84fc41f7a24fc3b9dd71d0a676e5c4f27a4a595403c431b54af310f42bd83c57

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Size 9.7MB
Sample260822-25jkzscp21
SHA256 84fc41f7a24fc3b9dd71d0a676e5c4f27a4a595403c431b54af310f42bd83c57
MD5 da00f16ea82fb304e97409d9c08fb9b4
SHA1 d210861fb98cd2fb48f95ce03b9ccf547c6aadae
SHA512 91d02c5e0ae8b9669426a232d59259c11c49e7a1672c5f2b5255c13492e9f6f189ece8b1f5dece33e0aacd2b652277bef20710afe86e713ed7921805ee74695e
SSDEEP 196608:5aZseskAFIQ8fGu0zkisj7Dks+Afv8xxKl08:5pes58fGuLzws+yvFC8
TLSH
T1C3A6E063B302C0B6D58201F1592A9BFE893CBD381B2154D3F3D47E6A69721D22636F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4744	elevation_service.exe
2928	elevation_service.exe
5632	maintenanceservice.exe
3008	OSE.EXE
2780	PerceptionSimulationService.exe
2976	perfhost.exe
4884	ReFsDedupSvc.exe
4644	SensorDataService.exe
1300	ssh-agent.exe
1168	AgentService.exe
1532	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\24913f71209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000217209668b32dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000389094668b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006941ad668b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1f773658b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7eaeba58b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062cde4658b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeAssignPrimaryTokenPrivilege	1168	AgentService.exe
Token: 33	1532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1532	SearchIndexer.exe
Token: SeBackupPrivilege	4884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4884	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	4744	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
3036	2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2796	1532	SearchIndexer.exe	101
PID 1532 wrote to memory of 2472	1532	SearchIndexer.exe	102
PID 1532 wrote to memory of 4120	1532	SearchIndexer.exe	103
PID 1532 wrote to memory of 5356	1532	SearchIndexer.exe	104
PID 1532 wrote to memory of 1140	1532	SearchIndexer.exe	110
PID 1532 wrote to memory of 2668	1532	SearchIndexer.exe	111
PID 1532 wrote to memory of 1000	1532	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_da00f16ea82fb304e97409d9c08fb9b4_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3052 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1656 1628 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3052 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1656 1628 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 560351a943a7458d2fffec7b47b5868a0b8d3e867e79fd79026d5b4b0b596aef
MD5 2d095f3e451a0edfcd972c287933cab4
SHA1 4619782b91fa758644fb46a3adaa9e200a1246d3
SHA512 f1a0d37c51af9e489c0dc79430c2aab02db1e0e421563fdfeeac67e9872415e837403908fb600ca2020165497a08efa56b657b955931ccb45ee9596ff26e8aca
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGlWI7f2Fdj:Q3q6HjBJvIdj
TLSH
T1C9D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 51cdb932744b47942fda0156d2fd2c2d7bea716d335d7696562e43b4a9ca154e
MD5 af108b0feca703a71a4beabfc62fc626
SHA1 c794608f942733ec5aa96186b1d215e2ba18032d
SHA512 6fe0a5a50600f8f3db39015ddde275b29b1881fb7cf07a009ae09ea6cc38e40ba97eeef813012741de1257075ee02cee9222711bf5064dc1a4f0569e02e7e64a
SSDEEP 12288:+1XLsswWkxy2lRq2czAfAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MXYfDtczAf/KSWITnbD2sKJdj
TLSH
T14765F12967E508F9ED67827CC8A2C512EB7378914760E78B03F49A261F336C85D3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 990af5de0d26d6254587a9a89d4c33ec761d761285aae299e0efa46497813a50
MD5 87613586c493025f88719c2b8d779d5d
SHA1 1ce20a1a01a6baf65153a45725bcd7decd679767
SHA512 15e3300174f2be6086d9dc8cded6e3fe00cde24cba22f65ac5a16fac3df13b7d77c0b0d4a73623b7c79f8c28eec5b315643472a7bd23feb68298f66e0402738e
SSDEEP 12288:yXZNYVLeyUji0h90ZD0wxpGZIVuFrHsAAgi85bpRaTbqGLIIcdJViyD2EHFrOHWR:20Le5ji0hmxirMA/KSWITnbD2sKJdj
TLSH
T1F3859E16F6748735D073C0B9C5D2A69EEA7130821B308ACB4296D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 789de59fc6f5db3735e6ca1f6eed24520151044b2ac4e983cef0b1b6f53afeb8
MD5 eb066def531db53f999f7f59bb17ac7a
SHA1 2287323b95636231eb1379527707b187edbc00e6
SHA512 2024489e63ad1a1f85bdedfe8e2607b54be8f694a1b5aea8cb020cf16fd22cb8e7c705d1ebc87d52f451b73779c1f5956020bec47df310130286f6519753e25c
