0818ef3d294871edc0f42444fa9710d0d8cfb3c4f26886f1996895522a57bb8e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Size 4.2MB
Sample260820-psk7tsxbpg
SHA256 0818ef3d294871edc0f42444fa9710d0d8cfb3c4f26886f1996895522a57bb8e
MD5 681690e7a0a3666bfecfa0101f60c600
SHA1 6d1f627e164fd48b48a503ca8374b9f6c2403c7d
SHA512 0ae4ddb915eee1220e3d8b44029688b400737b0c96a716153fad0f0950e6b3b36e942160708a1282b4d09236759de50c33cafd1590238e9a14692adac006fe8f
SSDEEP 49152:108OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJX69emEPGKOPkQThMYRMnm7LBS:108vdsGaQNgS1+6e6ngKpq1LjY
TLSH
T1CB16CF12BA828472F5930271996EAB7F48BDFA304B3595D7D3D41A5E1D301E23B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5264	elevation_service.exe
4996	elevation_service.exe
3384	maintenanceservice.exe
5328	OSE.EXE
4300	PerceptionSimulationService.exe
4720	perfhost.exe
3340	ReFsDedupSvc.exe
5560	SensorDataService.exe
4648	ssh-agent.exe
3368	AgentService.exe
5948	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eabd5217e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038e25ab5a030dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac1cec72a030dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b189e274a030dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2d04073a030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa1fa073a030dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b282cb5a030dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	elevation_service.exe
5264	elevation_service.exe
5264	elevation_service.exe
5264	elevation_service.exe
5264	elevation_service.exe
5264	elevation_service.exe
5264	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: 33	5948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5948	SearchIndexer.exe
Token: SeDebugPrivilege	2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	5264	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 1916	5948	SearchIndexer.exe	100
PID 5948 wrote to memory of 4580	5948	SearchIndexer.exe	101
PID 5948 wrote to memory of 3724	5948	SearchIndexer.exe	102
PID 5948 wrote to memory of 3240	5948	SearchIndexer.exe	103
PID 5948 wrote to memory of 3144	5948	SearchIndexer.exe	107
PID 5948 wrote to memory of 888	5948	SearchIndexer.exe	108
PID 5948 wrote to memory of 3716	5948	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_681690e7a0a3666bfecfa0101f60c600_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5328

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc943867fa7d7022e8ff9bcd4313ea437c94c4680fd9c7c852530cc5ad58b142
MD5 4ba7db1f6af40c16d77d62a5dce01afd
SHA1 bd9a1d04a346ec7cf06f8b8348d5b7da30e86025
SHA512 41f9d96524907be6c63eab65474ff35f75301430bd9c98048f39252e9cba6632947428794d80f7f6588753bdfaaae02d6a7312bb9cc9ea87c76a34421ab0d53e
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnu8LiUqx:93q6HjBwLjY
TLSH
T148D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c29c53c13bb2890ba540eb35df5c80c98b638b259285c422e375cfe7d7a8cd48
MD5 3428ad0fc73f49d9a11d549d3dc6e84a
SHA1 0ceac4af19db35c8469d1ff2c792b94ba0aa851d
SHA512 b4ed1293a92b86edf40a2cdb3d89c534340fe66979d11134ffb53432a823faca9b173978ff38c8d7e02ab6706f0b8cad8c9259e3be4ff8fb7f8eb8a7c7ebfe71
SSDEEP 12288:u1XLsswWkxy2lRq2czAn8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:cXYfDtczAn8LwsXYHU9MPxMu
TLSH
T18175012863D408F9EDA7917DCCA2C505E6337C5447A0E7DB03E49A6A0F336D85E3AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9ac001f72f61b2c2fd8518a7f83489257e7eaca5532be2604ee7c4b30aa07e03
MD5 6e3c95000f7c8b1dd29cd8039af99ee2
SHA1 bbcd58d27c540fe5f12b536015ad5aa985a324c8
SHA512 bd2ff991f6be6aac7c827370650896cc55e46bb390b5bde499ee444d64f0940070fe2b5286a7ad2cec0e9481b1bf374573e7b8d09f02a1a090ca73c198d233ff
SSDEEP 12288:ZXZNYVLeyUji0h90ZD0wxpGZIVu8rHsG8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNky:v0Le5ji0hmxrrMG8LwsXYHU9MPxMu
TLSH
T100859E26F6748735D073C0B9C5D2A68EE97230855B308ACB4286D77C3E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e34068d9e4af5377e7277d1c27afb3749d7cc6d51c6aacc91b148b09995751cb
MD5 ac050992b845af37b8d07a7eb14f97bb
SHA1 91a5af61e40c7a85c0264c9ae0deff65e61fa18c
SHA512 cd1b19c2ed8097c72dafcfb091d07c26ddf0a9c1d1b8fa387da318d0a2275e0a6bc3b5ad99ae22802a1aab3daad95088fea1c88db4faed6979a20266914bd6a4
