fbfec92f0ff264d6233d9042ec0cb93f2bb266ca3cab54e8aaff7038d7213dcc

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Size 9.7MB
Sample260823-d7cnfssdqa
SHA256 fbfec92f0ff264d6233d9042ec0cb93f2bb266ca3cab54e8aaff7038d7213dcc
MD5 a180c0ed09d92dc44f157760d70294a7
SHA1 9d9487feeb24222a83806c3d9b32b0c6995f94af
SHA512 210da88c37c85cc003a6c3a871e1048ed65356aa5c986d7a77b76a082380d0814a35072c7cf49d137b39b043f826ac823106d81ac7b330e7cc84c7042193b917
SSDEEP 196608:NaZseskAFIQ8fGu0zkisj7Dks+Afv8xxKl08:Npes58fGuLzws+yvFC8
TLSH
T111A6E063B302C0B6D58201F1592A9BFE893CBD381B2154D3F3D47E6A69721D22636F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6092	elevation_service.exe
3748	elevation_service.exe
4260	maintenanceservice.exe
2104	OSE.EXE
3104	PerceptionSimulationService.exe
2144	perfhost.exe
3080	ReFsDedupSvc.exe
3480	SensorDataService.exe
3760	ssh-agent.exe
3860	AgentService.exe
2864	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32fd7654209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\SaveSelect.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0abaf32b132dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe
6092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeBackupPrivilege	3080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3080	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3080	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3080	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3860	AgentService.exe
Token: 33	2864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2864	SearchIndexer.exe
Token: SeDebugPrivilege	5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
Token: SeDebugPrivilege	6092	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
5424	2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3360	2864	SearchIndexer.exe	100
PID 2864 wrote to memory of 572	2864	SearchIndexer.exe	101
PID 2864 wrote to memory of 5572	2864	SearchIndexer.exe	102
PID 2864 wrote to memory of 4680	2864	SearchIndexer.exe	103
PID 2864 wrote to memory of 4140	2864	SearchIndexer.exe	105
PID 2864 wrote to memory of 5732	2864	SearchIndexer.exe	106
PID 2864 wrote to memory of 3568	2864	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a180c0ed09d92dc44f157760d70294a7_akira_amadey_blankgrabber_darkgate_elex_glassworm_luca-s.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2928 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0d95694b8e0244813c1181fe3266f8fbbf7de3a265da22c639f5fd7ab9e49b1c
MD5 7f9d12fcc1286e3776c8d2511b8becdb
SHA1 3f57fefa1131ad5e9a4b4b9ba29b17403d3e6387
SHA512 b8d7f1c460ce1423cabe331c50727f467646c3a38674a14be57056f1b7dec3e6891ee26484bdb9d0e455faf10e119e252a0b8562f08e3eb110cc0fa886cafeb6
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWlWI7f2Fdj:r3q6HjBhvIdj
TLSH
T1BCD59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1b90272da42ed34f26d07164f2974d9bbcb1d7e32a74e4887e981ce4aa0e260c
MD5 0429dac7fc755ad1385558449cc28263
SHA1 d0c5ef904c2e009afe02f19ce24ec39a7a9d5a71
SHA512 2f41a366fc76c9fb831a68af690f25c9f11696c4f7534657a4afdd450280f58bd1b585a5aeb72b86f15cd121805b568e476b2766d986757ade66ca697aa94e76
SSDEEP 12288:R1XLsswWkxy2lRq2czAfAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:fXYfDtczAf/KSWITnbD2sKJdj
TLSH
T1C565F12967E508F9ED67827CC8A2C512EB7378914760E78B03F49A261F336C85D3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 20e11b6b45f2798d821ce7e45c10b9a14599c67b00b9b8ca87992164df75b543
MD5 6a7da9351c31723ac24268cb1cfbc6cb
SHA1 264af4e61e121e0699cf8d78b6ce19ee4c2f696b
SHA512 0500d46c59fb118ea4d1c02d4a167435988773677a928e554c2450b7df47e3bedae05efdbed039a0ecc42b8aa86a39914bf1d32192f9e064ef9ba5cab9020c11
SSDEEP 12288:eXZNYVLeyUji0h90ZD0wxpGZIVuFrHsQAgi85bpRaTbqGLIIcdJViyD2EHFrOHWR:y0Le5ji0hmxirMQ/KSWITnbD2sKJdj
TLSH
T1F6859E16F6748735D073C0B9C5D2A69EEA7130821B308ACB4296D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2dd45acad3f81b1cb355b275a734781000b686914c1f142c322db34a332bca9b
MD5 6389988d594f0635856dfa24f79fee63
SHA1 5e7f8a2e46787fbf4973a7f43f95fe0ee26e0e98
SHA512 cb31d575c74e06cf0db26553e5a203df6a1591636989e0059133ef17acf4048ea42985479a6608ede8270f00cc505043dfd0dc0ac2996493911e58c075b56217
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyu+/KSWITnbD2sKJdj:0/ezSC6vUzPvxHjy5lWI7f2Fdj
TLSH
