62dcde7b287a8001b99ed34609ae213584aca539f7cf2478ccf3d334d82ea833

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Size 2.8MB
Sample260930-aaaaaa1gna
SHA256 62dcde7b287a8001b99ed34609ae213584aca539f7cf2478ccf3d334d82ea833
MD5 5f7fdf8469acf1a3723684686f1d0844
SHA1 fa36c49158b852a35e62c38ef822b049197ea22a
SHA512 c5f09bcff1ce3b7d8ee9fdeb5b0289fd65271768065d3b4fdf668801fe23160cbad40926b981d05955d35749dd676c9d275983e4a9dc080553e8a6779f77ac7e
SSDEEP 49152:dSNmXVku+VVk+iZ0lPTEnypffJ4klKXnoVkYej15VHW:ENFVm+i+PfJ4kBA15V2
TLSH
T1ECD5CF037F558462D6A14D70DD78A7A55728FD2C17FA03E7728029E9ECE02C23E35AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1308	elevation_service.exe
960	elevation_service.exe
1056	OSE.EXE
1036	PerceptionSimulationService.exe
3976	perfhost.exe
5188	ReFsDedupSvc.exe
716	SensorDataService.exe
5536	ssh-agent.exe
1220	AgentService.exe
2996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e6fdb9ac3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5060-0-0x0000000000400000-0x0000000000B02000-memory.dmp	upx
behavioral2/memory/5060-166-0x0000000000400000-0x0000000000B02000-memory.dmp	upx
behavioral2/files/0x00010000000093de-278.dat	upx
behavioral2/files/0x000100000000934f-276.dat	upx
behavioral2/memory/5060-282-0x0000000000400000-0x0000000000B02000-memory.dmp	upx
behavioral2/files/0x0001000000009b92-284.dat	upx
behavioral2/files/0x0001000000009cfe-283.dat	upx
behavioral2/files/0x0001000000009cd6-281.dat	upx
behavioral2/files/0x000100000001b93c-280.dat	upx
behavioral2/files/0x0001000000009952-279.dat	upx
behavioral2/files/0x0001000000006215-291.dat	upx
behavioral2/files/0x000100000000a0ce-293.dat	upx
behavioral2/files/0x000100000000ba34-292.dat	upx
behavioral2/files/0x000100000001b93c-474.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000557a8cb36e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6f271b86e50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066b594b36e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009bb01ab66e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007ed29f56e50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f890fb66e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5060	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
5060	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5060	2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Token: SeAssignPrimaryTokenPrivilege	1220	AgentService.exe
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1308	elevation_service.exe
Token: SeDebugPrivilege	960	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 5724	2996	SearchIndexer.exe	100
PID 2996 wrote to memory of 2672	2996	SearchIndexer.exe	101
PID 2996 wrote to memory of 4616	2996	SearchIndexer.exe	102
PID 2996 wrote to memory of 5960	2996	SearchIndexer.exe	103
PID 2996 wrote to memory of 3272	2996	SearchIndexer.exe	105
PID 2996 wrote to memory of 1700	2996	SearchIndexer.exe	106
PID 2996 wrote to memory of 1412	2996	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5f7fdf8469acf1a3723684686f1d0844_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2924 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2924 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a6078412d9e5b731d560025f05ed0f5a85d566eb21ccbf3d46f83f2e4a39b0c
MD5 27c4c5f726d4637ff06e375298be6255
SHA1 4f54e6933cbf9e69f35840e6ddea8e3fcf64f7bc
