6095a0196c450bc3bbda0d116c48ab150fc29eaf2531152daaacd9ed81910878

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Size 4.2MB
Sample260929-3ccseaygmf
SHA256 6095a0196c450bc3bbda0d116c48ab150fc29eaf2531152daaacd9ed81910878
MD5 65e91b6d2ee9bc211d094bf4c84795b2
SHA1 af151b66e8143acd63e51975e3bd5be61ceed06c
SHA512 3cd72e44b161bb772757a710b1ff3437ae5607f3e8991cfb0ab84641a751993833ea57f11cd16498a8721289395ef4a2d81a4d4b1ce79ff53ab33d135d17d372
SSDEEP 49152:L08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJX69emEPGKOPkQThMYRMnm7LB7:L08vdsGaQNgS1+6e6ngKpqkLm
TLSH
T10B16CF12BA828472F5930271997EAB7B48BDFA304B3595D7D3D41A1E5D301E23B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4504	elevation_service.exe
3800	elevation_service.exe
3444	maintenanceservice.exe
2940	OSE.EXE
5096	PerceptionSimulationService.exe
1740	perfhost.exe
4356	ReFsDedupSvc.exe
1280	SensorDataService.exe
4992	ssh-agent.exe
2036	AgentService.exe
6076	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8d3ffc017465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5eecc556950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc341a996950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cd36e996950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfc4cf576950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007845bd556950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060b62a556950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4504	elevation_service.exe
4504	elevation_service.exe
4504	elevation_service.exe
4504	elevation_service.exe
4504	elevation_service.exe
4504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeAssignPrimaryTokenPrivilege	2036	AgentService.exe
Token: 33	6076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6076	SearchIndexer.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4356	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	5264	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	4504	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 5636	6076	SearchIndexer.exe	100
PID 6076 wrote to memory of 5112	6076	SearchIndexer.exe	101
PID 6076 wrote to memory of 5320	6076	SearchIndexer.exe	102
PID 6076 wrote to memory of 1716	6076	SearchIndexer.exe	103
PID 6076 wrote to memory of 5164	6076	SearchIndexer.exe	105
PID 6076 wrote to memory of 4296	6076	SearchIndexer.exe	106
PID 6076 wrote to memory of 4376	6076	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1f32bc43e9ba9e1a082a5e1b9a0f03441daf78380b010d4789c315fb285caef8
MD5 b53aa20bdc0b0953acceff5b371fa4eb
SHA1 ed2adb5ac62441323b7f12008db707d08c0602fb
SHA512 345f203c933af4952aca4f4432eed8a30ff61baa9edca887389857a1b583b1f628c3c0e1157754af12e87c2e19bfd0da08728e0b624894b36ce5eba01eac4b1c
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHQ/lFTjN4:L3q6HjBzLm
TLSH
T1C6D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2836e5e4bafa2ce9d4eebaa71bf2aee0d53ac7bd396e22d87dbe5b452d7729cd
MD5 4f3c9ee610da9560f08547765f94f96a
SHA1 da0efcf0dc8943dcc07e9319449b8f26fa0fc493
SHA512 6c7603388f4960bdc855abfea8b28df2da778052019c85c46a8ff3ac30388e018fee459d9269202ff44b468433a1c64188977e5c11016dea2f766ff069e675ea
SSDEEP 12288:f1XLsswWkxy2lRq2czAUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:dXYfDtczA0nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 feea0148f0f95dc318ce608bccd2d4b5e448924c4a2ba3284f39d211cffe3946
MD5 68f6167680233201f2823c013f890d31
SHA1 a0b96b18f6956e071b385b84dcbf6b8eea4b9d37
SHA512 1d828adb2c42382bae2c0d86f6aa6aaa2fc1c1bf8d27d1a920b01166ce41466220576386f38345b0f8c4874033eb5998db2fedbda561f682f8a2e81b988f466a
SSDEEP 24576:G0Le5ji0hmxLrM/nQ/tbw/2Mkjy6Fr7g0o6:GPji0Al+Q/lFTjN4
TLSH
T1ED859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6c4f0f51d9ecbfbff9ab013f89b4113498b851ec1f6e375e033342d6700a85a2
MD5 62d115d08f77a4187a5541ec234a91fa
SHA1 78f7443004e769a5ab616c5c3869a5be19b7f3b1
SHA512 33409410527eb6b9f5771fa033a48a18ab885e07592cbc8b49c7dc5b571b29a97614018ec2096dd7e0723a9428890db05f87fb8266a6e03cfb26db24d66dd089
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuFnQ/tbw/2Mkjy6Fr7g0oy:S/ezSC6vUzPvxHjySQ/lFTjN4
TLSH