T1FE755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f63bebd329f03c13a750cbe0d9a36aa5e9824042f9a2dee21f953628ec4a64b6
MD5 d4526114b739fd2ce06e6da90df2cc95
SHA1 dfea734cdc04a74d40a60562e1865a843d07b11c
SHA512 9a8a6eff590e88415cbd618ffc4f538e9f2d05c1366629b64386bc53c73044a53379506075c58a790a5a238d2e2272d890e172548293211a2070b64233325f4f
SSDEEP 12288:9VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98rAgi85bpRaTbqGLIIcdJViyD2Ej:9VbqPb88hv/l+6r/KSWITnbD2sKJdj
TLSH
T1E4559E66F6748331D073C0BAC5D29A9AEE7234425B318ACB0246D72C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fd602a67b295bd3b471c1aedb659eca26c55e3fe0f3391bdbfc0ecdeaec3a998
MD5 dd1bd57d8e3a15b015c172529d746405
SHA1 8c844b539ee6090603c9ab708fd746535520b8d0
SHA512 f4b57cfefde6d8a42baec55df18b311349c3575a407681d8ccef5332eb4dc51f56d0fa38d6d1791564f3d964ee566595566f633c9fdaea5783ec642b028ef4a8
SSDEEP 12288:FRsAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:FRs/KSWITnbD2sKJdj
TLSH
T1D44523064F5A58ABE6770EB165DAC0D747E97ED02F606E0C82733F1B1178D84E46C7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 05b71820270be3c6d06c6e8c3a7e34eab59219f219d745d9bc2001e3358a6626
MD5 2ac1ebb77586e12f8a6ca3230b199cf0
SHA1 70b83b2f03e84a10baa17d9d6f92154ff8b3f782
SHA512 fd24aac8e5c94eb69a679efce61793023ae9403b222a76a51c2eca28eb1094768814074a86626b50bf54f304eb2a7cd88ac71e38fa63152a4b50d2eff6e8f06a
SSDEEP 12288:VeBNUbTVO86UTAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:VJIUT/KSWITnbD2sKJdj
TLSH
T1C965CF3BAE28FCE2C27A4DB95A91C240D7B278704F61A3CBD175830E9E235D05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b065ef2875505926b43ba64a25d53b2eccb6e4edc81766d6f8898e2b8e9f6e07
MD5 384c9ccfcace87034f4bafd6186d0a35
SHA1 ab93466aee93e6c35af970824dd7f8ff18d197f4
SHA512 8db10684ff067963216524306ed185f53484138ce4af60a162ea852707c16e5b558094993ad35a320ad344c47cbefebbd410e033057d0260bc6483f0235027bd
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:XQvGAdlCEL8c/yRNw5CgvIdj
TLSH
T1D2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 855b38c591ecf9c58c1d141aea741679317635bf956649336a02f6e00dd70546
MD5 2bd127b97f706b9c9fde22803e2f0d09
SHA1 b504647367fa0a5526833b2a4d21edc1cf41b31f
SHA512 e3bb5eeac3e9e3e87470b8552a5e702621382968eff1ed301d340e05a2665ea6797a15ac117223e19c5b63b1680d2c0d23f2fab78a713773d0051efd26a61580
SSDEEP 12288:HAwSfxL/2Dc34DLLmt0LDQewsAjJAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJy:gdewsAjJ/KSWITnbD2sKJdj
TLSH
T14275E031EF75E436C27B0DB21B26C716157D7A600F611AC3E3B85E9E59306C2237AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 451834d98a328b520a8769ec529c0bbc09b9e97b5fd9ccc71401a1dc17c877c5
MD5 a151f3b8c7043825e58af1c0c90ae833
SHA1 66a60bc8b9a22cd79f37f2ca504997e266f04e90
SHA512 15b547288c19731520f66bfa14f4ccab3191be759e29680d4a433552f5807926e75f53fed72450a5bbfc1ea0ff5db8a40c7fc655df70c42766feb6c3093512fd
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHL8:uUEtQevvqc2W1cpV2EI32L8
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 faccc2ba811322d16b979f2b04be8b4a454c7eb147b48f22be360c97f2ce85e1
MD5 a012ab88cf6a0a4ffe999fbdd8c37a94
SHA1 959e5a6b618f76bdc491df781c6f9bcbc0a984f8
SHA512 a5762c238aa639b6166dd21050c52912316655eeaad81d14ad15c58c678b1028c7c46f27bb0923eedcafc7982c3fd9d03658a12453ba67b4584ba30defb62109
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zNlWI7f2Fdj:doqtVjnm0vIdj
TLSH
T198D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d0cb2302d584f6d8e7f02ffeddcae551256cd67aab3cc72f3b125257afb14d1
MD5 8b05ade3af505d8fe86819a9d678930e
SHA1 8e2f64c9229d6802f9ec71e5f8ca4c0234a1ee36
SHA512 bd26d63b0366e3311fd48cc63139c5c6dd52989f0846377cbf05a0e5cbf601f681b90cbc41b17b67e2df0756c960343c7aab49931456500defb02261ec0606fd
SSDEEP 24576:sAhGLJIFoiwtA5l7S53C/KSWITnbD2sKJdj:sAMyFoiq5klWI7f2Fdj
TLSH
T1E835AE81EBF955D4F5B3AAB899B68171EA76BCA55E30D20F1160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b48703a8318b51cf0d9c95f895ebfec3175157d4393aa5370da81c3eb59a1a05
MD5 0dbcec6358393b08dcfa986162bed856
SHA1 65a8965db8ce4dd3129c2e6ff583bdc3bb695702
SHA512 395236523d8312cb0498864f4b39d67cd9bdff91f32a6a4ed448459fd337a385eb22fa0a5414671a650551af187b370363761a5a838c3c3701b480701c1febde
SSDEEP 12288:Smw5HEjsChNVBFgl0WDm+CeAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:LwuoOWd/KSWITnbD2sKJdj
TLSH