SHA512 e639c3e5c8ca52aadbad4b5fe04b3596057d8d66fca67dd900903496d4ea16bb835a6b38c352184c2e5ea3f5858515cc9548f38acc2f083c340fa23b7480b6e4
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYfJ4klKXnN:93q6mjBTfJ4k
TLSH
T16DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 2be97da95bc26a31d01970e25b8dfd2d6c41be08b6237aed9674e37931ce692a
MD5 bca91982637c13a923b9d20cc6d8229f
SHA1 951f8290af5edab07ba80d9ed54e162552529a9d
SHA512 aebef6c825f7548ea0cb1c8649edf6cc1d8e2c6a9e46e7b316a5395c4da6b4f8322a350ae22730768f4bac128482c7933eda52dba427125a611d9157abd54402
SSDEEP 24576:fXYJDoczAncvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:4ocNkYej15VHW
TLSH
T18C250128ABE409F9ED67817CCDB2C515EB72B84547A0E65B03E089661F333985E3DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5326212bd8e1aae4690aaa2ef256aa18d237a0161ffc3afe9b7d9e763558b189
MD5 d9730c90a5cbcd0fec839f9d75be9dc3
SHA1 f1865b00006312f5dfe7b71c8a87f71aa5ea24bd
SHA512 71c344e18fc42696fc4be87f7048e296667bdcaf8dc5a7d4f1dd57425faa343ed7a4ce3f88635400fb38d60d8fed78f2150631220f2a308912c949dffea89269
SSDEEP 24576:RXYJDoczAncvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtkFfJ4yL/tNCJPXUQrP6:CocNkYej15VHWFfJ4klKXni
TLSH
T1CA751229B7E449F9ED67827CCDA1C000EB327C854764E29B03E099662F733985E7DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ca59f27de9bf5abab0f869f1b71499f138de2aaae2fcff3341094d96a832506f
MD5 9b14d1d1e662a3e824a81b8779a7019d
SHA1 cdc887e79e687d643ab4e600092755c031dbf51e
SHA512 36594cdb5e9465c10aaeb0fc9c6f77d551be0775691b4106d4d1ad6eef601235bf89f40e3fdbc60727384b73625950c16311742f0be0af802b4f068e7561c607
SSDEEP 24576:Q0Le5ji0hmxhrMPfJ4yL/tNCJPXUQrPl:QPji0AzafJ4klKXnN
TLSH
T11035AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7b1a494c464550f550dcf1970dfda5b2eaacf34962e5dcad55e43821aea16652
MD5 33de09fd157b2c65b22f0e242641861f
SHA1 54e90bc41cd1efeb89be7caf09a4be1c08f7952d
SHA512 f16ad99593c74033ee034a6b87cded19866da5eb726867477532921d8f4fb8c928d42b2045e3d60ca575d6099409f6cebdc51b2c07e3b69100bfff01e4bb37cc
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyuZfJ4yL/tNCJPXUQrPv:j/ezSC6vUzPv+HjyOfJ4klKXnX
TLSH
T1CD756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b42cc216eb0c9e39744226d3bb4b73f979682b1afb6e1c0dad452b22e7704226
MD5 4c478193b2d3875401721a900fbfde26
SHA1 afdcac1b6bbde31389478e054003bc27a09f28cb
SHA512 bc4f103945c687017073064567f33ec11436746fdc341e8a0d58d59a865088c04ba4f6e1b3e049ea8e39e4b3e43f2960c9489badff4669886ec7e0005ccc3446
SSDEEP 24576:eVbqPb88hv/l+BgfJ4yL/tNCJPXUQrPD:eVO88hXl+6fJ4klKXnb
TLSH
T1CB559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fcf9908a8c3a00aa3c901b72ea019cae37313c182237ab2f9f2187480c3c6c4e
MD5 6441442a07e2125416fedf7810d4bc18
SHA1 25abdc4060b84a1c8943c1c3575d7761956c56f6
SHA512 0d953940d727e757dce3b48e3ead762091e404bde9c57e4e037f968c4aa3928b24ff02c7f206fe978bb9f1242f3870c57d45b35e8c52528908d62ae2363efbec
SSDEEP 12288:RG7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:RG7fJ4yL/tNCJPXUQrPO
TLSH
T114C423E751849486DF6687F82A88F001C304BEC5562FA2F6DE82B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1911ba6bf0a90ecfafd31d9005b4cb7701caad0910e3ad70cd964b5fbea1fb7c
MD5 8ea920e614ac37f80ace4e2756d10fb3
SHA1 c81fc8afd3104ed52edf974075bcf54e72539339
SHA512 44c43a991ec289e3bd8996a3b1b1879d089083f84bf0ed1c151551f514fae70144a508348aa487e2d31dc64f2025d4fad096c7817b26b23c644f20c111e3a6e9