T1DB755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e6f104d568d9621f3bd15faff03856c2fa25f99f147e251dbe17d21442c74de9
MD5 2246fb0364cf02683da530613ec0726e
SHA1 bc9da8159b7b3925b21b4b7a56a3be0ab2417263
SHA512 7113af6b8bf902d678c7c2ff80c0825fc81515b423a5c5e35d3696c98e89ec45cb7ca98e8cd603177e41ad633449b99c7020cbcc81a7b5d5c5bbd1da7a0113a8
SSDEEP 24576:DVbqPb88hv/l+6wnQ/tbw/2Mkjy6Fr7g0od:DVO88hXl+DQ/lFTjN4
TLSH
T123559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 84271e3a64ead8a8dfb0287b5a48af03865b97297467843e09ca9cb2db863018
MD5 75be8960155301a059b55affea05dcc5
SHA1 c493418643a13c3ade21430f5203c4a502002a65
SHA512 db3e565cd5d817590a84767cce79cede9cde9ce0e031254507a3aff7a2ed24219605d7f4ce7acdd84d20d4fa04f14190bac2dd4dbb2a08d34027be62ff3bc534
SSDEEP 12288:nz7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:nzrnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C15523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 590aacab4da38431a2b5c797af6c898a4c8b143359bbe95148de20bf1f292802
MD5 c33cc3c6879ae8280150e7fc70a07450
SHA1 9c93ca1e9bc3ee55102c0eac37e056ba4801471c
SHA512 292ddd0804a873e041eaf9c921dcd92cfc2584891954b0a99179281762522aee1f2e0ccb12604bddedd1fb8648498912813f64d40411843df5de0b80b44dd73b
SSDEEP 12288:0eBNUbTVO86UIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:0JIUInQ/tbw/2Mkjy6Fr7g0oA
TLSH
T15F75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5fea2147424ac2cb59a86c51f751335017901ac6dea32d0cbce1541b29e804d8
MD5 dfd42dab688b75c443e24eca7af96c0c
SHA1 bb8954d59cbb7016dea3adb023dd179261e673d8
SHA512 7c2ae6e0166a31d15e2a939b6d018f6ae160d0c890d28c16f2dffb9069297977340f5942e4ee0804cc17e64b4a21326639a2c66a03555f5532b696b4a6664a0f
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:xQvGAdlCEL8c/yRNw5C6Lm
TLSH
T142267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 72574165b7c35a2a8f2771095ce556ea904269b4b52ffb60762adcdd0f961219
MD5 7dccd8d29bb22f8e94beeb059947bfb3
SHA1 eef9f47f4a4429b8c53db934408caaa9fb6dbf8a
SHA512 49ff5d9ecd3176c1e3487e29e35e4e4bdb7c230f527695078bf179d8489bfa68726c63f3a1eb170aa42571af9a30de45ab093e9c8ea1f767e897b686596f2c21
SSDEEP 12288:eAwSfxL/2Dc39DLLmt0LDQewsAjOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:DQewsAjOnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T18D75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f417c979f6df3d619463efc65182b2fb91d547d01e5be7723eb3faf5fba0f92d
MD5 080fe24a26a69ac2b88b52eff1dbe19a
SHA1 eb409200f1dd8008a00bb66e9c2325db0567d336
SHA512 98d41c6a00e31d340e7e2f5a27d54f5dea68e03d209d9b1d48d1dec662b9f3fd1251e060346e79cad6ab573c9304e146bb9cd466222d7a7fa96c4154aed40798
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhL:MUEtQevvqc2W1cpV2EI32
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4cb7e9c95db3da519d901611c43949af06c5b77d17809d23f91bd71a602a7240
MD5 6738427731b22d199271ecf798c5b4ec
SHA1 712d4dfd63947c8b088ef2b8f90a1c0e88ef8ef4
SHA512 c31cd89206834ea785ca0ef8a68c51465f6c5f2f4a275e024044ce8ccc55726c430cb7a254a098204d860e48075dfeeb39f8770a5aa68c1127dc0a96cb73d198
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zuQ/lFTjN4:KoqtVjnmuLm
TLSH
T198D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bccda71c8d9ca272a567f673aecd7b7ae0602575aa7eaa092da67e12facb8d87
MD5 c4f2695583bcefc15feeacda8dca2ffb
SHA1 575e7a1047e60581ede6ac59f07cd748dda0185a
SHA512 d55f95b13099bade935701054d7718bcc0a81d263e3a4a57aef6c48c8f42c9063183dae718888e9c7845e929ee6a74ff66c7590bedcf1e498d8da5b161d4bd66
SSDEEP 24576:QAhGLJIFoiwtA5l7S53ZnQ/tbw/2Mkjy6Fr7g0oW:QAMyFoiq5JQ/lFTjN4
TLSH
T1D535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b7ee7899613e647f7d7cfb2ef35cf06baf75bd8c34e907d7ccf474bfa6d193dd
MD5 ba5c26bb6ffae7b55db4caef899140a6
SHA1 d408e227656d14415980703c7d49d1e4ae82093f
SHA512 d1110e29b652b3575fd3d3251bdf951887c7ba45b5a04e09bb3a5ef6dc44081ce138666025bd1bd675f1f12e5da468432875f8ff526fbb3736a43ee20328d4b6
SSDEEP 12288:Umw5HEjsChN2BFgl0WDm+CFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMz:RwuHOWynQ/tbw/2Mkjy6Fr7g0oS
TLSH
T19965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ed76a24e85f01c9dffd451e28881d8f898073f4f4a15d9e603dd8d3c0c556a5
MD5 dd08afceedeebe4aba577c864d3d5fde