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyuw8LwsXYHU9MPxMu:8/ezSC6vUzPvxHjyZ8LiUqx
TLSH
T142755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1c5739238318e66f9b6c8132d1072197f437eb2b9125094e20b52dec2a590422
MD5 6611c0fac24ddfebd157279dc1b8e624
SHA1 8e665b911266081299a9022ede960885b9868823
SHA512 ebf258cf94067985a4ee9ab5809742c4fe63e3f68a409334df764c15a26e8c22b664d98d8ed57fd905f1ad6027963058a50597498cb8731cb53a04c27cd070cb
SSDEEP 12288:5VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im9878+g7FmsTL0v0vCHSwu91GPTUQw:5VbqPb88hv/l+678LwsXYHU9MPxMu
TLSH
T147559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 56c955a98e67952dd68f2883e23e9f7eb9868d8044eae654fc6cdaee923b269c
MD5 98508dc9807b531d0854252c16414c88
SHA1 00657e5967c2c7151421e3ac559fb72a5b1f333b
SHA512 f630ab1fb17033cd1f3c0595dcfffbdcf96b7de19f0bbb4d8a0b18381d3ea2edd53ddf3891483d40c1e9014d6c3764a3bf82383452b21486746a9cdcd95c9071
SSDEEP 12288:QjK8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:QjK8LwsXYHU9MPxMu
TLSH
T15E552321878938F2EBE5707AEDC1D74951276D68E8E5EFAB7450BFDA08718B0CD9012C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 78eff6d3096c094d822fc2cd03c8305a992e3e73ff406edafe36c33dcf19df96
MD5 c215647364eda9278fc1b5f614c3c196
SHA1 87c85e4a321ad7ba6fa1d99e03b41598a1ea2449
SHA512 fc08f09a3df8da84682013c139127205ecb9298ec8f3781aed6c8a42f8fa5796afba8515b4705aeb70514b19e19adfaec61c1e895c7be2323b90d7775fdb5a3a
SSDEEP 12288:HeBNUbTVO86UT8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:HJIUT8LwsXYHU9MPxMu
TLSH
T16A75CF3BEE28FCE2C67A5DB99A91C700977278304B61A3CBD164C34E9E235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3d22594bc77c6012b081b2a31bd2597a73b85baaf025dff9a294be3225f9893b
MD5 ed5634e50bb8191c897bab44b4ca0741
SHA1 f64442a20ef42852115f5ace4113a872f664a268
SHA512 344745459c8607ea1bae893bb0c66cba7c677d8f9b238dd60ccb82ae59e61882788f2321300e55016d0704ce69390ca9d317432c7beb2d2fd98805d01c875d02
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:SQvGAdlCEL8c/yRNw5CNLjY
TLSH
T101266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5b1d1cd199eee215881bccbf4753ae1d24d63c22fe4f8baf57d621e2bdae2819
MD5 4aeae01c764b77f36c778ec1aefeb76d
SHA1 efd1cbbe90330f662e37aeed0ff7a972a07dfcaf
SHA512 2a5ef81ee570bd8521f8a54dcc7f0e8cc85c89942e8b2d8fbba268eb87b68fbd3bde3925ca5bd903fcc45279436d114b9402bdcceee5610dacd73aee5a1906e1
SSDEEP 12288:ZAwSfxL/2Dc3tDLLmt0LDQewsAjd8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:KgewsAjd8LwsXYHU9MPxMu
TLSH
T1AF75E031FE74E432C7BB0DB65B26C706143D79204FA11AC3F3A89E9E59701D26772A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6b42130b923a1c6a44d3002f0b4a3c09dbbdab2c26171c92fcc3782398912514
MD5 c142e6c68573df95443321572d1f06c2
SHA1 ee94c2f1a32b981aa3c2844d3f2e97c9124036dd
SHA512 4a40f9ded39df5b4cc489e7c5ba4c60820f9b066359aeb01e9ef3f84a6c79bbde4183fbe28f49eeaac94967d1a7f58141af122838e2f202b94273f487de43630
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmLj:FUEtQevvqc2W1cpV2EI32mLj
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de1928fa780409755d2261425432290cb0b5e266e41ab9aa922462f00133badb
MD5 7fea66a1c6ae413c654a9e1fb4be2c08
SHA1 64015856fff72e11bc6753e3c20423508f9f116a
SHA512 5636064e0dd7c96972b339bd50f48adbdb5ffd04d698251afac9398c5954bde4e10e89e354e267144aace968d3e86c339ff1d622a00db6c74eb13ce0e23be91f
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/z98LiUqx:CoquVjnmJLjY
TLSH
T1D9D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4b2ba8c88297bdc7337e5dd849b15a1324d64406ba655a0ffdd77f7c5bde3cd
MD5 e06467158b89a379d037856b60d2db81
SHA1 0c69fd91d8cf62a2cb0e5ccd60cf8f9141dc2d62
SHA512 748e4edc393a46a1002cc40a706ab47f9dddf4b8235d412389760679f275d532dea369c6eca71befebc5e8e9a981f0cdc42037ad622b1a2cdd064d13a083793b
SSDEEP 24576:cAhGLJIFoiwtA5l7S53s8LwsXYHU9MPxMu:cAMyFoiq5c8LiUqx
TLSH
T169359D81E7F955D4F5F3AAB899B68171EA76BCA95E31C20F2150D21F0E33E509D20B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 dae10bc508df3956dcf853427a0c01bffcecba60d017e6da839d2855b49b4bab
MD5 e9ab27a8566bd5e8137ccd998b5fb85e
SHA1 c481f5a4f9dae561a106edffaa7dfa7923814f3b