T1C765F14667A90CFAE96746398597C136E7F2BC422B20DB1F0360C71B6F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3cc94d78746eabe0577721702ffc168d4b62bddaa869dd6d385493072ef46063
MD5 9d146cbca8c86d54c583078815433144
SHA1 e2a058eb62dc195e56ed1e3e01abd67fa069fde0
SHA512 1a2f719f54df86ebe3d400968bac66076eba2d5ad844314e85bae63cf65ba5e7c1df213e4bb6689d30025ca2e841f0ed6dd00c43894a6dcd0c1a8fbb9d24b436
SSDEEP 12288:KBZ1IyZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:EZuY/KSWITnbD2sKJdj
TLSH
T1B355125A17A920FAE1B706B8D9E58186D7B67892273053CF0271172B2F32EC56D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cda3b2f813004732e27b4fbb3ff7ce6fb7d810f3eb5dcd3fa4c17286cb1c5ac3
MD5 13b4351ad84e61e57983bd52a71fb54f
SHA1 ad9feb6a25a720f7dd83984bbd96f7e42924fce0
SHA512 eede52c6481446e614429dd46ea802db42693efb1bbe4f1e0ac8a2d7329704493bf0d0acfebd8dab87bceef453f28fd9de4ef4e3298a2d5b28cad3e11f8c294b
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:yQRQyi36YOcPQLvw2gAf+PN3tvIdj
TLSH
T129667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9933235e3e699d92c64326ff58761a74fb562b18d28f51d599cd2c516a89ca66
MD5 0fb757bbfeee97db46efff212827cbdc
SHA1 2f334d57c0ccc1de1e4bdf7c64d29652364a7287
SHA512 2f98b8913f2295674dddf2485f4b2fcbfa1599c253bb86b1df376b7e58fb2adf7162f7afde6c9092c5c6104f54b336e22fd75640c5aa9572ffd215fa805de532
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:WQRQyi36YOcPQLvw2gAf+PN3tvIdj
TLSH
T122667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e641a2f18b7f56555b1a67efe04cd9a58f9932fc893d0c259f3663a52c9ed339
MD5 f766aca00600b1cdba1d807b34d188ac
SHA1 ebd0c557dc62f2aee4fa7c392f993cd6e9b70660
SHA512 fd342f592a8543317fd1c1f6f9dfc9e339fc72bc42666f3be3f9601919d6fa9c5d2682426943dd6701a7398ee489eccacb67dd28186f4769f9ce6189ef9ced60
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0I/KSWITnbD2sKJR:+68Qg55nhheWu7PNU3/dlWI7f2Fdj
TLSH
T1B2B54933B2F600A9C45DE1769F4A872196D27C718FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c92ed8755400a1aad35078b35838983f06089c5825a2dce6b85178dc7ef4377
MD5 a94222d4a18bb9279ebc2647559c367f
SHA1 fc682162a27048a26560a8a0627ee9bf5c93a605
SHA512 176fcd2f8a13f4f971d42fa8935508b6141bda3d8f8bf60ae0c106efcba6c0d09432d907c074b1e4a72fb5e442632c1a173bbf7838320760ef96a66458aaa84b
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:qy5112gYy5azzVvL69nLKnhZSvIdj
TLSH
T1AD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5fc054d3cb9c894d7690956e7435586653c18d2b65fbb05d1cd5c5a9d4a5e39f
MD5 ca8e98c47ac8425af986870bb38693c2
SHA1 aa3cc2fb6632989c321edb3f1ab2b8e231a21acb
SHA512 50401a8b6b733bfa14c75c43ba8d3f065fa29edb866bad3337811b4056cf1808ebe17191e0044cdbee7c3dcb8b7450b99a541f60cf1ac280e7aa1fd58bc0ff96
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXlWI7f2Fdj:vu6JmVxd2dVvIdj
TLSH
T16BD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7236e9c15339793bb531f0247647281d86007bfaa4abf99984a9215cb8085d0e
MD5 3e7b4b22aa865827a4910e7358564a91
SHA1 e51bcf002274cd3d7d5cc6bf1f465cc9a428fc2e
SHA512 3f58e314cf4883e3c665eef004ce699f7450ccdf92c38b3f74816e035cf2abbe9d16b75b887fe4f96362b9591d1ffad36d7bc1f0e0e79f50dafe050556f00f83
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xTlWI7f2Fdj:0mifPbR0vIdj
TLSH
T19DB5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4922c225e2c7b10a3ba6325dce574bc11a31e2e8d5aa12708ac2888d090bc68d
MD5 e187e7bacce83a5aace5b8bea3391b65
SHA1 6e9f0b4dd307e4dc9808b90ad43e359aa26a38e2
SHA512 6ed8a18614056f4eeba658a79fe6a309d8b60dfb6300b15623b07e4f600b38b5da64b497a491255c789d30c4785e6f44ad7bfe4cde1ce98a65caee3cd2629ee2
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqmlWI7f2Fdj:e5dKTi61uvIdj
TLSH
T15AC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e6c18e45014f5a58f8e3f29128079a8719310bd4273d1c4a1ea7363d5e289a28
MD5 b5addc34f48a73598f12eb8d19fe7a78
SHA1 d8400f7a302cdf9757a2f47af163f00dc7ea3a3c
SHA512 0b2520e013a21d7ea151aac79720f7ed62bfb0f0ce2911c410276fbc1aee9cae4f0cfc665512db521edc63744caf954fbe7d9ee0834f707bbbd11aaed9ef62e6
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wnlWI7f2Fdj:fX2iyph4vIdj
TLSH
T15195BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 40d25a17dcfe4336e308de5b74e8c8222b8cae8b08d4752589e44183633283c9
MD5 280de9c23ad0363ea8da6878fb5b1198
SHA1 3a605927920730cc7352a902612a768a14020cc7
SHA512 7c0410af0c6a04f3789ae245c8053a61dddac95ae1ec86a1499a0d7b7ec925d2a9aadb069213d78301c806d4cb320aad5f188a2eb7be148692b0bddafd4171de