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyue/KSWITnbD2sKJdj:U/ezSC6vUzPvxHjyxlWI7f2Fdj
TLSH
T174755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1cc370e958fe62d864dd765a8f9e1cc99a598bfdb81d1242e3604fd678d8ae4b
MD5 0e6c71f2efb29dc400a02c62ebb1b1bc
SHA1 36223f312df2cae0baa131d99548ea6970302651
SHA512 6cf90b37dc6a59b0b00808c4ee27de1f9ba163884019a5cb6b898c343036be39568638c7a1c0ef283a5076aabeeed7449d9468848f87a9f885173fdbf4038ef3
SSDEEP 12288:2VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98zAgi85bpRaTbqGLIIcdJViyD2Ej:2VbqPb88hv/l+6z/KSWITnbD2sKJdj
TLSH
T1A2559E66F6748331D073C0BAC5D29A9AEE7234425B318ACB0246D72C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7d98699f3abc4915511e90985ffc1874d59097a063ee0b78a847a02a70d0468c
MD5 63261d994e79c01acffb532c77152d6c
SHA1 daa8b7de4cf6256d23fb6ce753e96c8f7e422dcf
SHA512 fd500d5f3d394398204a155529cc5c32cf25552fec61da3d59e7e2fc1bdc948221c58d425e6c828961d620defd50dbea58f2f45ee1a77c45050083545bb1aebf
SSDEEP 12288:kRkAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:kRk/KSWITnbD2sKJdj
TLSH
T12C4523064F5A58ABE67B0EB565DAC0D747E97ED03F606D0C82723F2B1178D84E42C7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1550361ff13c26083167a3cb9baa45c06d904900a440126b0a9d17a4f29afc5e
MD5 89c109319afd7bae1134fdd37672c4bd
SHA1 f6a5abbbfec8b686ec96b079da5692126648e628
SHA512 2b72da63e49c8cdda1f07ef0e044d01c16ee26480c98150f6aaf966b3b8cd10a9f5ba61c329248d7d56307536c31402d6a31ad68eadb8f36be533e48bcba8948
SSDEEP 12288:ZeBNUbTVO86UbAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ZJIUb/KSWITnbD2sKJdj
TLSH
T1EA65CF3BAE28FCE2C27A4DB95A91C240D7B278704F61A3CBD175830E9E235D05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9f5fc5066b9bf2c227a7461a9eb31b83cf3ef6add53894d9250ad6c4d0e5ee74
MD5 f43eba15bc768c090a7c0abf679366d6
SHA1 86005d516ece73f0fb028558cf11d91547a4b80c
SHA512 932c39a5614712505211085471ee4949c9c37c794eaaca5b8aa53b7a850aaae81640335613cb526235c878451852e89ac062618c0271ea1122ac1f5d0eace9d2
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:PQvGAdlCEL8c/yRNw5CAvIdj
TLSH
T1B6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c9e1096dc5f44bc29a2957cd0e8b8c6844ae4514ee698dc3abc030819a9dc113
MD5 3840906db13c03715ec0887c5507ad9c
SHA1 3d3d0cc19f1cf53d79a530d21691143ed703a63c
SHA512 3fb1b78fbcc9c3139baf606349433fd714b2cf39565bd37af0beda7272a082781993bb08dfb88a7e8224e1b5496e908078ba8465f153b8c762fe6095b2604f62
SSDEEP 12288:BAwSfxL/2Dc34DLLmt0LDQewsAj5Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJy:idewsAj5/KSWITnbD2sKJdj
TLSH
T1DD75E031EF75E436C27B0DB21B26C716156D7A600F611AC3E3B85E9E59306C2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5ad158d7152950f3ec7782837ba9cc45e7dab1269bc39a9fef52e1cf19473d28
MD5 727a396dfc656af7fb8fa7cc2b01c1a0
SHA1 d04e84173af50545226ab15b7d9d6f6e36042aa9
SHA512 634cbda86d962e5622e05ab69965f99610ae4e82dc209f7adafbf9287bd91888b469ee064e541c80f14c285fae53d7cbbbf7121f7ebb5b32441e93071185a66e
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHb8:2UEtQevvqc2W1cpV2EI32b8
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d8124fcc7cb3f6fa9c4735dd00d15d0fe1ff27504cbc6dd173c9f95b418bf17
MD5 c2d7eb76a9f2d480b1cba6b5e9b068e6
SHA1 87bdaccdf0bdde86dfa5163e020d8db3c9a01583
SHA512 b12ecd738590bdb3d3149683eb9ea68fe70635edb471a480bb9fe7eba36749c3622a897d97990db578568ccc1c85349a5613923029eb9a7e6aff368c147f02a2
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/z9lWI7f2Fdj:ooqtVjnmMvIdj
TLSH
T14AD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f8f27d953d8a785400364d6830a8afd639236d98ad29f169470cabc26f2d269e
MD5 4596ed5ed064339c8525207ba19651b0
SHA1 b298e0b4d2998060014facaf3c0e70e306210893
SHA512 916fa4de1f053d1351db7d0f96f775cf35ca7f70cc4eafa505c50e048b8a32236be9fa032a524fdf904a0b73e968883deaa6613f1e63d83247d5d72ea8eda602
SSDEEP 24576:GAhGLJIFoiwtA5l7S53a/KSWITnbD2sKJdj:GAMyFoiq5MlWI7f2Fdj
TLSH
T12235AE81EBF955D4F5B3AAB899B68171EA76BCA55E30C20F1160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 946f7d306dc2044a62a836053bad6522910112db6b41832cea1c9ea55e8aee46
MD5 8c5917d52c90f1cf9e19bb298af8b1db
SHA1 e9e5835d337a96940f3a20559dbc790e10057b9c
SHA512 bba9ee194e0d099c282ad2a792e8faadae5c2422a2af47542e41636467bbca4386057b10f9eba3f64bb3de4109a56e1a8b8bc48505168a6e9819f121adec6bae
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+C+Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:OwuoOWl/KSWITnbD2sKJdj