SSDEEP 12288:yeBNUbTVO86UIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:yJIUIfJ4yL/tNCJPXUQrPp
TLSH
T1CE05C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bff83ae62190e366d3c9cbeb3e065e634032b80ef92fd01db40e5a4c8585d4b1
MD5 df6faf887ecd76eda700c64acb1cdb8f
SHA1 e0698839e9311d7438cbc0bac0b32f4967e2a134
SHA512 0103f2f81334400e3e6ccf72176699f7a89942051a5243f8c287869a01fc87e6f6c11271e691140b3edcd64e83bf2336f5ee4e6cd3551ad24922cb4be8f20446
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH2:AQvGAdlCEL8c/WRNw5CpfJ4k
TLSH
T101266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c603d4313f2246148c8616db3b03c4ac3cdf0e91c53f8e015d8d0a966bb6399f
MD5 f51b5c8d185a9c9cc0d0ce1040d057f0
SHA1 da63a1e2a99ab67e911b5c53928a2cf51782c11c
SHA512 2e37a7e97776b99ce0ac529061f2f574eff2e0840e9f570b824a3caf399d62ad14e943496d3a021f6b106272fc6b10109da1eadacd7a1116366f1cf53aa6fa7f
SSDEEP 12288:LAwSfxL/2Dc3mDLLmt0LDQewsAjqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWw:0fewsAjqfJ4yL/tNCJPXUQrPS
TLSH
T15515E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 53e8654c42184f5e00e66fde24ba597788638c063b9bfda83352191c8a55d3e7
MD5 440cfdc4d691b914edf6a6e2981d329b
SHA1 6ca9a7fa72574ae57179b08e34f002206e17b0cf
SHA512 81969d9c1b0f5bcbb6e5520107327e69d582ff71991828ee27f1066624a0c37200668eb6a4356fe3bd7664b06fe6d52f00c7f792e962bea301f8f522b9cf5737
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCfJ4:AUEtQevvqc2W1cpV20I32C
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 75c89cf7e41c15e9cb9f393e3fff5058ca7aec0b7639e62c7df9f1666c72ae06
MD5 3bf21534f1a609a5d8bbe963b9d7ad34
SHA1 c3c43a59fe7559257d97e836e87661fc61a5bff4
SHA512 f7f16f816bf57c48fb09cf564ad14d0ea4dc28dc9df319cecd62e35e4e686fdf263f3172b39b594efef009c7fc8a073fa7168f88bf472c25c450e871691a70be
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zKfJ4klKXnu:GoqtVjnmNfJ4k
TLSH
T135D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 62328ad07d425f76aeec256e83a13ea56ecd55dd8ccf7fceb7c3da80011adb40
MD5 6ebc16999b4d14a5636a263fcd2c5785
SHA1 8ea67890602552efcfd9efcf9528b62910aa4dd7
SHA512 71d97a2d1c18248897d442bd0d87952c1c98c9985f157e12fdc464682f1e17ddc94b01f99ae984785ee06f4bcfa18767765c8fed69314b61f2b6b84f546be6c9
SSDEEP 24576:3AhGL6IFoiwtA5l7S53tfJ4yL/tNCJPXUQrPJ:3AM5Foiq5dfJ4klKXnx
TLSH
T11D359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c727370e7062468934365b993be5ccd9b6cce93e36b71596551dc901aa240389
MD5 ff04f10dffccc4bcfb8ca488cf7beffc
SHA1 5082c3a813d3432caa6141c9e9191398470831e7
SHA512 3e8af8da6117826c8d6886a71cdd42fd7744a1c74b69aff3b5fca4d3230068c603ec052b32731ed76c281e99c38dabfe5783aa83016ad58e36f834a827b76f5e
SSDEEP 12288:Emw5HEjsChNEBFgl0WDm+COfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7:hwuROWFfJ4yL/tNCJPXUQrP/
TLSH
T1C105014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5d6abcfd34d0ac54cb9c991e0a2ae0b21c902fde22ceb86b8504ea22eacdb1bd
MD5 5ae638ad5421e27e135e594d3e900429
SHA1 a2371c2b80957516fe7dd674fe670880e5a61487
SHA512 f90b26c215969bdff22f36b34505bb92c2a9148aa5fcbe058bf96693530570c5448a2cff37af42f94813464c558aafccd8b5b354b1c91dbe205e8d4aff5c1f2e
SSDEEP 12288:DyZ1Iy6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Scc:OZu3fJ4yL/tNCJPXUQrPW
TLSH
T18CE4129B32D460F9DAA782BC8AD4D101D3317C92273A53CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 abe83aa3c1c0265943fc209394eef47ee3a8191c7bcdbca528c129cb83e8d487