SSDEEP 12288:S0Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:S0/KSWITnbD2sKJdj
TLSH
T1B54523064F5B48ABE5360EF195DAC0DB87DD7ED23F606A4D43633B1B2278D84642CAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e8cec726ffcd535207d0402453136e6fcf6b8377e9e75c1ac13c448de719cdd4
MD5 bd2354af1f0bac55783e26ae023ddd8c
SHA1 ea296f96c24d061ed7770ebc5ac0dad33b294270
SHA512 8bdea1e9104401e76ec536185ade3d6bdab1a084ce53f9b36262ccc85f711dee337eb5127e8fa03214290c6ec51eaf080e2dee0bba27a92111dba589cd7323b8
SSDEEP 12288:N1Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:N1/KSWITnbD2sKJdj
TLSH
T1304523164F6B08ABE5360AF155DAC0DB87DD7E923F606A4D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a058c3540531013810c7ef876d58e6a43562ed980be72a0c45dcd1914808233b
MD5 0a0c8584730e3d3900cdc8e248da82dd
SHA1 f4f628a2f17fe9fffc38a7a162d0036ab30c1ccf
SHA512 123417fc535aea8ae8ed43828188d73b01c1f06983374d4a6a7dbb2a39f6a624dbd6eeb86b35d7317e7be9edc4c5bc881ec2ba7cc2551f2719c89784dc9455b3
SSDEEP 12288:LbAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Lb/KSWITnbD2sKJdj
TLSH
T17A4523064F6B48ABE5360EF155DAC0D787ED7E923F60694D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ba03dad2c284168ef253a0d9f694e48974c1e0d436a2e4fafc6ee41a2347e9d2
MD5 7761d669cb308b258e3d991b6c72fa78
SHA1 ee8023609c118576733f20b2587c234c633e9d36
SHA512 924b342b00f4c227461444e7098f4114bb60ad7df3e0fa0edb077392e71c11dbabc949c2ab3fe4e5689d7bfa650db31cba17082f3d55235a12f7922623086202
SSDEEP 12288:nViAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:k/KSWITnbD2sKJdj
TLSH
T1EE4523060B6B04DBE4774AB4C5A6C096D7F97DD13B306B9F83622B1B1674AC4683CBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6901117cb87941061d3473b224470bd61000a04480dc3da175b4c335eaaf95c7
MD5 ba7743d17645d9ed12ba9702eef0b8d2
SHA1 65d421b806a87e2af9d5a143b59e4053e65932cc
SHA512 be5f0117f45f1d761b881adaea1ba835f66c12cf6b0ef3db7dac3d31e26640e43a996030f0aa7042e57ebeeb614d1e6b048e997a7a27ade0fa62f3db40c4daf7
SSDEEP 12288:Q6Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Q6/KSWITnbD2sKJdj
TLSH
T1104523064F5B48ABE5360AF155DAC0D787ED7ED23F60695D83633B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c8a8756eec5bd408509327010ecd78d63b4249dd3ea41faf751104d2e5283b4a
MD5 86c41a0d25833f08da08ab9212359a4c
SHA1 fd6f19ea260c1f92959a20d72b7bd2e54ae35013
SHA512 812a202e2f1cb0657ad80054344fab29399b422e82ada12eb4ddb3ffd76f0a00d4c2bc423015904b1fb78a34355b83fd80ce4491816987046fd79e81836791be
SSDEEP 12288:QRAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:QR/KSWITnbD2sKJdj
TLSH
T1CF4523064F6B08ABE5360AF155DAC0DB87DD7E923F606A5D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bc1c6a7a92a45d45e29b733a514cb4f77b14202b715e437a39a45f17d071c42e
MD5 ec375bf38ee488b7291ca2ecf4f03011
SHA1 242b3361bf7a2b8e304316cf3b719d1ff8e4c138
SHA512 93ae471a0b07b34e303d583d85982738d275f58489101e5a37458766c8212214ec8f44ad3dd21582c0dcf7e7132bcfaf02b239f391490ffa80f813c746a45809
SSDEEP 12288:ONAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ON/KSWITnbD2sKJdj
TLSH
T1024523164F5B08ABE5360AF155D9C0DA87ED7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7aa435bb9c05b0fd173a04897f392046d30e01964a61500b77854f21417bb208
MD5 7ff2f5d98e06abbf8c77576caae23bd3
SHA1 a9020447013a1124ae9d4b7f4217b8f0c7f31442
SHA512 e5f269d18201e5eb20bc992dd7dd56ca1b1df8fedaa1bc50141099807ca5fc807d1f5531f3ecd3cbfebc5ee705454f8b7f35d3dfd51c4cace9f8e99fe1e80462
SSDEEP 12288:WiZwb6zzFEoS2cPvyVAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ZZMSzFVSOV/KSWITnbD2sKJdj
TLSH
T18765F195B3A018F9EC67827EC9658946D6B27C561B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 42ee6cb9a1431a77a6d5637add7793c4e80f116281c25559492a9d834a44a630
MD5 3a4cc0b7510d9399dcfae4a38c84433f
SHA1 cd433b833f0f993fc17c0715dd4148b1af7d89d2
SHA512 06d2f721327be5d803b195094a742aef4815e99df7d597d8210c30d97da282d63e021bdf3de3ab72594e63222abe7c7657bc877df6d31d6fdf2bb2662e459246
SSDEEP 12288:loAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:lo/KSWITnbD2sKJdj
TLSH
T1F64523064B6B08ABE5360AF555DAC0D787DD7ED23F606A4D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c173d76d5ae3458bc9b147fa6b785e4eb7730340310d02806c75354453ef185f
MD5 67a4cb0d8bafdad6041b9f7cce777cb0
SHA1 6a7b6c0203c6872f12277d0b744272c4d0e92e2a