SHA1 e6a239049a929e334dc3f43920f46543fa38cb3f
SHA512 145128dab39b1609652c29f6821d5577ac491f4e0850d9e9a4bf6a7853f0e80214cc5e79e9179eed6dd7d0fab70fe828895d6d17af4575e936ac6ee7444c087b
SSDEEP 12288:xXZ1IyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:5ZuXnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1A455126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 36c2b7891ed168c51af0891141426bdfcfe5e03b39e2261bb087a5041f4ddf75
MD5 8df72d4d20dd2d644d97c6450d333b60
SHA1 1d3691ca9c0b4ec693c5f218760bba2fd991e416
SHA512 39369c10c571c544d982436c05ac52e909462e547278ceaed9ee40a215e02088dab46d333960451ea45c94ee5080991ab854e375a3ad46e564ac708017b9f7ef
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:WQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T1DD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 abfdacd66a6a2c5aba99dea29e66402e7d19d959b166cb874f3c5e86136f8e84
MD5 959c0e5198b0f29dc6f08b5105a42d5b
SHA1 c08fca7f51cf38d38a7ba25d2a7d39f643099df6
SHA512 0fec6a14e7a49b82e5a8556bf572d4c5121f7bc36883a3e3374421066d13a8598829a0c811404b782894d62ac2cc611a8258130f069838b30bae006faa78add4
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:FQRQyi36YOcPQLvw2gAf+PN3vLm
TLSH
T105666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bbbe0d7ba52194a4ee09a49129d926039b2ed3e5c05e306a8683bf5a192b3681
MD5 891376730af11cc3eec22e44729c0c9e
SHA1 3f85d325eca17c38f579f7dbd5699e2c2b699df2
SHA512 fb2a8961415ff489ee1af68e1dba8d4c2b130ef6e8b17a2fa78857c3eb7233657c311566e7c2d343c391710f29b2a4c4a7075d00a6f7c14dd2de1420f35ac845
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HnQ/tbw/2Mkjy66:l68Qg55nhheWu7PNU3/+Q/lFTjN4
TLSH
T1F8B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 06c7f494048bf00d5e34dc3002fedf3105fa03e9a4646e2b8b3eaa85815aa557
MD5 01448697840b65d542d08c5184ecd73b
SHA1 64e73286998330fb6b2cd1b8f5973521bd28c57b
SHA512 6a78e5308cf427b47d4de9f792dd8d6a93ebce567c93813978d72ce52fc5ed63e9010d0d242bbd2d0d0259321cdf13ef20fa5b432afa1fd1e5c7403eef2fc719
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:Fy5112gYy5azzVvL69nLKnhZgLm
TLSH
T1F5167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e3b972107e6b3f8515e39cbc55a1689b288d468be14a10f387d0906fc3f9b9a1
MD5 db804c3b663408a219ccbd1df4bbd73e
SHA1 1459c0ef9e80c6963bd452ce364ab7b461ceda6c
SHA512 3605c9150dbdc563cf8d676c84e2cd7978ef5b85f0e04be277dd45f93463d86e11961eeb62f217269decd3be27644a3941442122316f2f9d808eb00d687fb1e0
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkQ/lFTjN4:cu6JmVxd2dXLm
TLSH
T105D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad58e30b2e170904ca62856a5db5c006c17fcdc16bdba78c935720bd19166847
MD5 1258a158c3d22bb58e2c5ea48d9b1d9d
SHA1 a02958cdaa87214999d95ae5beb569e59b54790b
SHA512 0f28c3f0b38fefe0a2ef64992e632274653072349280609b491ff03aaa69fd19c6ad0104657782d469e954dd6d48195dc70a6c5a9745926b87bf1a7d220635a5
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xoQ/lFTjN4:PmifPbRuLm
TLSH
T147B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 678b8d86c5a801f0ec8f3fc48b25bcd2e9ae7f481d40e8a66200a5b2efb72704
MD5 9074437b29bfe1176d04e997eac36103
SHA1 3b5441a449ef179c8eee61d6db5978b021ca2dfc
SHA512 865c57c622d780a63044845919d77fe6ac68639b6fb17f7ea25ec5bf4ec8566c6f3318ab2821b910826f5a4e25566a777d8a851c405334c3035a31fe02bc2b0b
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqXQ/lFTjN4:U5dKTi618Lm
TLSH
T15AC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d51bb62f205bf880310f5c8643459f40351778dc9e5595ed0d1931882af57cb
MD5 717a94a4d01959a44812a47981671075
SHA1 460e563c028bcc27c7a0503a264451953c95ca59
SHA512 12924e49975e44dbdd4109edd9b33dee10eeb2615aa9103c7fb10e88aafbb0108c9211ad98013ef6c3e9ab7d3b90f9d7c83c67e24e573150654ff4886b29f600
SSDEEP 49152:9htSn8EApI0figngiDn0AP5w0Q/lFTjN4:sX2iyphSLm
TLSH
T1CC95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bbf17b952c21ec84fc8499890b03f192771837da23758c158d2637a2ce72a840
MD5 e707d465524ca4f70de8635c1bef4d60
SHA1 2f6ed67fe9f7ff836b13f439bcf03f797806d204
SHA512 3a057f5402afd174b77fb26216c04e3701351ff04221b533462e7ab2f0e2ddbd0cc6abfffb62eedddbaf17f728f9143dbc53b808f64fb486b2c7963ff64aef09
