa800c5f
MD5 01e9b7e9b99274aace07523d373dd1dd
SHA1 bfba7e76200da28ccc1334690f632284cf296aa1
SHA512 89b6f9066d4aef9af8ccee529bfbf71376a48847198163f67bdc39961e81f9fffc97ffd89332d573eb21d7a648799c54c198f7d5f1777e90edca61f84259848b
SSDEEP 12288:WGm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:WPySo+7MjpiRqHmLqfGowKuN
TLSH
T1B4C42316162DCDCAD62B2F308393C610D629FCCE3F82A32B5DAD757D85B4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 288892322424233533dbbdba3c6db13eea962e8df40b4b2b0c909090b863d86b
MD5 7c83d7841418db70d0dc7f515b2f6af0
SHA1 a9e242e2faee18aa415e84536216bde3ef5b206f
SHA512 258911ebbb1be14a109bab0ff62e10eff109faf108fe1e25c4dc2cba5db95abe98bb94673daf803bc898ae42399c776c0a125d61cf97cd4b702f3b855d203951
SSDEEP 12288:1im4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:1bySo+7MjpiRqHmLqfGowKuN
TLSH
T11EC42326162DCDCAD62B2F308393C510D629FCCE3F82A32B5DAD757D85B4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 85aebe201f56a5538c16b9bc3588bf286b994878253b19f44b4420803589c718
MD5 4dc9d0ea6f32b2388ac2ad2a16fb6a31
SHA1 51311d16bbc9eef34a585d9eda4022e1a0d9afd1
SHA512 ff6a94fa1abd5aa3293146908f37957e9842f041c4847eeab2190e080fc912af655c441d81e87166e7f8acffcada57955b206b7f00d5d4a0cd8624d992928017
SSDEEP 12288:oyPz5L8Xm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:pzyMySo+7MjpiRqHmLqfGowKuN
TLSH
T143F41217336560F9D1379238C9A24A01F336BC761B609BAF17A4177A1E376E19E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e17ee265ac81190f071f626cca1bedf56e62d892202849f90c6380238f9c1f84
MD5 d88286ebc46f81ea295f8f3ad42d908c
SHA1 775592b27874be6bcbc1eb307e751a50e7e9cfa5
SHA512 36f7936011f9f88928b7126cd5199f5f83b9147de9e9abed5cd4f5c6766cf11593ae5a1d479b5b4dbe6633717be121deb717c9683772c2be0ff5fd1db8fb9480
SSDEEP 12288:wGm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:wPySo+7MjpiRqHmLqfGowKuN
TLSH
T14CC42316162DCCCAD62B2F308393C650D629FCCE3F82A32B5DAD757D85B4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5fee3a44a92371ff149a61ae7193a6fd60410ccd5ec549aedc2bcb56261d6d4c
MD5 44c22a13711fa3bcea17b9a2d68da584
SHA1 e58e44835b8bb6bb84def1a1649908f30ec70938
SHA512 09b488ecd50658e18489f3957544bb53b46b73090dc586107bcb995aebdea3531cb7c645aa22624d54acd64efb6ad55d625c53240426d14f94e2a7798c501131
SSDEEP 12288:2Gm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:2PySo+7MjpiRqHmLqfGowKuN
TLSH
T1E4C42316162DCDCAD62B2F308393C650D629FCCE3F82A36B5DAD757D84B4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7e50957d314e5c5b14d61a077a79ea2e8312eba4a04f0ec5d94b5eb0e9be00d7
MD5 2eab34660ecb707112c42e949083bc23
SHA1 84ac7739b452588d7c0cada69881d36c981dcdd7
SHA512 e7ded59e5323398a5fa2e9be430df7f5598c5c384d0075e047a87fe53e339718822b273b9921549a472d9b3c7ed2b3fd05081c829020dfa00df963e2d930e21e
SSDEEP 12288:pyPz5L8Xm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:IzyMySo+7MjpiRqHmLqfGowKuN
TLSH
T1EFF41217336560F9D1379238C9A24A01F336BC761B609BAF17A4177A1E276E19E3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5867169c6d85b82e88e0d50a0e01682219a22ee588d5b00b354272b5ac435d06
MD5 cc660cdf489e0abbea69f026ba01fab7
SHA1 79a332fa2373a914e224f235c44957df7f8ba7ab
SHA512 8431a40fe852724a6bd727f405b99eed5199b4f97862ae0e2b20d16185e37a8237387543f28d64e91c59be407b5384ae1fd94999deb352145e5890eb608965b8
SSDEEP 24576:GTDaLl3z0zDKySo+7MjpiRqHmLqfGowKuN:GTuLljxySOiR9Lqfh3uN
TLSH
T1110501A573604CF8DC67863EC9528916D2B2BC5A0B60C71F07A8366A5F333A11D3EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 11b2439be64dfa7e69eb12d18e8fbe5ab4c4cb0345b987ff8f12efecce0626e5
MD5 65596a0919097fe9eca99fcdb90f3db7
SHA1 010f11344bcbd1d3a8b0a524d80cd941d3bcca43