SHA512 eae1bce44f8f0282558aaa2410ed42b7cdfe10dbcb38bd86f7a271be4607fe6544b755d4d02281f0d473ccba06edcfa8d703adffec9b0d1ba580e9ec5480b127
SSDEEP 12288:Pmw5HEjsChNGBFgl0WDm+CQ8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:uwuXOW58LwsXYHU9MPxMu
TLSH
T1FB65F14667A81CF9E9A79139C987C136F7B3BC112A61DB1F1760C75B1F33260AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 41edd35f5beba8fd8dc6f196712bd3c721920c7e58f11859e2eec6c5936e050b
MD5 0cb1299d83d36f3f17eabe2d1351a791
SHA1 155f99dc58ad0b39ab50d5b5c6ff99ffaa10933f
SHA512 b33e7a2dcb624ed9586347418a18e82ef853d6c77b34e320e79647f9b400b1d01d82e7dc3d15dc9d27ecb3a09c3399527e1a3b5889c158384fa3997792cfc001
SSDEEP 12288:+HZ1Iyt8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:+Zu+8LwsXYHU9MPxMu
TLSH
T13655126A23D830F6E6E3617DDDD18609E372786567B693CF216087AA1F739D08E31324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c8fe700fb64719725f282cf74e6d49d306a5a194c2fcb1e46813dbf8119939fe
MD5 f402a0dc6a23f586c0ebd22a781b8212
SHA1 3c606581eda1646f7dbc4142805a3585c08c214e
SHA512 8e028a366d5000067d40357b1d75fbbcef447e4ae3f7cbc8914b6ae8d037bd62a3c44272615937c3444b9bede3c3ac548911301592797f763ac3a8aed1d18e81
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:iQRQyi36YOcPQLvw2gAf+PN30LjY
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8ec3c28852f51fb42cd926d7820173182950be75660787ee788c9e2c9f5d1886
MD5 3bf76ac73c4d8ae3f3c25802e2eecb1b
SHA1 bdda814b61ee9b63f0a4aa1ccad947f99ebe984a
SHA512 3aa871264df285e0cf88fa6bcf727719334348ec696bef0bff9ff2854cf162964ac638ab2256fb037df9e2b70fdd742a0fb132f063fa2120ee4caaefaf9cec7d
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:IQRQyi36YOcPQLvw2gAf+PN30LjY
TLSH
T10B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2e22dbd821097a596172456d10138a94c0b01e5ee2a5ce9db2a502e90a163e2f
MD5 fa69ca3f0309a2e4cacde37bef1dcd2b
SHA1 4c6f7d27d782b386ed26c3cd963653fbd5100e42
SHA512 00bbe3cf4a9fc7cf9d1f8e3bb5d7a391b2ae1052cce5635612e850b7dc8613c0dcf9bc8c39277d3fbd9d3b13d1c6e0e48b9c171fce8e84f4e006d0b2a5ee6e68
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0u8LwsXYHU9MPxMu:468Qg55nhheWu7PNU3/N8LiUqx
TLSH
T19DB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f67c50be3d12201f116bb97fb5bd75164748c1e1ffe110031cb51a1462041cc0
MD5 d51a7ca52c8c9a84e04b0809eb06a48c
SHA1 c8e8b7589fcea9e60954e1b56c0bbf66ba1530d5
SHA512 0e3015bba42c02640468f39f3b85e0961fff853f439f3a8e89396112bf9f241fe4cd3748c5794f8efbcd7e6ff502309f2db47f70d74b15901a198ef48fedd324
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:dy5112gYy5azzVvL69nLKnhZrLjY
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c935e6369a72020d687123065e136f72f6262aea98abe681e88957daa393709d
MD5 363c23d2c9ddf1f43c642083388ee8d6
SHA1 fc53ce23cd06f17c9c86ac5ce106e61aa2065a0e
SHA512 0947884717b97842d25639909f5c429587e77cacb8cf00958e194031fc334e09a9dfcfe8aa40e4b00f8a7c710c3eaafcad00b238cc5891bc0561189862e90f1d
SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glX8LiUqx:au6JmVxd2dsLjY
TLSH
T1ECD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a3d13e88f5140309af3e05ead31c81994e56928bb40ba7b0044e7494726af108
MD5 0c3613531d2ef2a440bd34a6a2ea5555
SHA1 a18a3e9fe0022c8ec1dfded6347d29dc1b139fc6
SHA512 9402c2593cae7092e1afa4129f7650afb4da87c90e9af34795af8a6fc267a5f463f0f5ab52cf5a79610d9daeb54977df7f365c6fa1870eefde7a55ba58787fd8
SSDEEP 24576:bhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3D8LwsXYHU9MPxMu:x1hpsNoJpF1A6UU44CwH7R4xz8LiUqx
TLSH
T1BEB5AD13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3984ee2cf230d44859dfbf31704e4f2fd327e22c56b583409579ad15177b24c
MD5 c397e2f522e5cf0116cc3df7cfb86565
SHA1 22fb52b3e72156a19065a33d37e419d31130da26
SHA512 c729d8ffdbb552272fd99f1a3ef308fb8bc70d06690b035ed8f8cac39ba00ecf855a0fa04146652fb874a64462e322131d95ffbe6efebf41a01f2e2eaae48457
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHq+8LiUqx:G5dKTi61/LjY
TLSH
T163C5BE13F2E940E8E0BEE674C7669232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d7860ba404d1e91de8fefe14b5edc44728ffd6014a61bdd4e44d2cc9b98f8d22
MD5 8b345d97af14c27c449054121bd7fc1d
SHA1 18c7be76a5be6ad876d5b9844787c76a116bd635
SHA512 5c46034050a0fe0b78489bfe73855d522cfa57d5e3d12ca8340c250d40f26f21f24d0c6dc4b8cc4f32b35ba7bcd6cb5f685ce05ddb8f01486872a573f5f34efc