TLSH
T13465F14A27A90CFAE96746398597C136E7F2BC512B20DB1F0360C71B6F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cb34794ca54187d5ec075863cf05cc6fdd76d38dc3110315a41323b758d47ac0
MD5 e91ec92f4b0de59d64ea65e544be710d
SHA1 46071d14fd52cc818250215c5faed957d7b854bc
SHA512 33c7d8d40a2099b45653eed3455b3b5c6c97bd551d05b882b493e7d340610c252da8409efa934e828c0139c6be49a195d1c89bf41b3b0f938de7e8a6f2a7d638
SSDEEP 12288:NBZ1IyJAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:rZuI/KSWITnbD2sKJdj
TLSH
T11055124A17A920FAE1B706B8D9E58586D7B67892273053CF0271172B2F32EC56D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9f5c340e5997c869d752d1c36c13ddfe474014a8fc1fc2ee9ef905fec1226618
MD5 12940c8350173eb455ee02631abc4919
SHA1 0867e0252b6176e1f10a2923b28d304cb8db0d83
SHA512 387e48896f9e43ce8cf28162b320d772c8dae7d9a5ac0fcbe108ce828b8cefb7a9ea84393a7dec0c2b4d5aa3f8a3ac119d397ba9170b37c09ef38bd9544dd824
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:/QRQyi36YOcPQLvw2gAf+PN3tvIdj
TLSH
T15E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cffdcb12c5ab5b5bb2895785d735af08721c0ee93aca0d492ad0d2b53e16548f
MD5 b664062f75b59c9629e9996c9c0e001f
SHA1 9e1b61a45017a7effd80497f05f87743f1fa6145
SHA512 22b7ac5b1f605c1b2917145d9fcb2f8fad161466ae9f2a8b4d4855a25ed1697acb98fe8bea6a16f4d13c70847e6fadf15966a12649c8567a11d310058888bdfe
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:+QRQyi36YOcPQLvw2gAf+PN3tvIdj
TLSH
T118667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bf4f3a01574cda653364c8f4c9681f4f49d74985b4e66ee36dbc8792c4064e96
MD5 503cdc60748c7bec4684906b670a67bf
SHA1 58b2db96a30913c4b37f3fd466d806bb505d5044
SHA512 09043eeca62eb32fb47e5c49e71b9dc7cb43344f7129181a56c4e611a518e61e120c1e260a688dad91246b24e820a1efa2ee7020be4e764333c685c9ac671ab7
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04/KSWITnbD2sKJR:v68Qg55nhheWu7PNU3/NlWI7f2Fdj
TLSH
T103B54933B2F600A9C45DE1769F4A872196D27C718FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 29eb99e4267efb05c1372b3e59a48ef6ae188046a2b70f187e20c37e64ce14a5
MD5 3a67e0b539c7fe3a072aa8aec750641b
SHA1 e85fbd532cd873f10d2b384397ba6767443871d5
SHA512 b2a2d99a8aa167ce14a780033852ab0c3f550c0e43fa4e970936c31f6d5c7ef6d755ee21d24bc4825a4f28ca500bf32b2445c1a3578509259ddfdd1209b2fe96
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:qy5112gYy5azzVvL69nLKnhZqvIdj
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa722cd569cbf66929761a9724047e2329ddb27a3500199f878d83476f01aba8
MD5 3900d4de713dd01e0c98fecf1a7f92fa
SHA1 ff26e8bdb730b02f3b38767b7681ab8473eda6b7
SHA512 cbee9ec265af96a132c4975528835afce7989a9ecf6c3dfda91feca7b114b0a0a23e4940b6485170bf954a2408c436be2dd1b41f9a67d773bfea07822d83ac4f
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXlWI7f2Fdj:Xu6JmVxd2dVvIdj
TLSH
T13BD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf0846be008aad90bed009d6661948c8c8522c47aad3c7ffdf28f55af56e56aa
MD5 a9af96c22fad8535fde0bad92f5df480
SHA1 a18bc8d61048df879547d8e0301cbd50ad73ba64
SHA512 85fe0dc42201c9899038321d7b72397178ac7806ee3fe03194e3862efcf71e6f2f0adab129fcb4af5ddf9f82537f565c036695a54d583dd8cc505d2a50859650
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xLlWI7f2Fdj:NmifPbRMvIdj
TLSH
T164B5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 23d13f8699259a9d1829a5f299eeca25f593c1ab9dcd37e68a8e43cc4f940433
MD5 45f67f448e7feb13bd2dfa8c7ade452a
SHA1 cca0dafcf6c7f2df143c7d9f093995282839b460
SHA512 1e87ce49d0f13c3b47bb9b0b217579b47d41c14238161720c885355354b1e4e53f1d75bfd985b5d4272e2b1aef0650299f1418dbc1b7866a3caf60d1f0df51ba
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqWlWI7f2Fdj:f5dKTi61evIdj
TLSH
T1F7C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f918ef854ad5d4031c389a21a14dd8861c50ac699b4acc1d890c8378395080b1
MD5 b826c37252bc2ec53ca3273d434a6b98
SHA1 642a9b040db53886259ca536bdb01b2df32f19fa
SHA512 c6f9357c2b842af226e8fb1e1dbbcbc746c179e1d5ce6ec32dc5b56c516396deeda21cdc18cc2c41fec678b068ac02540205378a9b9c4a2e69cfd8fcd266f665
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wnlWI7f2Fdj:7X2iyphYvIdj
TLSH
T1FF95BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 166146f31e0ee41fb35427a3362996fc3a4d84bb1ccedd234d4f043d911b6925
MD5 bf94ee0c9689d1f03b87cebb59a09910
SHA1 0ccc557d2f115daf49ab2204d03de6f44dbc5a9c