SSDEEP 12288:9TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:9DnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1505523697964F98BFB1706F188828182973F0EC6BFD1938F77482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 06cd56e5bf447948aa1dbc5cc85d472c4bb7ec1969d0fa747b67c0926de5c7fb
MD5 9b64642863e7ffd2a4dd298969be64a8
SHA1 050cd17c1403216c0054e0d59737583be515156a
SHA512 b46302e288293087af72a70a6c8b0ff5d07d224e3d076277b27d814c86b8d981c4ec3986388e2ed982c715799c70298869cf39b6bf2d7d169ac05dea8b68bd0a
SSDEEP 12288:+6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:+6nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1405523697964F98BFB1706F1488281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 09bec4a9b99f3fd3e315184f9a8d94fca75beea9e0b463c0ce4420232ad614b6
MD5 f87eb4704c2256419b0dfc8cead875b1
SHA1 8bcfd91cf0d325a202482dba389e4f3554110560
SHA512 3b9402e8a1e203734ce4886219ca1ee60a218422e76f828beba398917021d0b4909bae7cc5b1d01bed985d281980e29a30a07bb8fc434cc6d2e395a0f9ff55a6
SSDEEP 12288:vAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:vgnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1CA5523697925F98BFA1706F1488381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3c3c8939bed2fd514ee5daaa7fcba6ba5b91f462ccbd4f0f105cc9bb56672e27
MD5 d3265a6b09ed70606b29b44a034f9b75
SHA1 a53ad6349a283ef330bb5498828812678d2bb9af
SHA512 369af5340c7c86878adcc62240aff8009c862ce577f56f51cb09318f379a77a2d3f19360fd22c98868ad84dbc811f30b4ee4ec1b3f34b1328cad55ff67bc4bf5
SSDEEP 12288:sVpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:knQ/tbw/2Mkjy6Fr7g0om
TLSH
T1A85523693A69F4C7F92742B4CC928142E77B3DC5BBA1A38F6B04112D4E793D419B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8797b394e5341a77f7130f14f6cd3c80012f9044ac915050f20cef5425c6bffc
MD5 37fe2e22120c4ee5d5cccbe29e542c4c
SHA1 045d99e4f13e215b9438fd218f1a60f5aa99ed60
SHA512 4332873d75bed1285770d4397a496f1f6dbaada8a5fd16cc0b7da61994bc213453bfbde45d8d318b840d08b6a5a23326eb4895c686233441d5317cd269d7847a
SSDEEP 12288:yxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:yBnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1F75523697965F98BFA1706F1488381829B3B0EC6BFD1A38F7B4C1128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bb6080ea71c6bf4a7e2784fac5fcee4edc89c7b1962fa87d77587f4e82e0d9a9
MD5 97be21ed0728ded655dc922decb23a59
SHA1 1b80889fa66f87931888cbc3bca7c1413f6dd23b
SHA512 ce9b313636c3cbf11427971be8d4ea85e814d4e1c0194bcd5f432fe56e3201e95b76d289fba8d1cc8e02fdac26cf4ed97af52dcd5f6d8bdbe1c771a16b7b840b
SSDEEP 12288:kGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:kmnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1105523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a72784259433a3f788ebb366b205d2ceea867f21640ad00dd6e7837deb73e721
MD5 1e4dd30e87a0d9d8895b4a44c6d78b96
SHA1 70d854f057b9ea87d35626a5ce6bda8960341ad4
SHA512 b1509c7217464b0dd6efa4d12184a1bfbf343e236da394715866d6c07c0741c97e781f9b3d8c013c0b6d1d13c7fbda7974f5879d82194a298dbef34a2e8eab07
SSDEEP 12288:0iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:0inQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1415523797924F98BFB1706F1488281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0260dd7d2b4a68627d61be75ebe4506bb4b89ff500ef5f29326dac29ae633283
MD5 c4d42488231dc2834d8746bae8f25d44
SHA1 00f7469fca8a44f6dbe728972a007b9c5420074d
SHA512 ee91442f9534f8a88e08a271f75f8c2aac70c7ab80a1e57f2f069aca3242c56e42fa4abc6d6eab421f9b24f63d039e10224e68c2eed6663c415f927ab10008ed
SSDEEP 12288:YiZwbDzzFEoS2cPvyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:bZM3zFVSOanQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1867501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b1e16b85b9109f4dc0c74f9059c4aabbd0c3dc2f4a88d5820743a75227351c9a
MD5 044e8215e9af5bb48a2c2dd088f967be
SHA1 4d6b52eb89ea05324eb90181b53585570ceb9254
SHA512 f62d192ba755a5568a8939b9d12e42a50e73e17f4c54f04bb0c3df6547c279c20f8f0226efed874a6c0af50fcfac637db0cd591d32842907a25708dcdf94be71
SSDEEP 12288:RHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:RnnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1DB5523697924F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f651200a21584e4cbde2413716ae9ae5f830db5b4a142d7729ddf11a1ada4b1b