SSDEEP 24576:ehiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLD8LwsXYHU9MPxMu:ehtSn8EApI0figngiDn0AP5wn8LiUqx
TLSH
T1F795BE13F2D900E8D05ED179C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3f6873a6d7b610b2a233e52f20169b3d4777f022c5bad6d0e0030b75a8277d63
MD5 689d6aa3d554fa6eedc1c5341c979b6b
SHA1 c44accb5be7aefa16b5906123badc72a34636224
SHA512 a487cbe1a36f6b20207b9c303ba9b40551de87b9b9cde23284f23b0856ac3f8fe6dd86b0173ceb6a0d21ea50a1409a75422018cca05e2380842adfd9a43c1291
SSDEEP 12288:EC8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:EC8LwsXYHU9MPxMu
TLSH
T12355232586CE28F2E9D571BBDDC1C34961273D6CF9E5A7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 928fdb6252c71689864642106f3c41fa79a16abe5a17704186dba3299a16b822
MD5 1516b36241a09df832913c4b47ae64b2
SHA1 9c7854e4beb09c10f10717272dac2ebf7fa4344c
SHA512 7d4077c793008447c19237d48fc8acdb7cf364ec7c5979ccc9663c1bd77147a7c3fbc83ef53a72c19d380e6dd205d6ecb29db7020020c5aaa0ab2e8e799f33af
SSDEEP 12288:HB8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:HB8LwsXYHU9MPxMu
TLSH
T16C55233586CA28F2E9D570BBDEC1C34951273D6CFAE5A7EB7450EB960AB18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f994fe48c17b5b01a16b5e72b98adde3f6d43249e0c250909bb2aa4fbe295961
MD5 5b174e6308649221cd4eeb287dc4d7ed
SHA1 73dd8616d1e476c9e8a79c4d149b23238751ade4
SHA512 83e2f2b3d0637940fb218dfb331c8ab061a7081a49e699cdda4941baa717ac84cd446a3a2e3da5192ebe0cb1132b1b6c8464b0c049e90dbf89e8e81724bcdc35
SSDEEP 12288:Or8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Or8LwsXYHU9MPxMu
TLSH
T1E655233586DA28F2E9D570BBDEC1C34951273D6CF9E5A7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 cd2a28e82053ab780fee40afed2e7baad465d756ba7b5ff935afa9b8d6c90d19
MD5 8f2db63030ad2cb5e23b4e24cf9a1987
SHA1 a32b9745823ce8226da7594aa37e578a1e49906c
SHA512 68cbcd386c800fd37754eb2583905a10cba80af65a1cf8eb81c77490363c2f2c6de0c75b3b2e9313cc217f442274b766f4b499890dfbe556047b1cf7ca17c646
SSDEEP 12288:0VM8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:/8LwsXYHU9MPxMu
TLSH
T1B7552325479A14F2D8E6F17ACDC1C209E2777CA8E7B1A7EF75005B8A0EB15A0CD7066C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e3fb2ec67fa6d11b01a8f49de1c2121bd7d845ce9cc55b5381c0c4aaf4b5a141
MD5 f7fe3a38b55728ecda93cbb51cd07e6b
SHA1 cfef9e3607fdcd0c876d34714144ca0593e5eeea
SHA512 1221ea36c9a2d28652fe29ab679831eb8322fb0dbe072d5d6e4dcf11b7c92d2815e455055da697f3f4562f8793790fab1b7883ca6141d7214d7d9cdfe7de650f
SSDEEP 12288:L08+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:L08LwsXYHU9MPxMu
TLSH
T12655232586CA28F2E9D570BBDEC1C34961273D6CF9E5A7EB7440AB9A09B1CB0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5250cefc72179b543671c152419ef307251fe0166b560dc886c6e43e579aa6cd
MD5 d156bf1d6b097da18ca8771501eec2b6
SHA1 30a773b48bf4905a79b743f227543db41d87674f
SHA512 7c5ed5bcfd9617d0fb6a93a7d7e5fa1e4a4723ec57572f1888fac3010926e45f52f05110193361a76f24806959f74a6f15a5c61f9d5074e5a952f02c45936147
SSDEEP 12288:DV8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:DV8LwsXYHU9MPxMu
TLSH
T11955232586CA28F2E9D570BBDEC1C34951273D6CF9E5A7EB7450EB9A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e85ea910b4731756f128f4d310083f6e972517eaf4507b5c6762313c7f786572
MD5 af7e17ce3b120f0e1f34ae48732f17cb
SHA1 d3ecb16607f13adb96075b95ba2e69f27e9e9fcf
SHA512 bd8628aa65e9566938b5f18a65cfc3c56d433e7571830a809c08d223cfe5ce4d9abc8167385681e04e27f7f3f5b0171decce166aaf42c5698ef7374c743debe0
SSDEEP 12288:1p8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:1p8LwsXYHU9MPxMu
TLSH
T17B552335868A28F2E9D570BBDEC1C74851273D6CF9E5A7EB7450EB9A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d72f342cedb95b13dfdb743c5057d66c909f396359ce56db638a4f41253cb213
MD5 43c21bb91859417369359bb2e8a788b0
SHA1 29551a2929bfbd07f462b91204211df903e51703
SHA512 69934972db3e70e78725a048ad50e35e2ef11a0f7c02fb57662f56ec1193378eaec586e6a4f432754ad00435c39904d7965baa9cdf77e4bb44d330542dd96174
SSDEEP 12288:7iZwbzzzFEoS2cPvyh8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:mZMnzFVSOh8LwsXYHU9MPxMu
TLSH
T1547501A5B39018F4ECA7813ECD518906D2B27C694BB0C65F13A4376B1F733A05D39BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b95c79f4eed5218a7c19f6dc8d0a92a76431f804e7b38c66df6bf881f262df96