SHA512 9a4993708a68eadcdf7a836e246dc56ddecd2e2dfd872fba484f4e33d3cfc59e4b38588c1c52b36a88e40941bb31cbb11c7c69f33304ed965a00531a137cba1d
SSDEEP 12288:AMAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:AM/KSWITnbD2sKJdj
TLSH
T10B4523064F6B48ABE5360EF195DAC0DB87DD7ED23F60695D43633B2B2274D84642CAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7df6288d358b2b21c3d2fff279c0fe59a7acace5ca20fede243a2323545efab2
MD5 68587455d2b27a931f08adfb73f4f19e
SHA1 1f9826d1cecc1759802bfa4e1600ca174fdd8b2f
SHA512 4170fa4672b5f2c436e917870dc3cbc916b9e0039b4344dd7cc6c6c33763b23cab2cad2466acec369937a8a7bc537e56faab13a68d0b4dee3ffe9cfc2c1c4292
SSDEEP 12288:I9Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:I9/KSWITnbD2sKJdj
TLSH
T1244523064F6B08ABE5360AF195DAC0DB87DD7E923F606A5D43733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2b70243f37cd4805fb70c06bc025121fa5c58906204607def237dd20ddef9aa2
MD5 a43fae56a2cda0e45f92054c50196129
SHA1 6504d24addb5eed065835b0c179d55221450cfb5
SHA512 6f816d887dcba50f2441586e11a16c77b34e6392a41bdf9968ae2a5f89b66d004e4b577836ae81249e87770fa12d92e6b177329c8ecdc557d54f3ca14e88114d
SSDEEP 12288:FjAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Fj/KSWITnbD2sKJdj
TLSH
T1264523064F6B48ABE5360EF595DAC0D787ED7ED23F60694D83633B1B2274D84642CAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0e5c8173ada93af138050a4b50b582d0f1bdd2526eea0b119ad253a918460c7b
MD5 a797a9f92760ab2fec59678cbead7840
SHA1 52da9ea2491f1720ebd496b0db56acc31e56e909
SHA512 096d32b36546f1f105ba8f69dd864befe502177be4f6e0858440f90fde2cc41af359afc8629a8e8ead47a6f97f26bc37826d53f4ced4732cc34f8e9b36393a0d
SSDEEP 12288:tV6Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:y/KSWITnbD2sKJdj
TLSH
T15C4523060B6B04DBE4774AB5C5E6C097D7F97DD13B306A9F83622B1B1670AC4683CBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e7e8a7f796885749d9593b4983c11cc560d5ff4d510c82e97a1e6aaad2521d48
MD5 2a97c0eee01fb61803a724c594e337a3
SHA1 1aa874cb4c26f3b3abe6797c6f642246de93fdbd
SHA512 c3d36305ff54c7007c4a255910985a6795c241b82f4345ab30db42e67c19c80a9785060492f11030d015b4fee2d197dea871aab01a3385dc332e245690a25405
SSDEEP 12288:fSAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:fS/KSWITnbD2sKJdj
TLSH
T1CE4523064F6B48ABE5360AF595DAC0D787ED7ED23F60694D42633B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e0a173a8d1a5b929fe06f0b8523aa6e49cf6a5e309ff5b1d69a4c33adc72df53
MD5 d86a26b017079120efb651b099b63e17
SHA1 60183ceb3e4f5ac113f9fc3a1a6b9bc64dba9fa0
SHA512 853cf86d139475e08a5253a4b7db23e39b292df71192af7f197286921aa7f407957094b4834d265940403b5bb8cb882656defa7001ed39adb30093dfcdb3a116
SSDEEP 12288:PhAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Ph/KSWITnbD2sKJdj
TLSH
T1A74523064F6B08ABE5360AF195DAC0DB87DD7E923F606A5D43633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3582c5279f023675d97102db4ed5bce7dd213ff68b32ea25a44f59880155ec5c
MD5 64096bd384f311d23fa80622346fee93
SHA1 6b7a4b42843598833360bd8515bb85c47a55984c
SHA512 8095e6413821e5ee2864423518693ea17500c0562991372463241c1aee1c6c248ffa764f9b87c8a314a0c6572f0437ad16272c461e393029acfa5bb0f5b87956
SSDEEP 12288:EVAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:EV/KSWITnbD2sKJdj
TLSH
T15D4523064F5B08ABE5360AF595D9C0DA87DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c746e6459894c097c3cc2b6d813bcf27f98cbfe096a139d0b400f2aaa1d386ea
MD5 058cb72cde5d1148778f70697cc1c740
SHA1 81b8c3fdb23ee1765ae04d6e646e16ccad6cfd01
SHA512 8aacf61b272788d70a3b9fee5f3b24de4e27983f88d8f9bb46edfc87b5f37bdaf1bc58c1d811683eb4f4dc8c3f8554506343c810bba734cb1194935eadbf1fe1
SSDEEP 12288:PiZwb6zzFEoS2cPvydAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:qZMSzFVSOd/KSWITnbD2sKJdj
TLSH
T15365F195B3A018F9EC67827EC9658946D6B27C561B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 edfdcb2c328792f0c3578499a44b1cd8e626c660595f3af55cb2ad9c1f378509
MD5 12343e2d2b96d1bc1cfd8931d68492e9
SHA1 07329c100a7f267c6d01b9fa25e420f84a3da9b3
SHA512 58b964cfd80f584a9588c07218fccd25d8d173db752aa81106c4f39672689521ad5ec8086675a1437bf36537aebd0d17bcc04e46e6c76946b8fa609029906e59
SSDEEP 12288:5YAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:5Y/KSWITnbD2sKJdj
TLSH
T1F34523064B6B48ABE5360AF595DAC0D787DD7ED23F60694D83733B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0aab7ee0a098b0aa7197e6f0aa27a49441744fb63394c940ac2a5c191d273a3c