MD5 067cd3cac95ee7733d7c8249d7288c19
SHA1 6f9b92e3cf16d99b33a2277f1c4488226e0ae892
SHA512 271f307c89f9b451131149dd7f8aa2fcc328d7af9c1c00d9e219c0741199db852ae19f37b0aa585a3a06bfe61db55892719bdbcb3c0fdbcbe0239bd5110e743d
SSDEEP 12288:MLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:M7nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T19E5523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5657327a8315f75c048addf97d4893819106eff9269a9fb8e777d3a779772ab4
MD5 ea8685101a8a966e6cfbb8dca91fdad8
SHA1 98018f657ee2c38146a44423d4cea04a80e9968f
SHA512 e4815ddc61235291a7110f37baa072e83072e21a781b1000365f61a6fe0972e89da1ed60b9d90ccb980086c4c006adb018837b232a48a1c79916c47f37b7b3f4
SSDEEP 12288:QyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:hzyenQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12E65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 839e8c429cb16d22007a14585ef8fbe13e1bba4c5b2f77c81f88afae8518fb09
MD5 7ebbb2fcee7e09e9e8a5ea37c6798d4b
SHA1 2b6eb0293d21d99ba3ec32ee86fbafc49dabf43b
SHA512 6f592df255ec785fb473ac87700aa25303b6f91b319cb8d1024bb6dff423168f91f7b0bda125c687e69f38af07f94c8c2055c7299685c7f38299689b3d00f6ea
SSDEEP 12288:PHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:PnnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1615523697924F98BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d7ee639dd46ee2a62e5282e6183e28911c897876f9e58f4669bac7b87e8440ee
MD5 9d0c8cb2e993e63e7a4ba2996e40c444
SHA1 6a867f290d3815a98910a19925a78c93e72cc3d6
SHA512 acd523e5e3687231714c1432586a98534d97bb56bfee974ec21fc6d2061f2256e9a872084a8baa0279c6ad5d158f2bcbf213689257359af611844c0d74d6b0a9
SSDEEP 12288:tHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:tnnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1185523697924F98BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6e197bcdde7f0c1c2488ac534ffd27b81dcc8ed06da8cb2020abc3892e3b723e
MD5 a16b65c8820047a609865a78cb85734e
SHA1 1022591fdb340c111f204fc763becb52759557a4
SHA512 8a1d419d5886fd4d0e2199883dee5e5cdeccb271c392100fa5d70eb32cfb51876894e748f385955cd16236effe453bc9ef79630894965e9b5aa9d3f39ad37d91
SSDEEP 12288:xyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:gzyenQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1F665021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b5f39f8cb2e7217125f560c5a29b39b21b6426c7ef1db1913f571a81b319d03e
MD5 114ae1203efc6aa469e5fdd84a6d3ca3
SHA1 17008f6f66505094b3e163e0026a9ef0f56e0417
SHA512 7635d81a7b87bc32a113ad955a47a913ca3c68f88258368b70c915339e7a670e8faaa64533149db3f7aecbdd0d73dc27782a26e75cede47afbc2a535892be017
SSDEEP 24576:AT0aLl3z0zDQnQ/tbw/2Mkjy6Fr7g0o/:ATDLljFQ/lFTjN4
TLSH
T1F47501A4B35058F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 45932face5d672f6acb6caf6f3e46dacca94b37634c07bdbb35d80ca1420b4db
MD5 cea7ab909b9a674c0420a1591ae8b7f6
SHA1 88d8977ace5085a42cabf0aa20f607cfd0393d19
SHA512 abc6aed94493ecfeea22ebaf5a949ab14cb1ab531512ecdcb600fe806dfb34d879999a13c83cb63df19c07c9c86f66b372f88ac7cdd5346c06efc39741a654f5
SSDEEP 24576:J31d9CHKy7GZsnQ/tbw/2Mkjy6Fr7g0oK:Z1d9CHKya2Q/lFTjN4
TLSH
T1E885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 492ecb7d5ba5d7fc9f015ecd2c652d8b200b4b447fa868cda296a771a11e4db6
MD5 ff25248cdf0c754fbb5b3291dca2b65a
SHA1 a96fd5e5a003ba5873d6769f5c6f4942f21bd816
SHA512 1d5ecec6c948f22a29e31b94ae7c44034e379c7f63be150389ce8f8ab4c79c636fa8efdf5247c364721902a3da94421537f1bd887c3e8b93c7743f65bf88a139
SSDEEP 12288:XgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:XAnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1075523697925F98BFB1706F1488281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e1d651ab50f8d8ddf10a8aee4a37bdf4821a0ac536b33a59168a533f8942c554
MD5 5852d97d0379ea502fdcd878fc9d403c
SHA1 00af08791d6789bc3675456e04860092db361e2a
SHA512 45782d1b8828ad7ebaddbe64a24235dc5913e33d701a317e866149d9d9aa8e81ef2d6a5f4556881b33c80750d2202f98b86129a172f90d3b1bfbf332467739ef