MD5 51cfaef30d501519548782acc5f91002
SHA1 cd32bfa0848b5f496db8a323525e2c535a027f3b
SHA512 1ab1c8053b06c7c0ccb5fda28723fef9f73bd9b148ba8336583cdfa0370f1be4c0aab0a3b21d99f88261f98778952e053eab50385cc3d6d0bd9db977d6c048da
SSDEEP 12288:AO8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:AO8LwsXYHU9MPxMu
TLSH
T122552325868A28F2E9D570BBDEC1C74851273D6CF9E5B7EB7440AB9A0AB1CB0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3bcf14935bf53e691adc940238b603349bef43d6387c510cfbcfe488e9937f47
MD5 cfbcd12be1031e7b9a2ead3666f8e185
SHA1 536a4bfc1a6c9014f22c8988609c64ebafdcd680
SHA512 6356f927143256dccf8256064cd2784ecb2dd287696c2af858021b4b1e911f98fbe587c6f123db502171f55cff3778e237d74e089b7f458e74cb918d0441126d
SSDEEP 12288:Pa8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Pa8LwsXYHU9MPxMu
TLSH
T176552335868A28F2E9D570BBDEC1C74851273D6CF9E5A7EB7450EB960AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f125e68c9e7cc0da9079fe8fb9feafa4bfa2d9ee954ca4a447b04599ad34d5bf
MD5 3af655eb89a307aaa0888386ed7e08db
SHA1 35e5b9d3ace2bc0f2f728e90819f955113a2c0be
SHA512 fbf8bf3cceae97aedca4c9ac950c1157af397879c399bef2dd3ba14ae2b95f9ebb2b5381656309fe1d38532832e296e6da051e23f9ba97e8f7a556cc8b96556c
SSDEEP 12288:FyPz5L8t8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Mzyt8LwsXYHU9MPxMu
TLSH
T15965021763A530F9D5B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 eb618c0feb4820f0406757a470bc263b8c3483db2dae0796c332be700eff450e
MD5 8a6574dd70401f1657ea9fc22d42fab2
SHA1 819eb32d4ca619971dd093234cd5b3b1a9585a27
SHA512 d92d783091769c274a8ce7c20541233ebe489e14375687ecd75c3d8012c7a92c272a8ea005b9320412a877fdff85564c0f7f11ae3347b53e451859ef8a62ad2f
SSDEEP 12288:KO8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:KO8LwsXYHU9MPxMu
TLSH
T181552325868A28F2E9D570BBDEC1C74951273D6CF9E5B7EB7440EB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dc8719c1351d35ff5018cd2454882b1726e0b8eb3d7b942d31c2edcfb2feabf6
MD5 04b5d9a560ad0c1d26ad1199602a2439
SHA1 d083cd32ceb1d3e1eb02bb44cd6bd3e9972230d6
SHA512 dfd80f47fd61a5bedfd51fa2355e983d58becd64566ee304238c4953c260f54c4c18ddd20bb0cefa19e1ecfe148f47082a0ce7131b2cfa36acc13d0d58e483c1
SSDEEP 12288:+O8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:+O8LwsXYHU9MPxMu
TLSH
T1DC552335868A28F2E9D570BBDEC1C74951273D6CF9E5B7EB7440AB9A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3ddc92eadc3ec994afc020aa5424d748e1bacfde984a01902b2f8f15b4e4f4dd
MD5 cc9894ba691e43a577f596bfcf042a79
SHA1 024628a8382e123448bb93ba97d0d81d68ee997f
SHA512 6a7db7b7cceae88126bbfc09a9fcc2bfd8eb6bd2689f99ea219663639352954095c33d0e1ff7fe6593b620bbb45d3b8499a493d78f28608b556fa60d6725dfb4
SSDEEP 12288:GyPz5L8t8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:7zyt8LwsXYHU9MPxMu
TLSH
T17965021763A530F9D5B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7c91d55dfbc6226192235a30d3bbf81120030741c590bcde76beafb06d645dbc
MD5 87d69fcfc9ee6a77cfe820900bc44129
SHA1 06473e321379c89bac0d669fc1f1153c11327fa7
SHA512 508e299f2375b39217765173cc67baa8a25cd23d895b88ba72833ec4e866b5e2c5fb553415b13c84701c267c767f648bc6ca4c993b658dde142f671bb42e394d
SSDEEP 12288:/Cd99WYoaLHF3z0z04PDvhb8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:qTkaLl3z0zDb8LwsXYHU9MPxMu
TLSH
T1447501A5B39018F8ECA7913ECD518906D2B27C6947B0C75F13A4376B1F333A05D29BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fc8e0613533a7761f532980e26fb33669852b5b885343705c6d77a0520da103b
MD5 7f989fb4d4b24e8e148f7761645047b6
SHA1 a73806a52d6ad9ea9438b88765d001eb3c2d1ddd
SHA512 15f4fd07c26ee67ea1b085036ea2ba840b483d1840702eb48a5ebaf42c61fe6d1b7db01e1e5c5903877543e8f4709d27b30ddb5604fb686b2c4cb60122c93bf1
SSDEEP 12288:vi4e78RdTfgwCHKy7GLbbdIvY8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:v3ld9CHKy7GZf8LwsXYHU9MPxMu
TLSH
T11A85CF90F3E814E8F0B79A35CD628501DA767C595B71DE8F03A4665A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8f6657fae72e361275f91b4df2a111635f2565ac5ece712491878f6e728219ee
MD5 8ed4ba7593be12e4525dc6b5f3490f47
SHA1 b66f8708b884151f128896e935716564f1a81a5a
SHA512 9c5f060a7255b583753c8983c48186f7315087afe0495a2db7f9550346382b27d13ac655e925f903239015a27c43ea816ea7cd3ff1aadcb7364a3455d91c51f4