SHA512 c9139aa047801bf42a716e68a8e22252b843f7529c57b2c59ce99bbf100c7582984a160e153347ffcc3d926de9ee1fddf92e07d356e5f708ec50edfae9db0562
SSDEEP 12288:Q8Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Q8/KSWITnbD2sKJdj
TLSH
T1F54523064F5B08ABE5360AF555DAC0DB87DD7E923F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0e29dc03bcb9fb8a783c638a1270172c20d240d3c58d2259f939c72d4849c43b
MD5 d3c6556c20119a00de071dac8b514ea7
SHA1 824749ffd856ce17d8d82dbb7bf8ce3c34d149ff
SHA512 70370fc0cc838c7fb2d1df130c45b0bf5f090c670bee6da27a6fc9b2c17d1688f08ae74b4fe61f90ffb06c1373216473eeda40080c61ad54f0c63c7c7229502f
SSDEEP 12288:gyPz5L8ZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:RzyZ/KSWITnbD2sKJdj
TLSH
T19455020767A630FAD1374679C8A64546E7B678721B209A9F43A0173B2F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8f8f6952fa9af8865f06ff436b35473b66eb2d7c86801a9a5f9ba05144a97ceb
MD5 8e6950d810cb7a6ba16ae8d48c521a2e
SHA1 c2547a1b3352bf931eae026cbc3b8dd6d3732fcb
SHA512 adb657ba975ffcb24ef133cf3a42472606c3c357af0777c8a82a21b6172ecc256c7764de754d19eb59ef5f74ebef1494f0756a0ab88f7867ac2cc11211c16e4e
SSDEEP 12288:koAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ko/KSWITnbD2sKJdj
TLSH
T1BC4523064F5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f297f2da42c89905c95302ec4a5ed73e74d0759abaf1aed0659b6dadd7df0308
MD5 fd6924197cd2ce58dc1757cccad5af72
SHA1 9e59b041ef3847321a2bdecf59c6b4ed33f151a2
SHA512 2aa8d3e0acba9feb2e9ea37a210d417f56ca4227651e5475c9cce7272250d354b878995ffef58ee2289cf95b2d3dfc146aabbe4c2c6c025fa888d68cd23e4bb3
SSDEEP 12288:loAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:lo/KSWITnbD2sKJdj
TLSH
T1194523064F5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ede3fc18cef127d67563da923ab5be22a838cf0fdf3c4dd2e575137547631bfe
MD5 1798ce89a84716507e75816c6d4f01b9
SHA1 233b20286e1ad480de222a174a418981fd4b3800
SHA512 ff66a073bef425029eef182a768508875092e37a54cd7009afca3cc6642b8d28c5ef463cab0bdf5ccc5285c2b6cc30896686499d52b4facf57cc5e3b530616fb
SSDEEP 12288:zyPz5L8ZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:+zyZ/KSWITnbD2sKJdj
TLSH
T1CC55020767A630FAD1374679C8A64546E7B678721B209A9F43A0173B2F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c3c1b53b8c8ca1a6ca1ffb6a67c52ed9074761d52453310e87df0914422a3ebf
MD5 75449f618963b99d6a0c3ed363146a72
SHA1 c82fb3caabd30615715a12e10e1cff70cf58b116
SHA512 67579770fe0b82c985687086248af12261c34ab547cfa6bf450c0f949751e80692179070ea75f98be9c104c9e2a89b948133e23ecf5772e017c9f3d529909a96
SSDEEP 12288:bCd9eWYoaLHF3z0z04PDvhLAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:WTHaLl3z0zDL/KSWITnbD2sKJdj
TLSH
T1F765F195B39018F9EC67867EC9668946D6B27C560B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c05f50c8a42c7336a286c46e3d82df640184b6ff21516b94da2146c39956f1c1
MD5 8517f74ea6c0055e838e98e9f286e655
SHA1 5a6bf2328e6e609f5dda47561b0872002441fefe
SHA512 78655d559cc0e32a972d4740e1de69dcce494f1e92cf981fd770d054b814366137749ff5681e12772ab0fee921863d02c173f9dc0e5dbe2987b53ed8993a0d18
SSDEEP 12288:Wi4e7+RdTfgwCHKy7GLbbdIv2Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:W37d9CHKy7GZH/KSWITnbD2sKJdj
TLSH
T13075CF90E3E414E9F0B79A7589764512DAB67C591B31DE8F03A4261A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 92a02c08bec0ddfca06ba1fb714e2ce6cbea50358632c59ec3d2e873f212a662
MD5 d899d18f12e3482c37c569ba85068ca4
SHA1 8aac844f8e4acaede4ffe557a15db6d0a8a38b72
SHA512 87ade94411464a84239f04d2dd9724e5c2425715fdff40ceb4a9049ac8eacf3461e3517112c10a68d8c59b65d591e1cd2877f134bcf813cdab561fbcc9e16b4f
SSDEEP 12288:37Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:37/KSWITnbD2sKJdj
TLSH
T10E4523064F6B48ABE5360EF1959AC0D787DD7ED23F606A4D83633B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6207f680a84e58c7d4a60de84a98691b0abe2582e78d69a35b1678113362bff3
MD5 6beb2f2d9b6e187a5c95b651f7534c2f
SHA1 e0b7b072f55e7509030b994395a187d957497d6f
SHA512 d7cb6710850e4d2d8583e0b146df7ddf819a08ca00e3cdd95208e330242e79da52f4f12ef8a172235472d007add89e55ede55bbca38bcc55beb9057a6d6621a7
SSDEEP 12288:R5Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:R5/KSWITnbD2sKJdj
TLSH
T1CF4523164F6B08ABE5360AF155DAC0D787DD7E923F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0914ef3330bb41373626a0bc50d36362500e213912778900ee33b1bf0181b4d6
MD5 8de40450bdab31d25d7a762f38523a53