MD5 d7ab9f5c01c68c8e4ff17504e6464b72
SHA1 27b7ddf69b3736320d5eb3ce6cebbec61633463c
SHA512 98bcad158e3e4d3390e740b6e9de4cd4f9b1a4a20f8e71671eaa47ef531ac2dee88807bf10bb22e1daf0425b6873498dea98ba6b66f53805a91470a3e478e214
SSDEEP 12288:o0Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:o0/KSWITnbD2sKJdj
TLSH
T1144523064B5B08ABE5360AF555D9C0DB87ED7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4ab1480e46f8691fcaf447c2895147620a7606e8858eb7139e5112e79c721322
MD5 ac22f2c718919535261811f6292947cc
SHA1 d4ce22c85292e6d62145db995b413c22f95c38f4
SHA512 080cad6eb54bc412b8abce6ed0ff56c94ca8bb9db323c023d9c6f65be422df3dd9a58b0d9c441974fc4b36fc7185c54300c9a2173e7bb079b1ab3f2719464703
SSDEEP 12288:IyPz5L8JAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:JzyJ/KSWITnbD2sKJdj
TLSH
T17455020767A630FAD1374678C9A64546E7B678721B209AAF43A017372F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 490975a03bc8c8799941b4df9941246db894ea216dcefd50585437235d104334
MD5 41ef3e3aeec67bb147e98d16b0e5d688
SHA1 0400c1c2212e0dec6433af635e781af55b7dc2e3
SHA512 cf23df075e445773fc9aaa80387e1132e3f7c2ee20762173d150afbfdb4c5fb67daf1fa4b05b85f54a7bc3535e0771d3fdc018cd74749a13d64e923ab89ce079
SSDEEP 12288:zYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:zY/KSWITnbD2sKJdj
TLSH
T1984523064F5B48ABE5360AF595DAC0DB87DD7ED23F506A4D83633B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ef9cfd05be8efa13a85d8d63f6e199b756a44bb9be9338fe0a47c74e8c01dd96
MD5 37fc11c5dcd37c3b0482057870ed9b56
SHA1 126afe65d4a59a21d1b6c9f9fec3eb85aed1d7dc
SHA512 0b62b1ac6966159e0a7d59dc24cb20335f473b1e2df980bddfaec9cb283fc30638e5eae1ec08b1a297949105b5c579b5f462bf1ddb9a453a4d40c35a261dbafd
SSDEEP 12288:uYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:uY/KSWITnbD2sKJdj
TLSH
T1A54523064F6B08ABE5360AF555DAC0DB87DD7ED23F606A4D82733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 987c816d95ab424a0f8cb2fdf0345981cff0b080651e94cc9c1ad1ea9ca319e8
MD5 64c828c5d7f900dba55c6d826c69df50
SHA1 25929e543f8e67aee92cb987161459ccaa1eecdd
SHA512 5165b0d067e2989cfabd71e90c9f8f7517d273de9fbfc250abe9ad524d74137476240f50cdbcbb5eca788b99cfe14e58a4aaab6288f0aa60e73f68238f338d5a
SSDEEP 12288:LyPz5L8JAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:mzyJ/KSWITnbD2sKJdj
TLSH
T15C55020767A630FAD1374678C9A64546E7B678721B209A9F43A017372F376C06D3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9106c3e1b9dc1972561cf2938164044790ab29bec346b4fe16f546a1ec04a78e
MD5 2ee0b8f1c64fa8f5844d20fd86d4edea
SHA1 7821172083e6469ab51345e6b4657a4919e1f2e5
SHA512 6cca74f74690241c5fa2cdbbcbdba3e3c5de99e1946161a50d5c9b3afb61cf11ab52f26efb42be88832d75e25d563aaeb5e0ad75191633b47250c8a8cc8cfee0
SSDEEP 12288:lCd9eWYoaLHF3z0z04PDvhTAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:gTHaLl3z0zDT/KSWITnbD2sKJdj
TLSH
T12765F195B39018F9EC67867EC9668946D6B27C560B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 dcf38fadd7f698b860cbd22695f3e91f5aae5c8fb1fd83489f3c05fd325500d7
MD5 9a432fc1233db900b026a7172f0b3362
SHA1 ccdaaf6d59bd1962bb944d32445d4da4f8722b16
SHA512 422796fd893c41de5669ecee1ceea28e0c25c267700648845e503bf675e7777a643d294e6c3a05c8a9f41daf245dcd2d38f4eb025104a52f84616377909f3613
SSDEEP 12288:Ji4e7+RdTfgwCHKy7GLbbdIvWAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:J37d9CHKy7GZH/KSWITnbD2sKJdj
TLSH
T1C475CF90E3E414E9F0B79A7589764512DAB67C991B30DE8F03A4261A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 521a037c4fc937047564e1199b4cdff6c47c375e66b608e01bcc9da541bcdddb
MD5 9279c9216163b1cc82dd7d0b503009b1
SHA1 e8c266775896504f39ee5aabe98da8478bcdc325
SHA512 a4fa010441f60ea33fbdcce396797eef458098f60908f7dfbe39871491da29bcfe1b87805d72984e979b87d2d2f7cfc31782aa82c45d21ba92170f4783706146
SSDEEP 12288:eDAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:eD/KSWITnbD2sKJdj
TLSH
T1644523064F6B08ABE5260EF5959AC0D787ED7ED23F60694D83633B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fcff713a7d6f665d2a5c3b11c98e90fc5b72dfd676464ba8beb4ed3f3cd0976f
MD5 5b7af53714517ae6059e57ab9cd80108
SHA1 4ce71143d03f18e94b08fd3b300f74e226583e28
SHA512 8be3c6dd3f5d4fd15cbc6efcd3b64c464194d5f9247b5b05cfdf8fa86ca3980c5fec73a27f61336dec2922301d15deab116e57f55f852dca1e2abffa5d9d7dbb
SSDEEP 12288:KpAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Kp/KSWITnbD2sKJdj
TLSH