SHA512 f4820a1d87be436642839aacffe3d0d85485cb3e515765d570691d84b2ce1c732ead3927bf14b0ef90575a29c09ee8e57fe1b91557c782ec80a2f5e5274ab047
SSDEEP 24576:s3vd9CHKy7GZeySo+7MjpiRqHmLqfGowKuN:Wvd9CHKya0ySOiR9Lqfh3uN
TLSH
T1AD25CF90F3E414E8F0B79A35C9728511DA767C991B71DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2dee5117af4932ff4ad7101dac0a04927441601241bcd035c66bb1181928216e
MD5 26f555032761ee583fb5e3779679ca4d
SHA1 82561728442d82ce3e9a0a7389d935c21e0a7574
SHA512 d466eed0fc3141cc28e7f31e7146bfd9701215235d0ddd1ab08226363bba800b74955bfaf9153c1d1c605271d714d7bf8e8ac034bfdfcaeb90108ef5f7c0df4c
SSDEEP 12288:cBm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:caySo+7MjpiRqHmLqfGowKuN
TLSH
T166C42316162DCDCAD62B2F308393C650D629FCCE3F81A32F5DAD757D85A4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 9fcfc9ce31573a9d2a263d00ddc8db9f038417607d338b1b473e5249f682461a
MD5 3c82cc74d3ef92644e607dc78d7cfd29
SHA1 04ed17fe36e9aa03ee1b17c1f32a334222f0844a
SHA512 6b097f5887bcacc4634b13eb5a7a9afd35d770634f9e0ac7dc54fea33454e7de3709431e79c04dc983f82b973141f98b83cef66af7e78f034059942962163988
SSDEEP 12288:X3m4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:XsySo+7MjpiRqHmLqfGowKuN
TLSH
T14FC42326162DCDCAD62B2F3043D3C610D629FCCD3F82A32B5DAD747E85B4C626629D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a9254f11c7d348d4dd6dd875eecb00e5ec2d5719826c4be13e27c5f1cb785f5c
MD5 831f1cd6f711bbac9617b374f54d324a
SHA1 477720bf2b3a166cc8c30adce05168bc63ed7ee5
SHA512 79321726f5cf50dbb616b87e57c8bbc7a24de6d99e20897ab810d5c46bc3ccb79c25f022f30f01a6f764c027e357a8ce3a78419585d5217527f407a688050149
SSDEEP 12288:Fcm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:FJySo+7MjpiRqHmLqfGowKuN
TLSH
T1A3C42316162DCDCAD62B2F308393C650D629FCCE3F82A32F5DAD757D85A4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4e197fe2685c1a8a1ccaf8b095adf93f6eae82dd0d64e8135447c83d55243efe
MD5 be0cf13eb4b63acf7eeee94c51335c3c
SHA1 0cb94329d8d72ef17cf9bc57e4e5a887385c21a1
SHA512 ed95fe9d4e6bc639232cb024c1da1884eef8884d16cb87acdd6870185af7b208626b4af6fdf35c8c353082e265d89066f5ddfeef040a2e7c558d9ae5fa63ff57
SSDEEP 12288:pGm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:pPySo+7MjpiRqHmLqfGowKuN
TLSH
T1A7C42316162DCDCAD62B2F308393C610D629FCCE3F82A36B5DAD757D85A4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 59ad8897d3a26a406a08202573e4096be9f4b6de4dc9f4500a99f04ae217ef0b
MD5 df8a6fb47a23c79e8f506b453a0ec5da
SHA1 c7ec695e070a7e92fe05e37bcf06a2c8aade86f4
SHA512 60e027d787ea52a5ce8c7f6fd130b95ad92d60fdf133d6bb98131734b0a1b422cd6bc8bbf1322687b94e79daab3a6827cdf77a90832f7672d0aa02990d60f2d5
SSDEEP 12288:9Bm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:9aySo+7MjpiRqHmLqfGowKuN
TLSH
T199C42316162DCDCAD62B2F308393C650D629FCCE3F82A32F5DAD757D85A4C62262DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 356285c12313e1d98b0f80b39ed57c9271e34a5e0ba61c20b3ddfcb61af7ffe9
MD5 865cd0717dc91bbb6008b4b51f1de37c
SHA1 a5ec63724b7ad3f389990f2b71944161b6c1a4ee
SHA512 effe62b28d20382095e501168b8dac95524880394405d63e2c27606072a652228a6c43ff9f10158e9b2da35eb4284f642440913b698a1fd7daf30ab89036d44f
SSDEEP 12288:Gem4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:GnySo+7MjpiRqHmLqfGowKuN
TLSH
T194C423161A2DCDCAD62B2F3083D3C610D62DFCCD3F82A32B5DAD757D85A4862662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ad8a208bdaeef1b46f502483c0a51abb9edc42b63893a3f56f20c462fdb5b269
MD5 8fc491f4d4aa6152c2a01cee2417854f
SHA1 792c256747bfe5d390d5b91d150350287f37c1be
SHA512 96bb54a5538862aab5fec76aaaa794b2a6ca90879d3f6f245b2390b5af2cf9bb3b124285db1d17274e10ad4acea65f6f52e670302600cab4aa6e4606c999edd6