SSDEEP 12288:lL8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:lL8LwsXYHU9MPxMu
TLSH
T13E552335868E28F6E9D570BBDEC1C34951273D6CF9E5A7EB7440AB9A09B1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 627d80f92d309263f49d44590fa274d5c6f31638e9dfe0a8f0a037b4ddd85c30
MD5 44656191f0a6a8db64b1635ca6d11d31
SHA1 ed1c29f2d7b87e490091e0faef56eb371c81259b
SHA512 01d671c90871cf1b86f1905d8ce67f4c490be936f14ecf83c5678eda403efca29ed7fcebf41af971575c1b0c81726c4f9ad36ce739f43143109b25e3c6c623ee
SSDEEP 12288:iN8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:iN8LwsXYHU9MPxMu
TLSH
T1CE552335869A28F2E9D570BBDDC1C74861273D6CF9E5ABEB7440AB960AB1CB0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 582801d17bf62873ca75d0258e3ceea7e2b1ef13c313eab63413e86823781bb2
MD5 883c2844b31b58504edebf59437b58f6
SHA1 2eea5852ef80a3d5352007a4e0392cb74b8ab23e
SHA512 59edda89de29c2d527eac84597983de6ecb22d3a4db58db02c215a65f08e5903fd259b944884545387233db6578dd47014a8d6edf99776e817b19f9e63d07039
SSDEEP 12288:nY8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:nY8LwsXYHU9MPxMu
TLSH
T1CE552335868A28F2E9D570BBDEC1C74951273D6CF9E5A7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b978b622382865b78afb020f4291604b48fd4c234a817d3cc4b6b55fa22d82c8
MD5 9e22a2fc99dd87800b01a0b2de58eafb
SHA1 4dc7e9a6c8794af94d5feee05d4f5ef50e3c0f84
SHA512 80f8227b13df511ae37421c2761a0b7d180ea115c242ca1afede77d72e7912f85fdfe5660f1d8376f5fb869b89cd1f019ff36ac74c925736af88e0390ca09d64
SSDEEP 12288:IO8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:IO8LwsXYHU9MPxMu
TLSH
T11C552335868A28F2E9D570BBDEC1C74851273D6CF9E5B7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fac2e616a5c224859c57d7bf67df609a91cb5257c28b49986196909620c7534d
MD5 89832e4d34d7db615c8ffc8fe4e92155
SHA1 1a5b8a7ebf001c2c3e06a15b44994f2731c9d07f
SHA512 9d591af5d19d9017639db6bf9b03629caa5496fd5828deccedb4b0bf7577c024abc5adcefc922afdd335e343fc17fba676775e0bcdb31b7cc95f19bd2d056868
SSDEEP 12288:hL8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:hL8LwsXYHU9MPxMu
TLSH
T143552335869A28F3E9D570BBDEC1C34951273D6CF9E5A7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2c750150802375dce0a6ce388fe224463c25132ed84b5e62630fe0081b03271c
MD5 c593f45d3fc41e9eedfa01f0537467ae
SHA1 13882c47f198534d809a06924e7a7353c463add5
SHA512 b6c60d4d09f858ac61b48947edcd3470165035608cf383db452e0c34fb255bca823b9a176207901a7add1764f31186d0d2d9ee8f8ed594bc228694559ecbe5ad
SSDEEP 12288:C28+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:C28LwsXYHU9MPxMu
TLSH
T1E8552335868A28F6D9D570BBDEC1C749512B3D6CF9D6A7EB7440EB8A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 32d032afc5d0c95e26bf3c290434f341b1c84e315916e624c2814b712e2f99db
MD5 ddd8d0b2376e09796fff9291a9c1739e
SHA1 c8e5efe4037069d618dcea961ce8bc9f378cba8d
SHA512 00e133532804af8c9f5fdb489ee2789d744d2aa9407f2a86937dcac3048257b4419c0705d764cbb4bd4bc16c3be3316fe52ed21661437b25f95ef4c37c235486
SSDEEP 12288:2fwvD5uw64Lk3tRX69qkyAI5A8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:2fwvPk9RX6wkyAIq8LwsXYHU9MPxMu
TLSH
T1ED85CF29EBDC04E5E1B7913CD9A3460AF2B178685B71C6CF129953AE0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f18734a70ce22ba609e7548ff4fb9cf7bab158712ed0b0aee60218adfef7a3ee
MD5 cb800c77021e4d81b664e44efda4e900
SHA1 e13da6f34cffa73dba8264ffe85bac640b5cf420
SHA512 65f4b34f2b99d12c366406fa5fb45eb6b40e3df1aba429d26f5e2aa4adfbc9b4eaafaad4ee804fc4cf071de410dc2d6a4fb7315ddf00f181e2b4b6849d7f40a1
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0H8LiUqx:fySzPULjY
TLSH
T1F0066C96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0258aadb1252e20a5fe39b5a41b1a117fdab1787f8cfccd6afeb4301513e8e4b
MD5 6c5d34a12d7767196352862295f3ac12
SHA1 cc8fce973a0dada26f7137a342faed603a0eda09
SHA512 6fada473a1c586bd3de9160985796dd69891fb5f61695f323cace9d782de8af5838335627b080f1328aa438a2212a3268da1a445a4eb2fdd8deb43469d91b0c4
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYx8LwsXYHU9MPxMu:l47JUQj1irIhCnDHUPfF/X8LiUqx
TLSH
T1FA65AE1DA3EC01E5E1BA927885154A5AEA71782D5F31CACF2270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d829c9f31b38014e3c42227edde260613585facdb9ec3ee3c7d6afc9b68ad64e