SHA1 e164f968f9a52a491d90bf0801c86532a9cefc83
SHA512 80b42f06af8452e38c57601a12aabe40dc989249b43031a450fcd25059162e39132f408a8ad47a5b5366ce66cc90e23f8b341b69799d61472b86dcc150c9e500
SSDEEP 12288:e2Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:e2/KSWITnbD2sKJdj
TLSH
T1134523064F5B08ABE5360AF555DAC0DB87DD7ED23F506A4D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 041d1dc8a8bd35eee5beab70599fe5e9c059a4fedfca98b017353c356209f62a
MD5 07155d5e9943eaaedbd686c06ae6ff88
SHA1 792ef3bcb332eb1b9b425c3e81e6183c3cbb0bed
SHA512 c82e802f11bce1635ed89a390af27e99061c78354c7e6054fbd03c46d4cbeeb39a1672200fe7333de3876e2f2acbe27acfc4aa75d00b49440a18d89e6d607f10
SSDEEP 12288:yoAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:yo/KSWITnbD2sKJdj
TLSH
T1994523064F5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83633B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5beda8a044439a7623d45ef139c9f7898bad4eaaf3a103ab87c708d88228ffdd
MD5 b0304000b095acbcd60c8d044ea19fab
SHA1 b1754581ed542dc6ae284658b4fe7cd26afbc4d7
SHA512 68c805cff3803e2211d59d59fbe98434f7b280c1f0721bf9729fb2fd438e35e176ea6086c0a1932d9c3d8bb485541d51b8b439ad0cfeb989d35809e922ef8bdb
SSDEEP 12288:37Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:37/KSWITnbD2sKJdj
TLSH
T1F94523064F6B08ABE5360EF555DAC0D787ED7ED23F606A4D83633B1B2274D84642CAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3b997bfeab35a207763e13e12ae8f55f8babf2a1849d26c04e0416bd99c79460
MD5 0c698b26b82147ce2e9df5d7d72b1aad
SHA1 f07c6ac7a2eab75e353ebe447254d193fac9e61c
SHA512 6025af96380a3dd8fff1319c945b130f45608ef27dc201c5e1e022d58076ae4f31b83547b6f1e8b4340f76a82d26d4cb2c89340f3f742d8b2b7dea33d2c066d6
SSDEEP 12288:hAAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:hA/KSWITnbD2sKJdj
TLSH
T1AF4523064F5B08ABE5360AF555DAC0D78BDD7ED23B606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c235dfcd9073ad1a2048fcfd3f2909b077a40efe2d74815e86147b2363c50a89
MD5 9bdccd62307f0e4e6b726b3ed50c6001
SHA1 e219be2d0f747ba650441ddcecd49c847cdfc5bb
SHA512 29c064b90b5710651ead9343774de36a29c4c568af38c08aff5fd84eb0320a6ce6f4b7d152fec7169204efecc3bb82b521faa0bb5b1bc2dc3940262eec7230c5
SSDEEP 12288:1fwvD5uX64Lk3tRX69qkyAI5OAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:1fwvok9RX6wkyAIM/KSWITnbD2sKJdj
TLSH
T18C85D029DBDC04E6E177923C89B7460AF6B178691B31C6CF029A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cadfa5a928d5d45cf82cf1b3e4b3de1d20e89eedd70f4f9480a3205387ed5943
MD5 956597739b024365e9c08cf315fa2945
SHA1 a29e14619d524e742167118ef61161ae405b3299
SHA512 ef97b20c8d49041f10b9aac4e52f5b5363aa684a8810c87cd9a66cb5b94b6e9c281490bb775646076446729788a9d1ec225ff1d0acc09a842e30b9bac438c0cb
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HlWI7f2Fdj:hySzPNvIdj
TLSH
T1D1066C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2a928fc6c774e792ab30a308659e075929be8f6f1af7727107d79d622e234412
MD5 a139418309524ed60264daf53ab31881
SHA1 ff699806638d460a00e0c942f2f73600503bc620
SHA512 5cab5cf0130d5436c3e0f01d3ee3ef0332efc41ba2cdc111d35d70804da4aa733a8a10f598d902d3e0bf2ca4a1ab767c872c9747b925dd30791db33924ec98be
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYl/KSWITnbD2sKJdj:t47JUQj1irIhCnDHUPfF/XlWI7f2Fdj
TLSH
T18E65AE1EA3EC01E5E1BA827885558A5AEA71742E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a6e185f24437ed64510c2b72f74c6cd661b7acfdac38804bbbc4212a977ea598
MD5 fd740944eee260986a1b284d7b126dad
SHA1 5b4aa472a66a8c5bc7d0c93ce4d6532a6c5969a5
SHA512 b1dd6066e65161105f5ba8733b8245400021bfc1c9251b2d8c5021ab149d01f682e7319d8fea1c8e36b53c568f936c5f25098cab39df36c044b557c25ddf8b07
SSDEEP 12288:gNsfYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:BY/KSWITnbD2sKJdj
TLSH
T1B055F00AC39801E9C06E12B5C7968682B3677C6157E0D3CB53D1FA3E1F75A80ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bfe6fc414fb797c6e0b19cd7bdaea8832822c1a8fb306e7928e84a49bf072368
MD5 0b4180cb40759509c71317c131bc51d8
SHA1 c4ce90f183646d800b103a4a07a1807c3c781380
SHA512 a76c70663679b5c4d7ddfd3d288095cc5757867dd7a717751b8de2f2541aa741a6987e85d8a5e94d7137036f41fdf44bb94ed1a539c3cbf24c7a827c8f700e47
SSDEEP 12288:0CBkoU3f0Q+RzJfrInurmJPGS6fuoiHFg2NTn33:0CBdUP0xzuvitilg2NTH
TLSH
T1CB351840766BC75FC69984321E32D1CCAB707D01EE05AF0773C8873E9576669BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c3c22ac79d0a128ce0a5aa799e59a713d28b714be6278941b89b0e97252fd8bf