MD5 567238c4af5f350b4a6537c0ab086226
SHA1 9c9039f62b0b289b86df4969520c26a2a0ac1e8a
SHA512 659cc223b50fff10631f1831e1310aaa4db3ba68392df7c89e7bd9ffb352dd6179da02296d8da6b620fc80710f18276ee6d74e257b0f2787c33e9a240765a1ed
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ue:1QRQyi36YOcPDLvw2gAf+PN3MfJ4k
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e49bbc4431b1584278a4c26431f0834f2063061d71d7b71d5302f4ccdbfda4a
MD5 4536f30ad9645f08fafeec106ce96186
SHA1 452d20078fde1892c31c55d2c32352a973dec2d7
SHA512 76b40e31adb91d9877f1039dc1f64120f6c3c6689f83210304a021692b565f68b43ce93a8414171ad56a896433b6910607701f87f73c98e6e9ccf619de78156e
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U6:oQRQyi36YOcPDLvw2gAf+PN3MfJ4k
TLSH
T175667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf95853a63d932a5dcc630e7eca5a2d5de71588321d4d209ab25ea08f4340d33
MD5 62ad7fdbe71348ffffac7ab10119334e
SHA1 8ac27142643694451b13c4919aaed8e3c07ebc66
SHA512 5b4d21adaef1da62ee193f24e2f965acc6186e6b2ba391ef5c82a38248c5b05691c97e19d559e2d57ebcb45ac291de4b73f307952a616d00913f0ad230d80f16
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0nfJ4yL/tNCJPXUM:Z68Qg55nhkeWu7PNU3/afJ4klKXnL
TLSH
T183B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ca9dbcc45e330a46f3f42064173996b73f2165ed6697f2db13d29292bcd03bfc
MD5 85d736781755c16c49a8d4ffaa960b6a
SHA1 fbff53b395c1a6e89dc9e924ef23e9a74eede544
SHA512 af60f7c5d38c2cfbd610e80a1709abd0d28763186d8465d8a556fc8c9edcdde90327ed38d3b6b3f405c9124df141bd997536642ddaa52eb37baa3bf758948a44
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99C:Sy5112gYy5azzVvU69nLKnhZ7fJ4k
TLSH
T1F2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76c549dbd0c1bd15b10f70a44d8c477f0ecd123cc59447320564fe622191cbc4
MD5 370f4b4502fe6f98a0850a49e8e30431
SHA1 1d5aecdffca1424da4547d237b19a318df365c0b
SHA512 730a3d1c8818258eea49c6ea448bebc2996925624a97d1b59e6c341762b3773ca31e271f3f4f1e00ee231f5c532f2fc20cda630571472a01dc2379c12b47eedb
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3fJ4klKXnM:6u6JmIxd2d3fJ4k
TLSH
T181D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 822adcd13c56b6f020ba80843563b5f5ed45647abc60831f2c899cce5e08d72a
MD5 5c00bd2108249b0adc3b969789ebf4e6
SHA1 10c465f1a7676ed8906942a6afaadc38bc4458c0
SHA512 89b3725e4c489bf1e23b1adffe2780b82794527fadecd689cadf7aef3ebceca30bf317527c12021a0e2986a5c256b1e83b5738a00dc44976aa55d57999250515
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4xofJ4klKXnB:0mifPqRNfJ4k
TLSH
T1FAB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0aca65eb0d7261756f8071b4ee96bb7fca48d58ef49630da9ca547e9b334223e
MD5 8953d16028703c33f21552fc6d8a18f1
SHA1 0a212d27fd9f854a1e7055f24d2d0e599ebee1ab
SHA512 f0a3e5773a4d37675579ac47620894537d9e7bde5feacc6fb60befeb7592bceaa420e71c9982144ae5e06c214b6703b936d2d4f6f9c3af1b8e2407600082bfb2
SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHq3fJ4klKXnz:c5dKqi613fJ4k
TLSH
T150C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32f8b98588070a0bf9cf0011fd460c46269edce502488d5ed499a173b7b853fe
MD5 47c782c4057ea96bfd8c2b3a6906e02e
SHA1 649994aa7f2b2c54d17659e84ae87fcaae5b9ef3
SHA512 3bdb5bd22ec20260f4b88fbef6a38f1447f65285349b7f6551a4a9067d8f3a1c7dc2dd217a66cb0a1ee6e6d07e75712aaa3752ad67acc2c347987d222453d99d
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5wEfJ4klKXnv:PX2iWphhfJ4k