MD5 d2106c0dee8e560ef4b4b83c9ccae885
SHA1 e07fa27750aefbe0189f6b9227d0e02e1396131d
SHA512 8e8d40b74418ccf995ae464a821003565723bbfe0c5938d92ac5a547a90199f9aed7b52095aa872b5ff07be9c4f58dbf3be55d781de833ea9bb976d81fdce9f5
SSDEEP 12288:b8sf+8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:H+8LwsXYHU9MPxMu
TLSH
T19E650119C29811E9C0AE617ACB828645B3333C6897E1E3CB62D0F67E0F765D09DE5717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 74KB
SHA256 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
MD5 2814acbd607ba47bdbcdf6ac3076ee95
SHA1 50ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA512 34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
SSDEEP 768:2fqePMS8NxKDSYkK7U0H8zAqaMRmnJD+7OX4ubjJJYIn8n28zaTQ8PfcQWZcRZip:sPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVQ
TLSH
T15A737C472A1540F2E2C66231B6A5BB3196F5ED610F5A1683C3EF82DC2FB6787E211207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bda3ab7476f625e2e3e3dbadf8b61019966fe45322a7ca9c6e9faea0e6af39ee
MD5 5308e82bac5c74061780902c88217691
SHA1 f502225f212892c94b21866aa32d3a33372fa3ff
SHA512 b79dbc015d2cd0903da8da8d6e799f4a448a6b70246e1a6c67a8138c8d9ba6e6155b3080e5d360cc6cef684fc9e3029c50d946ce3389b0ba9dd322425ea7c973
SSDEEP 12288:cS7m8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:rm8LwsXYHU9MPxMu
TLSH
T118552331879D28B2E9F571B9DD85C208612B7D7CAF94E6EBB400A7DA1971CE0CD7052C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 232826b5756eb18e29a50cc6488a8b24b3fc786df4ce83f596a9ef040019f604
MD5 7a1859d1d233fb3b489e3e93bd4f194b
SHA1 e875dfebbb91d61f628e915430b39043583333c2
SHA512 c4333333f52342dab154b64278a5b14b17ddf96493ad52db9a6ec66d4b4ab540bd0920e43e734e62b44d53469e8e4d5e33b55adc206a72c83ed73ffb3ed31561
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYw8LwsXYHU9MPxMu:4gb4mBIBhGFx8LiUqx
TLSH
T10265AE1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2248b5b71a71bcedc755351070cb4b1496b20f83b4ebbe88beb9b5987402a48d
MD5 6fce71b3140bb028c7950c34d996834d
SHA1 53e1cbb122f7fbf7cbeb45cd01a79c50ee56a6e9
SHA512 817663c601cedb761287b44a3828b468fe85f268e0a37ee3e8acecbb67161aa59270751adb7b31cdefad3d9c827f1fd4bc5e32c41ffe8a1214507aadea47204e
SSDEEP 24576:OG88u8FpJqH1gzria7/mh8LwsXYHU9MPxMu:F7ZFPqV/a7/48LiUqx
TLSH
T16685F16567E101F1D4B7E138C9824663F6B2B8251364EFDF06A88B551F23AE04F7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 321e8edb867405e5254532462f894b3af43aababe3edf59a6b69036f561d73be
MD5 8d0a2980f8baaca831ecbe8f12ee7c56
SHA1 4a1b2fc5da05fdbd1b647fa4cdf8c493f2846b7d
SHA512 1f571f86993831a2c8ec286ac60a9f9630c6ff98af567017380a1f93e2affcd9f49da4f0da2bb5bc36c6980900019dae709b0d3629b075599ce1b28279661566
SSDEEP 12288:dHvUrBFrEjwaQl8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:dPUr+NQl8LwsXYHU9MPxMu
TLSH
T15F65E12F62ED18E5E676A17DC9828709F77278611751D2CF02D0827E0F63DE8AD39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4fb57124da3b2eb8135c8603d10fada677dba6c0702b24ed52455bc2cd03dd8
MD5 156dc7c39f173129489096548ea49686
SHA1 044ccff39a188c8ee81b2a66dba7bb859bfa83b1
SHA512 a0af84778ed7081357e856735b4a2b82f37ddeaadb6d6cd7e6f2661d752b995ab4781d98cf99361c31edcff7a7e83602c671e0b32fe2b25c72f5f20e20dfb412
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjV8LiUqx:7G05lO43bzLjY
TLSH
T15AD5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F23FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1c11f24cb6a3d585690ff3a35c0630d3f2484a0e1298c5a7a60422ae282d63c8
MD5 437a36f56a133e9f6b6317b1a24dac31
SHA1 a5080ce78f424c2018e8a9396401f86c572a137e
SHA512 336aa60c2a1b30c3caccacf5d6e7e30ffc3650c499e0c80b559f7df6127c44a8803ab459a22ddb4679a069cb3ae0e41f992ce7fe3d3c6266b7f5039b91e09abf
SSDEEP 24576:zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnH8LwsXYHU9MPxMu:La5POZ3+Jt2pasx2+mN8LiUqx
TLSH
T17D65AF5EA6FC00D5D5B9D17DC583860AF5B1342553329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 941580fb3dcb79363a7349ef954fd0f9ff00c6d7b4902f9e8a7e36b31f0c3a1b
MD5 2b82e99323145df5367e98289b03fa9e
SHA1 ac94140138a15e691607584013458172a322776e
SHA512 3ee03529890b42253ec4cfe04a058ad1fbc7be315d8bc7e0f88ab054114b7839ad44d0a11f2d3f1c9a763ba09a478758841870e81cc4ed96b29ac13f487cb8bf