T1584523064F6B08ABE5360AF555DAC0D787DD7E923F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 04d388d646c3562aa62f63a27bd5c7a6b624b5305fc8a5d82c23b73fde4b0d64
MD5 ecc13b88a32ab68bd6b028fba74479a4
SHA1 3f3d82e8230c5f71bd5eafaed3fb69a93e43bb1e
SHA512 17c7cbf879458aa7fa010f921f283b4b20a99cf1ebcdbb61cd20549a683aa633c828fa42f7cbe2cef34640a48116e97e8f57e6751854428129a7e7062c8194e7
SSDEEP 12288:lWAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:lW/KSWITnbD2sKJdj
TLSH
T1344523064F6B08ABE5360AF555DAC0DB8BDD7ED23F50694D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5945000e13079818cd6ea9b9a620704b4a49fa951e87dcbd4fe609af0cebb121
MD5 28cd7351dda0fe1b6250cf8e6a6335e2
SHA1 96a86f15582f0b0051b715fad496b36d36227035
SHA512 ba75fd9c3358de3248695366fefd2d8228651c145d866f5e3983a4d07e8a4d47c13e9cf45bdfa5758611b7b0986961f12c908e4a3ed53fcb7ac430038d7bee67
SSDEEP 12288:mYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:mY/KSWITnbD2sKJdj
TLSH
T1AE4523064B5B08ABE5360EF555DAC0DB87DD7ED23F606A4D82733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fd319e810993b03fe9a5bfed87343fa500d68c9a1b894d3102149e0aa0ab4418
MD5 cab557a7a7f3e2909bb1126470399bb9
SHA1 85d868313600418fd7a0c845f57133d888f0ff56
SHA512 2015eb7e302b46ee534ee96811f0bb34d3097ca583ac24ce3effeba10ef8589ad67d6b6dbbd76c11311f968b6d23c3b47594c08b1204ad048212036eb6ad42dc
SSDEEP 12288:9DAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:9D/KSWITnbD2sKJdj
TLSH
T1754523064F6B48ABE5360EF595DAC0D787ED7ED23F60694D83633B1B2274D84642CAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 140603aa0df979d2d57d00964df4b4bda94d4dee29cfb33f9a3c33ee3c1b61c2
MD5 e786a8f34adcb8b4976041dd6cbe59c6
SHA1 f109c8a980a91f63e106ddb564cd4285b0189c93
SHA512 e9618e71ecfc60c3717658975d31404e5d3fc9e745b79ce6314dd33af637f5e85ba7c5b94470db95eae5a2861208470f8b9858cee6acedb1ef38de027aa927a1
SSDEEP 12288:5wAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:5w/KSWITnbD2sKJdj
TLSH
T1EF4523064F6B08ABE5360AF595DAC0D78BDD7ED23B506A5D83733B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8a727ce3c650be1a15840a4e0762666f53661f7e4359deda059f40939f19c565
MD5 bcbfc0b793aa89a82c59659bf14438aa
SHA1 9bbf2282591a6969ab9d77cfa378cb44bfe3bc75
SHA512 79831feabc349b73ed30d6cdd720337604ff24fc3510906454fe4e855807965272aa5f93b8219da22baabc04bcdf39c9b7b2bc2b890a5bd082250da70a02453b
SSDEEP 12288:6fwvD5uX64Lk3tRX69qkyAI5uAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:6fwvok9RX6wkyAIE/KSWITnbD2sKJdj
TLSH
T19685D029DBDC04E6E177923C89B7460AF6B178691B31C6CF029A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9f78acff684a1d21f23421c7f6d09383b13a5f3dc7d20a3e90573ba4fac5381c
MD5 dbe075280ee83395d6e6ee23eb93f22e
SHA1 031981dd0ee227bf21f99b2bf1e22c79a38db586
SHA512 ee41fb06e00d1fb38865d6f5b53d18327480ac5a9b4cbebc61103abe5069422c8a42416c889dfbb42eabf872ba6f7912a65ff164cb021ab4e5dc13e64728443a
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HlWI7f2Fdj:iySzPNvIdj
TLSH
T197066C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5552f3f399ac3d1eb518fc2037a91fcab164ea45d5403c5161ad0c33c6f90599
MD5 128be468d3f5f56d040a079e827eab52
SHA1 6e5b134f0ee30d833769734a380ca6af4844673f
SHA512 3a43f94b15a93521857302de4f6df3f0f6f7b7b107d2b3bb75591158650b2419970081ae6311d86b57a8bfc97f4a0c3e64b45015fb992cd8556bd03f4fc63b38
SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYt/KSWITnbD2sKJdj:/47JUQj1irIhCnDHUPfF/XlWI7f2Fdj
TLSH
T1FE65AE1EA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 121aba729750f1bc8172b421cb7b30312511d4646a6f20d96b3cfd8184fb7087
MD5 3eecf9b71bad90f9cacef18efe3eccde
SHA1 818e3b04cc2c175358869d37a6c4cabd3672c568
SHA512 5b8921457a4d9c615748bcaf93cc09a041cd3da4dcc0c9f47f05de4e5fd514b8cf49f826261d6f3a497228e4a0ac6adce082d0b7cfccd1dd41c14440d327e1c0
SSDEEP 12288:vNsfIAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MI/KSWITnbD2sKJdj
TLSH
T18A55F00AC39801E9C06E12B5C7968682B3777C6157E0D3CB52D1FA3E1F75A80ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 ebb3bccc67ed3a809f8e9623a89ba606b3ca95cf6ae46c1e91060d17c2ac4b2b
MD5 5f254c99b7bf44630ac890b6b3c335af
SHA1 2facda5a5b3a650477eec517fdb0326918ca6535
SHA512 f5a2b834cb1929142c3cd6ce1e4eb6a57ea02aeffcee3e2e908a5bc2105e898ee7f3fbed792aa18ca72f776ed4d7a3be19c13d6b793fd0807e4d4a3a9c9a564b
SSDEEP 12288:bhkxU3fn16dyYX3pxW64wSEwn8Ry0pXSTa4TkJT:bhcUPnmV3Ojf08OgkR
TLSH