SSDEEP 12288:4+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:4+nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1A15523797964F99BFA2B06F1488381829B3F0EC6BFD1938F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b333235ae980be1b04a9cf16e684e8ba427c0b9f8de3c92d02b2bc7b5e2c6cf3
MD5 b1e509b6f2212c13357dca4b150bf365
SHA1 3405ff72cd9e6c41bd3c1e33368e1a84bf8e3560
SHA512 6f1256c2d1e02c13c65ab2bf567ad9075ab085b50f5be80cee6b698814578b241581a2cded5d4d54bd7f930528c038b1d98521b28a69bbb3e965662d78c8aee9
SSDEEP 12288:nNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:ntnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1445523797925F98BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f3cb7d9aa38b752dd6d8d604f67b28d7138f8581519be77578e789ba9c73586f
MD5 1e6459bba35d97a3bc2317cacf977cc7
SHA1 d216af24782a90eefc954c97cf112e539653b2c1
SHA512 986b3454a2732c7b7d43f0512cac0082ece36635013db9cbf5693f4e7b5683688cc25831f458d6e93bd3883a5c793be2a2555222db0add6b0edad84c63036f0a
SSDEEP 12288:EHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:EnnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T17D5523697925F98BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8b9cb93ff2676d70330bda63d1565a01603a95e927c9863d0ce7f47919902018
MD5 0daec16b628ab04930f421a7a496da18
SHA1 7d4484fadc7deb820d14573f3fd2d991daeba8c9
SHA512 374162c52c3700a2c19df81586f5ef8b9b8b16eae74e94a842a1a7fc4e48591cd5eaac1dd4bb50b4584e118c5e3e1642759afc5543309cbc91838e84ddf94d55
SSDEEP 12288:HgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:HAnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1A85523697925F98BFA1706F1488381829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cb40c07259038afa125c7d5329ba83030051a059d742b8132dedd446a9b98a72
MD5 677b7127d716c939a58483d6bbbb635b
SHA1 6214e578d957e3d189885b690179a5c0e4193019
SHA512 0ce73f64d02ccfd955c67377047a4e6d8643c43c154fdcc2912f3726e3e7c9d8299ac2c7199973235be9048aab63ff4acaf0445123f28155e33dbb9ff3a924a9
SSDEEP 12288:tPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:tvnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1575523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f68959f6042347f23c95924a7531b137e047a8bb431491a3352d0dfc5f13fc3f
MD5 03b7baf3a9aa28018bb559b414d83014
SHA1 cd7c8edc494a3757eea878d8d3251fc206254f0a
SHA512 2285b06a95fc0fe621c4e0b4af5c920b187664dbd94e91996cb4a2e529e408557755b76cba0893dcc8d18650ce55b3dc604c91e1ea91186050e49ef20a540775
SSDEEP 24576:Jfwv/k9RX6wkyAILnQ/tbw/2Mkjy6Fr7g0o3:4MnYILQ/lFTjN4
TLSH
T1CB85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a52138aa7e9e0e74361b049f382652727cb2cc285e36c11e14c6547ae3488dac
MD5 86744735dc5dcbf0f1c9c920c36948d4
SHA1 d7b99bd622f860731affea8c2cdf95e6fe235756
SHA512 4bc51ca180b5b2f9d527d1d96a91a71bbbcada0956a6a5e754771a529b897d32a106df0b01abdec06374c453730c0dbe01eabe385d312fa0f5ceaf8a3aad0222
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UQ/lFTjN4:BySzPPLm
TLSH
T1FA066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 41f8c482a1c639e9cf93a9905059984f09a1efe5545f66381724b250cc96d056
MD5 761da649962a00674fc70eea9e183312
SHA1 0cbf91f67db3d89934d1eb1b3479559ac73e8570
SHA512 3ab2654619be6ed24b76a53063acfe847f9a3195cb799f119f66210bbb6f833324c95e493c1e74a802fe5b2a8ef5b1abc15d09df669bea4eea630f3c5049b5d7
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqnQ/tbw/2Mkjy6Fr7g0oA:x47JUQj1irIhCnDHUPfF/kQ/lFTjN4
TLSH
T1BE65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cecb9e96e401f4178c91b61e3540c7f218ea62d7c1665e6d574ae3e6fb5d9820
MD5 77d900ce4f08be1430e3c086cc7621dc
SHA1 0be3ff689034ae763fd8f86a85343edc9eedff38
SHA512 2f7c56602c1edb441e31be87f6214b9e7a9451c5856ae1f90c0fcecde5e364c9cf5752de6e54e006ae3ec93790fdaa8bc06e22898f3be8306db47a8a6ba328f0
SSDEEP 12288:ussf3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:YXnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1CD65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 73942f1d806aaf66fc74fc22570fe2173594d21f889ed3ba5d3be0708b2bd2e5
MD5 c5599c13350f129ee521ba5fca247d29
SHA1 16dc808366af9fb82fa1ccc611a522dfe36a6b16
SHA512 f9dfd1a25ad40fc6412c51a78274a2ba26c51ec53692851e884bd1d701e79b5acbb18fe7759cb4237c5b46bd9d7002073a9d8f947d546d268f712150fa7571a5