SSDEEP 12288:lom4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:l1ySo+7MjpiRqHmLqfGowKuN
TLSH
T1BFC42316162DCDCAD62B2F308393C650D629FCCE3F82A32F5DAD757D84A4C62662DD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5a23593893cce56a774220fa3d7fe24f21909c8ff99fd2d0052ed27343d9a649
MD5 4a840ccd4313fe3b00c9f8375ad88bea
SHA1 c8279378a15b89921223b523ba23cb8c44827140
SHA512 38d7daecb0fcb8357462021b146ec67d22bc4f84526041a0c729f315c9b20d10ecce56379ad0a7f7c5507dbf2197e1bff3842bce255844905adbf82bf38f738e
SSDEEP 24576:bfwvUk9RX6wkyAILySo+7MjpiRqHmLqfGowKuN:xMnYILySOiR9Lqfh3uN
TLSH
T1B835D029EBDC48E5E177923C89B3860AF6B178591B31C2CF029A53AD0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3f646c6c929da94464596fa825b27dfdf48bc2ce2a7f898b94e6953b42103504
MD5 288755a9674d90aea71ff3f2c643ff1e
SHA1 07c810b5cafff6c27302a989aa217827d23fd81d
SHA512 f8396bc01bf1bb8d44bfcdcf25d0f1b0db1b72eab12a816c73eda08ee10965962873958d3571fa2b40c0f8c9993436686a24113c9790168665f7a0d3416abe0a
SSDEEP 49152:sYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02ySOiR9Lqfh3m:LySzP0FmfVuN
TLSH
T1B2067C96A16841D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dec51b7c19fbb8ff8d81f85d741adb2ef625ba50019ff52a10fb3a8da19af301
MD5 d3111a0fb80f15e87441816a87014c78
SHA1 d41e55c2b8edeb7063ce9882f58a7fbbe6c1a07a
SHA512 7f23e2a6f40bc99a99d426d36265a5644a55b2d7a8ace64bfdec77754494e118ad96f5d4b7fb0aca1b5745706ef812de1b6a1651b96b8cb31acd6f9256fb16c4
SSDEEP 24576:T47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYwySo+7MjpiRqHmLqfGowKuN:T47JUQjTirIhCnDHUPfF/mySOiR9LqfE
TLSH
T1EF65AE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a58b59a50aecc6bf6386ee16213993971bf5caeaf1027231e2e569cda5b0ac2d
MD5 fa927b0a0a368533a2d6c700cc71307e
SHA1 252e059dc685ba62773ad784f4accca1656b12a3
SHA512 8260ffe257296a01cfd2218cca180f1d7ed4f38656481943ace6e1553a114fc68ee52387b6cc98dc7e2be305506e84517fe4d70eac4c36e541025fc5421fd407
SSDEEP 12288:5bsf2m4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:UfySo+7MjpiRqHmLqfGowKuN
TLSH
T135E4F11AD25842D8C06E6235C7928A40F337BC6957E1D3CB56D0F57E0F75A909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a7ae8114266060d158b6eef5465e54c1cac00b2737cbf2dc73d68e35d9ce4f03
MD5 e11ead0fa0faa6d0d3fe7d47e8bda7e0
SHA1 83233f402b636435a734b528bcb2d6122af07753
SHA512 4f3c67793d08a8dbcce1377b0a6839b3cefde92a92cd8d21aad7221cc0a3e63e8d12d5d34bac0a53a295ce163061400e5da595baccc9f9da3337a069bd1ee6b7
SSDEEP 12288:1+j/fMy5YJXWePLIyZ/PJ+A8vFZBxWzxSmcaRMb5YB:oTMlGekjvDB4NzcaRMSB
TLSH
T144452850762AD75FC6A940325E32D2CCAB707D05EE056F0373C88B3FD576668BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2bf4e704416a6a5ff9bcc6b248da2d32506fcb7fe90ac5eb3bd10bc1da38c967
MD5 faec6af40f1b1ba997113b04820a32f8
SHA1 0e320adbfdd906619d7903183594a958213cf7ee
SHA512 373414129d93dacd2066d289520f7238e6394042af5cf8255667815703b4bdf6405bbd1903f30699f94e31875e5a012c0009fb2229b4a0158d1ed9a05c53ea41
SSDEEP 24576:lFYMqNSJvPDql8bnscAznGNIBEoanmYBUs:/nmwX
TLSH
T12165F981A537E38FD1F7607207296B8CB764EC16B7055F26B3C8053AD82A725B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5182be5734efeff6081c4eb430233feb137e1ed370194c1097bde4dc86b09346
MD5 553f9e04d4f1647ee2f364f97dadec6f
SHA1 fcb61bd99749fac5711463990a633ada4b8610fb
SHA512 e9c9a2ae838fe7d21f38b18232188bce38d01a217393687a9bc99ae0601a2fe0bbf9e78685695ed8fdf1431f8823630383bfc0b2e8a87c6da980d953cac1527e
SSDEEP 12288:dM7Om4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:W3ySo+7MjpiRqHmLqfGowKuN
TLSH