MD5 754039c631db12f06cd5b9d6ca666531
SHA1 19448501b5c3b437371dcf4059c6b9657c5653d4
SHA512 ce399f68045a155caab30671566e6ab8846840c0fbd0f21d627c0ebff3cd2196d06f635b099f8d064d792f878f0f9c89e372ad7a9fb47f0e6815721d4a9c67d5
SSDEEP 12288:jOEcEdCUIg9nuVlyn48gjApRlduQ7Y/yjV9ujvQ8f:jVHdCUIqjVUjvQ8f
TLSH
T12A75FA816137D38FC1FB503203265B8CAB64AC16B7496F26B7C84539D86BB25A1BD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\Temp\0b8e32e5-3b54-4170-af7e-25c83beeb8e4\sciter.dll
Size 6.6MB
SHA256 4ab5ec0a963da4fd1f88d0b9d2871fdc5890b277cfcb122889e46c0ce5831869
MD5 f472455593df1dc109cc29aea76a10fc
SHA1 9ba216f825b6e190d992da4c8893645b04b24cb7
SHA512 80078369c0b6ec6efd3013acc1f53a310ee70f0d5a8d2efd4fa27abc28d55172b7401c78b11ebf46f5b9d13eec4ee57d6833f66cd8d791e106ab3f7cbceada12
SSDEEP 98304:orEyG1dejlANJUNrmf6tATeQaazZaTSG2TeXeMDQp33/TzBrqNn:hERYJU0kATeQaazZaT72TeOM47zBrqN
TLSH
T15466AE327691C47DC02E0270794DF7AEC2FAEEB00AB1429B6BE43E5D6E345D06729572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 45931fb6756523ac9b1a958af7f58f572b708adfd9a5c114fddce5ef3436e738
MD5 2cc3be70e6201bb68caca2444e4dcfb2
SHA1 3117733edb9a79820ae9c12a5a2c5b5f193e9b77
SHA512 b747de9cd8f3dfb029916e4de4d3e9be990de9c2c61767ada435a60c67502732478ea145cf0ef132b27dd58ad0cf208b1ee422922af0a3dfd15d3d4bde466269
SSDEEP 12288:BM7wAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:aw/KSWITnbD2sKJdj
TLSH
T1824523124B5E5C9BF5370AF055DEC0A6579E7EA12F1099CF92223B1B2174DC4AC3CBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 442576cb3c634ee97d44ea1a925648059b58cf06c5588eaffdc875dbacf942d4
MD5 626c2274e6903970922bc39c95de1e51
SHA1 b5ed28cbd190df97ba83aaccf837c7ca5d3c685a
SHA512 8952c7dad3a08fd4e08a5bf2a89187c3a4285e8b48e0675a76e885600babc7629a3d2b79cffda1b81e9e2157d5d2e138512342882df45bd9c1455bdff8f588c6
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bY+/KSWITnbD2sKJdj:Kgb4mBIBhGFRlWI7f2Fdj
TLSH
T14E659E1E22EC01F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d29d26c9d77c5d4ca159216d313194c78b712c66cf24d38c2c02c2b0930b0136
MD5 231df31978d372a905a94edb607cc6ef
SHA1 3060af9a932d061c3e5d88078ea9bd8cc656bb4a
SHA512 c7ab2d116aa1dca7bf33bf7c9f5735f071d28abd3bec88a8bc47b5af83efe8e41bdeb3cb0a6fd43c26ea4d1aba7e417ad059b0eeef8f15544a8535d09e45f9c2
SSDEEP 24576:NG88u8FpJqH1bzria7/mV/KSWITnbD2sKJdj:A7ZFPqVea7/QlWI7f2Fdj
TLSH
T19385F16567E101F5D47BD138898646A3F6B2B8211360EFDF07A88B561F33AD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2d8eb233fbaff77197a53b140d2159c7ec6329d9cc9cc614da41cb8f90a7bea6
MD5 b7fd40d5257e0e8efd12ddd2d94c23bf
SHA1 c23d37dcbb7e561f4faeb1b3d16eca3a1eb3084d
SHA512 8800e73b43aead89442c6656392f194ec076890ffc40686d61e52c06437a3017261ebd42b36864fb72b262db8cc7be1bd18ea5de2d5b336347d4f15f2945c8ff
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjllWI7f2Fdj:EG05lO43bKvIdj
TLSH
T122D5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e4f26c021d7283dcf54421384227c98dd983e711b17a2eee2c5d1ef082279acb
MD5 42a28862ab1eda5a7afab234d8c386db
SHA1 e140f02dad5c404cbd724b47a20833121f335d13
SHA512 21d1c95cb0018f3d148ee3a1d2a021de4c0bc8e7977654cd87ef1ddf97dc5d7920e4efb5bc5687322ffa412728ec1c08a31865b31d67e3be6d25d50abdcbcc02
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn//KSWITnbD2sKJdj:za5POZ3+Jt2pasx2+mdlWI7f2Fdj
TLSH
T14165AE5EA7FC00D5D5B9D17DC583861AE5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1e097a6dba45fdc1c534b293151702bc547fbb4c9182266a255c9f42c5dea0f3
MD5 b3588a52bbf4eb15eeffd535267fd57a
SHA1 687738f165c44f834f7b0f108e27ea28cc7fdc26
SHA512 9a833832143f78a8c9df72fbfaf25e47e5540f7d9fb60662d956a391898788df2ebe5912a4aac95cb7650f9ca36f36f7cc75a4eaf3a381951f8dd23894031df3
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fk9/KSWITnbD2sKJdj:oNc/zEOVHFwlWI7f2Fdj
TLSH
T1AD858C1623E901E4F1BBE1BE89779546FAB1786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5c55bf18c39623b9bbbc7a1e43ee5dc0ff4b6653a383c353cfc7e530e944534c
MD5 fe70b92f2263d37934f99f3391ebddd1
SHA1 f518ef3b2834d29e4be6ae0e283ae5a4a6817b26
SHA512 80ead84226fd11acd9f13438fa56d0bf5afb8d1b40bc25b18375fc2396322dddb016b27691bf9b6b6cfbc9ce12dc3d020441b5ec23dc246f438ff3fe865251e3
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmj/KSWITnbD2sKJdj:b8MwBtOmDlWI7f2Fdj
TLSH