SSDEEP 12288:A+J8+XeU3fZxcPpqmt1z8VOSCtNiF/jsP/DZHQwhV:A+JxuUPfrSz8ktNAQP/Nww
TLSH
T1843538107666DB4FC6A940325E73C6CCA7707D41EE08AB0372C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 5b4de989aca0aa0b52fe0e27913a18638b3d9d11f644c4968724ee3bebf8832a
MD5 d11edab7879f4e3c1e2f2b46fd0dafe6
SHA1 709e92abbc7837cf37895f0d5f8a472e59286e7f
SHA512 741201526d25aabe9b01a9de1d8441de96063ebcea2bf3c545027d72839742f5db40214721522df078755fa1460da3260c5ea6df66a7a78cae20a5e1bd903ee7
SSDEEP 12288:d7CHg/EaK4FcADHfjimJrezSG/NVzZjGjHYOJNzxSs:d7CA/gY4azQs
TLSH
T1B6751A816137E78FC1FA2032033A5B8D6B64EC06B7086F27B3C9453AD46AB5570B97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 74KB
SHA256 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
MD5 2814acbd607ba47bdbcdf6ac3076ee95
SHA1 50ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA512 34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
SSDEEP 768:2fqePMS8NxKDSYkK7U0H8zAqaMRmnJD+7OX4ubjJJYIn8n28zaTQ8PfcQWZcRZip:sPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVQ
TLSH
T15A737C472A1540F2E2C66231B6A5BB3196F5ED610F5A1683C3EF82DC2FB6787E211207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a280873ec400b4cc7abc150018094197b0fcf8dbc47be7e0eac0314a7bc4ca1e
MD5 06b4a3acb46204c9f28c70de42bd9cda
SHA1 0743aebf6d20dcec1182af6ce1fcb6e1bb7addbd
SHA512 5a752d4c3349b2fde30c07619581b64ec1dde698451c36284d523634efff3eb537680b57fffa65b24d6b92fbdc96310b2f93778f72a185c1c253b535a138b27c
SSDEEP 12288:967/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:UfnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CF5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9cc732c936d41ae5112bebbee5361a4688a0515e2d88ae80edac352001f496d0
MD5 25294675f0b8fe9932585893c9e57a79
SHA1 1d441e872626693a92ce4ab3dd31efd6082c9349
SHA512 ee61ef5dc6031c5ae9f4eaa1077bb4fe720c57ed4aecea7648e4a37dda63e3904478d8fd02221ff125dab2acf4ef3c82fcf7e33a404a0abd080a55fb2c0050d3
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYFnQ/tbw/2Mkjy6Fr7g0o2:+gb4mBIBhGFqQ/lFTjN4
TLSH
T1EE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 331fc76ddcb1cc4a7171c7335c0979828dbbf24291e2025b79514876bdadec31
MD5 0a09610fdc57097a6046f20cf6493893
SHA1 c67d28b578c0b4ecbd5c88eb630aafb954c861c2
SHA512 9b916b4f9775572218447b8f7e7bc1d576db74b9a03ccf323734d3a40f2210d7e6ae6167bce243359de27ef091f18a68f2d4cd87b9cbe9d5dd2b07681cca07b8
SSDEEP 24576:zG88u8FpJqH1Qzria7/manQ/tbw/2Mkjy6Fr7g0oN:C7ZFPqVva7/NQ/lFTjN4
TLSH
T1E885F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6b7e7154c31ec3bb9311cb6f14c8d53b65e8082dfd396e87c70fc9b8f99d2491
MD5 58ba566fdf56121d392fe592d1e8bf15
SHA1 e237c2ccb61a6bdb1816c8cc7baebb2eb5f99892
SHA512 4578753e276c9033a331a71b29617908ac0961c23a6e3ea53fe17f6967d9bbba5e033a2d49f7d46df579fe3ecae2d29fda83cb5326d13316d47e7d9260695ac1
SSDEEP 12288:uHvUrBFrEjwaQWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:uPUr+NQ2nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1FF65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3ffe1213eb78d7f4ce4e2a12ab38f14a4bb71801f2f2230e280a795492ee2cf3
MD5 b933c98d87a1e1ade6f9f20136a656d8
SHA1 fb2219436ef6bfdd78c2d25c77e94b6422ba379d
SHA512 f5c3675e2a67a5229a8386394ead8738810e50fb88a5a1ba4fc46b191d06104acb2b55d4c924f00ae50aa67669d37fe1bcb8ff560037afd4d7a19c0cc143b771
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmQ/lFTjN4:XG05lO43b4Lm
TLSH
T16FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 648df60bae4d63f90da4d27268bcaa50d66c05e5102d0784d9e8f17ab50b2af0
MD5 fcc43631fdf71d1fb21ea0d2f8b3dd27
SHA1 81d2c3ac97315f9f37059d0da976ac8f16936bae
SHA512 77fdce0fba4eff9e2767f1e663e9f17570d5ec965aa24871b0ba27a4cbe7913b97ce186736fcc9e30f73c1edf23848d33c52b7eb9c7439efb467832fa43f38d2
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnUnQ/tbw/2Mkjy6Fr7g0o/:Aa5POZ3+Jt2pasx2+m+Q/lFTjN4
TLSH
T1D665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3c7876e6ad887efcae39aa8e6e275130a3834e4425323665f10ad156d6c32d31
MD5 cf93d388999addabb3157ba3576353bc
SHA1 90d6aba4b54db0b281bf36ba6b4621b86b6cfe90
SHA512 266e00d98a06530de9da069439d09b4ab912e65b665cc6d217ebea2b95a23140324b6d702e6af4c50b193d2cce53476ae21d622b83ef3f7f19a5e66c5bdbcaa2