T150D42322472DCDC6E97B2F304293C520A62EFC982F80D2DBAC5975AD54B4CD16E79E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 918324924d6e671c2bc3a2aec8872cb7dd61ea7dea8ce86d8e89ddbc14223f79
MD5 49434ae9238e361170f3fe0224e46f5a
SHA1 1e688b5081c3cce99b3172c0c91ca208001d828d
SHA512 8fbbb604d0663b64b2738074243e893d43134d810f4948bb2977f88fb0c2792dafa0bbb32e741bddae6697dfa1c4023c4a7066f2e18f542d0d84077f5ff33fff
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYxySo+7MjpiRqHmLqfGowKuN:mgb4mBIBhGFwySOiR9Lqfh3uN
TLSH
T1D365AE1E22EC02F5E0FAE2B88DA64417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 490a9b05956539be0ee6506c85bb056a28d5af46cb826fcb0aecc1d0ffd71403
MD5 c7ba5fc538e3207d141ae8d47a55a829
SHA1 eea8ace526557c757022fd1d868bd0c8f8261964
SHA512 8ac1a5775d6c403047d2604efe51bae5de38e3e62fdeff0cad99141c30518299c5951cd02dba10f7bd8aeb6bde74098ddb92d1e3668825e5251bb4efb221ac80
SSDEEP 24576:mG88u8FpJqH1bzria7/mAySo+7MjpiRqHmLqfGowKuN:t7ZFPqVea7/pySOiR9Lqfh3uN
TLSH
T1B435F16577E501F0D47BD1388A828663F672B8251360EBDF0AAC8B551F23AE54B3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c59474d897f762eac9193508dc25d054729bec4e5bebf15ad15af378c57c4bca
MD5 36990faa57a9d4998e66993282e3cef5
SHA1 c6a5ddaf331f1b4a223c47f8f32061052e203d10
SHA512 9560488e804a4907560788b5d8950c10b4da736e6bff981a1caaacbf87cbf7acda61b1ef4cfcd52584181fa45cad241a3bb57ba27cdc66ecc625c18985ba52c3
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEySOiR9Lqfh3uN:1G05lO43b3FmfVuN
TLSH
T138D5C06E62EC01F9D1BBD17CDAC6860BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 58b343076091a467156aef917b4aad60c9d6112ba58eaa1ef41fb0aa93ff6854
MD5 e25a700bb11b8d303022b59f5d0c88da
SHA1 bea76536b4fa68152b65209881cd00b467e685f2
SHA512 e7327f4257a1a497e5cf5a2a155e430be66e5c6d1f9f2433427826ed5b251f1d1a60195f1bdf373c602bda3f99aed8cf6b8302c14b42c3a231d5e014ec1effb2
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2ySo+7MjpiRqHmLqfGowKuN:9a5POZ3BJt2pasx2+msySOiR9Lqfh3uN
TLSH
T19565AF5EA6FC01D5D5B9D17DC583861AE5B1342613329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b80378c29e52d6b7efad9b52888eed331d045301e4d583102ae8934ffe0b0b1
MD5 dd7a0f5621d05996abaa16c09271a9f4
SHA1 27d8c17d5a3132e36d401329973d6ece29250dfd
SHA512 d7c8f274db375180a36ac422d2474a888cffd0a6196f469a2eebfe45f02012ea8b9f3184919065cbddf6c0d5a0b2bea2da9af1a4dbc93034cf46c40d523384da
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkoySo+7MjpiRqHmLqfGowKuN:ONc/zEOVHFJySOiR9Lqfh3uN
TLSH
T1A2858B2623E901E4E5BBE1BE89779546FA717869173086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 304b46d56e7a84e77b36f202e8a0f174b81ad7d166b09948095359ea31a1cb77
MD5 40c8911a85a5ac24ad6d50b7da368ad0
SHA1 1339ab38681f3355048dfbbb19ff2a1be56dfcde
SHA512 bc20b8f27d45f360a4eb081c8322bf27466f428178b296d9ddddce246116117e72cd3934714e76b8597f20f53e39b2f05af0ed3bcf1c9f01c1dccaa33e44daf0
SSDEEP 24576:YTkNvNnaFeYhJNtmZBmzySo+7MjpiRqHmLqfGowKuN:YTMwBtOmzySOiR9Lqfh3uN
TLSH
T1B955AF2EB6B846E4D1FEC674CE238512E6727861173293CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 bae4fd09eb242b7a0f213f6a6c66e85eec2a0975f5b8a9e5a8d6ea71f6cd85aa
MD5 48fe3040207803517ad4d3a27ca70f6a
SHA1 38198121f588a9044cc3f1e483a6fcfc5e202e67
SHA512 855d6dcdbd64befba7fc9e4afbdebb7fc8bfc930fca3952bfe92c112cdd673f88c72e4ea705e7932bb125522a561877f8791e8ec0b384077c427afe06caf5c43
SSDEEP 12288:8HvUrBFrEjwaQ/m4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:8PUr+NQ0ySo+7MjpiRqHmLqfGowKuN
TLSH
T14E05E12F22AC1CE5E676A17C85828719F771B8661712D2CF02E0817E4E67DE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f5b6e99db33a8a3bddcb4a7d665dbb17ac426e1b0cd35800434b5ef154b084b4
MD5 c7b94b3881074fec4961ff40d93dd079
SHA1 9ef52c9b6b158361457174d0be442d5e455215ea