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkZ8LwsXYHU9MPxMu:PNc/zEOVHFY8LiUqx
TLSH
T163858C2623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4433d559649adcc8fda4975bcc45a698d86ca1ea17025b27a1b89ae7359d566c
MD5 565af6a8fdf6e166348fe6656a92cf9f
SHA1 15a843aa46e2f1b6efaf5276c0d0b8085b7f69c3
SHA512 6fbb1b0dc6da6bc7d79c7e7f6291243ea3419fe42ccddbd1bb8d49e7dc2977e72d20aa46fc0f5f08b8f15af861acd897fd17a8b9e9a48502d9693120613198fd
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmj8LwsXYHU9MPxMu:B8MwBtOmj8LiUqx
TLSH
T14055AF2EAAF806E4D1FEC6B5CD238512E6727861173293CB5290C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5c2c4bc8644841ce9778210ca20df534be20dfb7724d878d63e1f1a8e2db4358
MD5 b3599fa37471d710451c9f2c201f5000
SHA1 664a01b26cdb342eac15d7bd9365874b97abdc45
SHA512 57a5b9085ff601aa018991a1739786c3a90bf07432a7ae0ea6604e655483bfc9954471cf0670f23fcea7298025977fb5fb96864bb5cdf67319b0c7cf39a3d256
SSDEEP 12288:yQcMxWDXN1Dp/fshBItT1IQgAi8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:QD3FHshBIYQgAi8LwsXYHU9MPxMu
TLSH
T1CD75E13DD69C04E4E57AD1BCDA538A06E77138AC032266DB11D4C2BA1F67EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-84-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/2624-0-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/2624-1-0x0000000002860000-0x00000000028C6000-memory.dmp

Download

memory/2624-8-0x0000000002860000-0x00000000028C6000-memory.dmp

Download

memory/3340-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3340-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3340-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3368-138-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3368-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3368-133-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3368-127-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3368-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3384-59-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3384-61-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3384-46-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3384-53-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3384-47-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4300-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4300-72-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4300-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4300-295-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4648-121-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4648-113-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4648-115-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4648-313-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4720-85-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/4720-310-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/4996-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4996-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4996-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4996-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4996-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5264-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5264-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5264-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5264-30-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5328-58-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5328-278-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5328-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5328-68-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5560-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5560-314-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5560-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5560-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5560-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5560-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5948-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5948-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5948-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5948-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download