T1B755AF2EABB845E4D1FEC6B48D238512EA727861173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d271370eef3a750ccf03553f11c8959c8623bc81a860e1176ff56da4a20e73b6
MD5 75563ed11560c03cacfd53871f888a09
SHA1 18a3e84ddaffca33e6f81b3d0f22f54184e760a8
SHA512 6cb522a5477cf84d8da9121e6aa735ab68a016ae3342e7a423dfe5a2dbe2b29639be3397e6913ea223be7062a93fbc96329b38ae0fc32b86da06f53a2a10eab5
SSDEEP 12288:IHvUrBFrEjwaQhAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:IPUr+NQh/KSWITnbD2sKJdj
TLSH
T1D165E12F17AD1CE5E676A17D85868619E771B862171192CF02E1823F0B77ED8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2c89cfaaa2684849677efc7cba11bcdfa9c2d8dd2ee740ca1d0a459264733b78
MD5 fe5c6eed4eaed6ef35ae89df7e6b7bda
SHA1 f59a00394367659216a666d2c8c08c8d6b28ff9e
SHA512 fbe4e4342b6e3b9596ee300d1eb4d7ce26a1b038c3d4cf45ba4f0b495e68ef7c5fcd879e4c33944e61d8b485efa664d8bdb84dcf65d70cce40b387372672f9de
SSDEEP 12288:jQcMxWDXN1Dp/fshBItT1IQgAUAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0B:zD3FHshBIYQgAU/KSWITnbD2sKJdj
TLSH
T1D975E13EDB9D04E5E47BC1BC9AA38506E7B138A9032166CB0290917A1F6BED47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2104-182-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2104-63-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2144-85-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2144-287-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2144-84-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2144-90-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2864-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2864-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2864-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2864-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3080-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3080-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3080-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3080-334-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3080-101-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3080-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3104-266-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3104-79-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3104-80-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3104-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3480-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3480-114-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3480-318-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3480-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3480-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3480-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3748-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3748-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3748-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3748-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3760-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3760-121-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3760-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3760-321-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3860-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3860-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3860-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3860-141-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3860-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4260-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4260-48-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4260-44-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4260-38-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4260-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5424-8-0x0000000000400000-0x0000000000DBB000-memory.dmp

Download

memory/5424-78-0x0000000000400000-0x0000000000DBB000-memory.dmp

Download

memory/5424-0-0x0000000002B90000-0x0000000002BF7000-memory.dmp

Download

memory/5424-5-0x0000000002B90000-0x0000000002BF7000-memory.dmp

Download

memory/6092-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6092-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6092-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6092-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6092-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download