T168250710766BD75FC6A944325E32D1CCAB707D01EE05AB0773C8873F9576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 de68820e0be9b4b5f9d227d0e60da967ecd55f8700cc732fd445d3f2080c3fce
MD5 b8027aebfe6141637ea44acd5f263c47
SHA1 d11a85caa5eeb9643cbc57454e8c59d59f1a0e87
SHA512 732137604f5de26d01ca10184b44067ad3196c72a8340aac0b855a33b7961a448845a9565b4a1ade4dae9c4c2da371ea5f4e504c73e93c589bc7d9077c8cb889
SSDEEP 12288:ah5tLInEOnc4hqNWM9S+ezKQUycTS7yvdTM1UCR:ah5tLIvnczHyUCR
TLSH
T1C855D9819137A38FD1F76032072A5F4CA7A4EC06B7096F277389453AD86AB15A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\Temp\3fd5c495-5d65-45b1-aa0d-eb93d8438f29\sciter.dll
Size 6.6MB
SHA256 4ab5ec0a963da4fd1f88d0b9d2871fdc5890b277cfcb122889e46c0ce5831869
MD5 f472455593df1dc109cc29aea76a10fc
SHA1 9ba216f825b6e190d992da4c8893645b04b24cb7
SHA512 80078369c0b6ec6efd3013acc1f53a310ee70f0d5a8d2efd4fa27abc28d55172b7401c78b11ebf46f5b9d13eec4ee57d6833f66cd8d791e106ab3f7cbceada12
SSDEEP 98304:orEyG1dejlANJUNrmf6tATeQaazZaTSG2TeXeMDQp33/TzBrqNn:hERYJU0kATeQaazZaT72TeOM47zBrqN
TLSH
T15466AE327691C47DC02E0270794DF7AEC2FAEEB00AB1429B6BE43E5D6E345D06729572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 35298b74c608f7c3fbfa779ca18a53c5f6a93b200ec3f8286e0613f112562ed9
MD5 b45a02cacec12bbc50e4a5b5fb78fdb4
SHA1 f178f410abae0be5f83cc1ea29127ce0905c78be
SHA512 dd68d2a4d63b6498909c8df58e473fa2b30ec74090bd02359fcc1e171f6409d1521d30b5dc1d5e49f6755a4bf451a4fcbd63d863e56d93f932ad19174cad8289
SSDEEP 12288:TM7gAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:4g/KSWITnbD2sKJdj
TLSH
T1BD4523124B5E4C9BF57A0EF055DEC0A6579E7EA12F1095CF92223B1B2174DC4AC3CBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f8b8565c9b24d9feba2cc90b48e4bc806c6069ef456755fd5553b98e124fdca6
MD5 ab40f1be8dc19b9371a127dcc751f6f7
SHA1 a2516185ced28936e3ae83998b95f2717a421f95
SHA512 6727a4626604cc8da35cf10bdc4f935a4b6f35786d50beacd2bb688325291bfa9c6bf1556c11c3fa5c28c78f9330350564dbca694addb76b8e591877de8a7162
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYe/KSWITnbD2sKJdj:Xgb4mBIBhGFplWI7f2Fdj
TLSH
T1CC659E1E22EC01F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fb4b8d921ad1aa5c66288e04633e94f4a8c6b09489496f659e4aefd7db3accf8
MD5 d3f4a55e10681f836cc844a4d9ddc466
SHA1 807e61f1868b27bd11464c3aa2f86fe698e5a179
SHA512 6b8e7e78978a08d70fd5bb6b1f7791211153f8edc7b2c2619f03c5c0d748c96c0e999d68c96bbf855ef889ecb870111a989ef96739ea62262112574af6892761
SSDEEP 24576:MG88u8FpJqH1bzria7/md/KSWITnbD2sKJdj:v7ZFPqVea7/wlWI7f2Fdj
TLSH
T16485F16567E101F5D47BD138898646A3F6B2B8211360EFDF07A88B561F33AD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3bbcad1b973d1c78780b9912aef9fdbd6ef4f63342b4e3ba22a9e56158fc1781
MD5 b16633972a341868cdb30e4608cda324
SHA1 dc08aa3d62cbd71ab3ebdca967eff915628d8b2a
SHA512 68520f0b6d8045e8e42007eb1f3de62750a5404371893f4fc9dae3d93891b54f71fe5b3fd1395e3596f8146c483de3fa42070e1ccf403e994fdc22e92b2a06a3
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1lWI7f2Fdj:FG05lO43bCvIdj
TLSH
T1BCD5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9e76c3179c72ab5b2091b16fda07228c2f1d66e63f04198619fa7acb47d7f55b
MD5 dd780ac7d576bcf2b4728fa28ee2608b
SHA1 a95520932fb760692a0d6f31f099b1f8696b4360
SHA512 db44b61bb23d75608e15e216362933697f74eb3fe93565e46284e9974559848081df801316d48cdca3186d26ac7701e86d06705cbd052a186e8c002e7e6974cf
SSDEEP 24576:zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn//KSWITnbD2sKJdj:La5POZ3+Jt2pasx2+mNlWI7f2Fdj
TLSH
T17C65AE5EA7FC00D5D5B9D17DC583861AE5B1346253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 33a016c52dd34dab0301fadb4b312e0d8dd7b6c791193dd4eb7240de3defcfd8
MD5 9b9f316839c84a51aa8ff5123087bb1b
SHA1 b112c5c6d4a4eaba6660c9b0c5f4928c30beeea3
SHA512 80d7065982c889d10acbb67d874254c57eb1bbacb013bca540699b65bbccf200db85064cc08dd721764040cad73250db5a2ac29c3dc6d08c6e5b628566f108d8
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkF/KSWITnbD2sKJdj:+Nc/zEOVHFQlWI7f2Fdj
TLSH
T176858C1623E901E4F1BBE1BE89779546FAB1786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1d2d7e3712015d69c46b2f540773e0430cf494adf445281f9c6db3fc697699ec
MD5 8b9bfcd9815d1b4c60d38b53cd5804fc
SHA1 1c2b856126a8c74cc5265b239ef3279831758bb2
SHA512 127f9deabc7f600d0e2e547ed59bec286626e2b6f2e24ed748e00234525b981a82af84b95300ac6417f9c0c2d3916773982f2b8e11461e4852069b4cf11f82c0