SHA512 8b60f8911c12ce1bca9028ec381519dd4b55e347cb7c3e3cb64eb722a71454bdb88d916ba831826a23268493c5fb8e7885fb60dc4ff3b9d1a423f39733e427c3
SSDEEP 24576:mD3FHshBIYQgAzySo+7MjpiRqHmLqfGowKuN:mDVHeBIAAzySOiR9Lqfh3uN
TLSH
T1DE25E13EE65C04E4D57BD27CC6638A06E77138A9032266DB06D481BA5F6BEE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-314-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1004-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1004-83-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1004-88-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1456-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1456-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3320-298-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3320-66-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3320-59-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3320-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3540-111-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3540-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-319-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3540-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3540-105-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3540-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3752-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-333-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3752-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3752-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3752-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4372-313-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4372-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4372-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4372-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4948-19-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4948-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4948-26-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4948-25-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4948-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5440-119-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5440-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5440-317-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5440-125-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5448-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5448-137-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5448-131-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5448-139-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5448-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5668-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5668-55-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5668-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5668-44-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5668-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5756-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5756-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5756-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5756-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5756-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6004-0-0x0000000000400000-0x00000000005AE000-memory.dmp

Download

memory/6004-16-0x0000000000400000-0x00000000005AE000-memory.dmp

Download

memory/6004-7-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/6004-6-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/6004-1-0x0000000002450000-0x00000000024B7000-memory.dmp

Download