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkSnQ/tbw/2Mkjy6Fr7g0oq:uNc/zEOVHFtQ/lFTjN4
TLSH
T197858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b0312e3f11f0f10838e32360f92772c2a27ac0b0b0d5c52934e0acf2717a581c
MD5 35e377773233e9288b0263a05328ecdb
SHA1 398a9e2a887ca297aa1da354138dd620301a30b4
SHA512 7f4f654623e8c7266c924d2e2182099f15f7f56862b3187baaaf6ea2c2d98bc75374692da555c6420f900292d4cafbfc902e40658c9938527dfc30f812c39e97
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmYnQ/tbw/2Mkjy6Fr7g0oE:D8MwBtOmYQ/lFTjN4
TLSH
T1D755AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3f1dc1b35d45f81cdd9e2b98726355caac2205a55100045c177d7d1ca34cc313
MD5 f860fc982b1261cccf3a46dd95620c47
SHA1 e4ff460988e9453915577ba583d7a2246bb64baa
SHA512 c6ec8954a757b36d7783971b3093f4751378d6aee0ee19b8dc1f1887f5bb35a9c871971e51cf90bc884fa534ed65812607461cf5b14f9f3f0f43d17bed91d436
SSDEEP 24576:pD3FHshBIYQgAjnQ/tbw/2Mkjy6Fr7g0oz:pDVHeBIAAjQ/lFTjN4
TLSH
T16F75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1280-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1280-319-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1280-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1280-114-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1280-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1740-90-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/1740-85-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/1740-315-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1740-84-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2036-165-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2036-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2036-140-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2036-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2036-163-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2940-61-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2940-67-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2940-60-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2940-299-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3444-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3444-45-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3444-57-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3444-55-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3444-52-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3800-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3800-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3800-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3800-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4356-334-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4356-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4356-101-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4356-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4356-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4504-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4504-19-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4504-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4504-27-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4992-120-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4992-318-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4992-122-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4992-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5096-71-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5096-314-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5096-79-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5096-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5264-0-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/5264-83-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/5264-8-0x00000000027F0000-0x0000000002856000-memory.dmp

Download

memory/5264-1-0x00000000027F0000-0x0000000002856000-memory.dmp

Download

memory/6076-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6076-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6076-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download