SSDEEP 24576:/8kNvNnaFeYhJNtmZBmr/KSWITnbD2sKJdj:/8MwBtOm7lWI7f2Fdj
TLSH
T12455AF2EABB805E4D1FEC6B58D238512EA727861173293CB5390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 da27beea40723e4a90d5a0075bc76597ece2a431058967462df2249cb8d9023c
MD5 ca512f0468b014d2e4055af479740850
SHA1 2ce6154b1ef5fce235eec85cbafd2424922af6cc
SHA512 b5cb1eb4075a5e298c0c1d412cac77425d4ba1fbb384998241cc8ff399e998abf97c39dda97d200ff11e4db44e91aa5184a8aafd6a56cbfdb4aa32f96072b680
SSDEEP 12288:mHvUrBFrEjwaQxAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:mPUr+NQx/KSWITnbD2sKJdj
TLSH
T17C65E11F17AD1CE5E676A17D85868619E771B862171192CF02E1823F0B77ED8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 75d1eff04a25c4ed1319f6e77657ac5b095776d8407d571d6ad0cbf9771ffef0
MD5 bc70e7efe1005e84f70b5956f2e169e1
SHA1 a3fc4d34dc9b4ed23a05b95efa3bab409b90a6f2
SHA512 f9687aaffd5bd538d11e19244914875204c453bdc5c76f3e547c4bb0c9858c52467f0f74b4fdd4b5ed32989df35b8e43e8ad518e260fd61be5f860f538601eb8
SSDEEP 12288:4QcMxWDXN1Dp/fshBItT1IQgAsAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0B:aD3FHshBIYQgAs/KSWITnbD2sKJdj
TLSH
T14375E13EDB9D04E5E57BC1BC9AA38506E7B138A9032166CB0290817A1F6BED47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1168-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1168-143-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1168-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1300-120-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1300-320-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1300-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1300-127-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1532-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1532-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1532-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1532-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2780-279-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2780-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2780-69-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2780-75-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2928-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2928-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2976-84-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2976-287-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2976-90-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2976-89-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3008-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3008-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3008-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3008-241-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3036-83-0x0000000000400000-0x0000000000DBB000-memory.dmp

Download

memory/3036-5-0x0000000002B40000-0x0000000002BA7000-memory.dmp

Download

memory/3036-7-0x0000000000400000-0x0000000000DBB000-memory.dmp

Download

memory/3036-0-0x0000000002B40000-0x0000000002BA7000-memory.dmp

Download

memory/4644-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4644-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4644-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4644-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4644-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4644-113-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4744-19-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4744-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4744-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4744-13-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4744-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4884-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4884-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4884-334-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4884-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4884-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4884-101-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5632-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5632-39-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/5632-48-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/5632-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5632-53-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download