TLSH
T1F895BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3bc119659d317f69aebff12d00739bd68c56418316ee75e6ecac61135029f9bb
MD5 a11b2edf4c7b4333eeed0f4b37a20155
SHA1 5b790828201cc3128995d309efee6f0af036429a
SHA512 e47b5fe16aeb4fe7eb58519dcf5f0f8dd91215b82ec30cfc4e19f5eb31fe280bfee37117976ed429f5da9347c56f57475804bf20e91e204ea05479521205ccc7
SSDEEP 12288:zjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:zjfJ4yL/tNCJPXUQrPc
TLSH
T1FCC423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7e41d1382ac9f3cff0405229be5f7b50477df7ad984dc53386449912632d608f
MD5 f52484770759f10402d4e659979ad812
SHA1 ebf40922ba3589689d29b7314049c604c299d153
SHA512 9d4ad48032a3de1149c427477b1a097e5a195a6cc5b1fb70afeea0f66133fe97cf2064abff6e130aff2b3a9ce9954f7d573c61efa5f8f9a9af6b3f1e31472e44
SSDEEP 12288:/mfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:/mfJ4yL/tNCJPXUQrPh
TLSH
T110C423AB60D59486DE1587F81788E001C7047EC6672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0b2948e833f3364b2d236b817fc4bb8689aac93cac444d7a34efc33e6b2267a7
MD5 a7413ad1e186be8018c22b9a7c560d5c
SHA1 e20c377ae25c2a2587c1c3162b8bef807cf8f547
SHA512 786241ab62fdc4a2a4215b37b7c7c42a8df844b39caef28b4e758dd0378a92621587c074753e0704c135206dadd1b1fbe67cd5448f28517382cbe0c842390503
SSDEEP 12288:dQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:dQfJ4yL/tNCJPXUQrPh
TLSH
T162C423AB60D5948ADE1587F81788E001C3047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 868ab4c4c0969b6763b696ce63f9c2cffed10fd0dd32a3ebb918c3697c799bca
MD5 03a431440d75f84af69bcee0ed427c0e
SHA1 2ca7a735f90eaf3436bbcf685529841985325e41
SHA512 34ccc87aec8c1d75f28ef27798fb61f8e3da28458a85efc3c77f95420b358b859988fb003f98f955e1fbb553559bd56887b6f34089c20a5c45063995e402e7fc
SSDEEP 12288:7VNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:XfJ4yL/tNCJPXUQrPy
TLSH
T15FD42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 855915e68041ea0b726acfb53d64430688f37061036ca9474ddf6a35a18def7d
MD5 0c85828cc4966d20e0a498c5651475a9
SHA1 139b773fa7771053d3d9ae92afccbacb9b4b558d
SHA512 11ef17f9bb95084a9ced22f7a4a1d9b5370ace9dc8b1940535c2ebbe06d098869fa526a296bec08b312ddb70def76f8f0f7d407225815f2aa23a450534b81b73
SSDEEP 12288:HFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:HFfJ4yL/tNCJPXUQrPK
TLSH
T151C423AB60D5948ADE1587F81788E001C7047ECA672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 33392eb9aeebe84c24911fe559aa2ba815555b453a7c4b1090aa1d9c459c4570
MD5 1f92e86ff82e392d238a50c252c3d5bc
SHA1 0b2b821fa0c3d6590d5d10e08ac4ebe451d754aa
SHA512 6dd59715e16deefd188301b3d6c39addee7e29d45f0df174a4a22aebdc575948bd5f6b418de37eee516069c6df0c017d64a8fc36d5b80d04fea724f992adc276
SSDEEP 12288:ESfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:ESfJ4yL/tNCJPXUQrPw
TLSH
T179C423AB60D59486DE1587F81B88E001C7047ECA672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 69280fdb0ad081f3e32f26ba232c2267ce72015ccbccfec9eadfaddae3460c17
MD5 b902bc5f23e4de2e6256307f348f23a8
SHA1 e08d0dba133793fd8d19018723b8ab60fe70587b
SHA512 8ea4f5811b7b183c91e042a56b5dcdd0c79f5c39bc163d16faff6e53d83d23ec3867a60507b908ea349fd9b720de09fb8f525dd9bb1cde0c2fca292a1340993b
SSDEEP 12288:pefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:pefJ4yL/tNCJPXUQrPM
TLSH
T1ECC423AB60D5948ADE1587F81748E001C7047ECA672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1bd7cde04f0fd3c49f89fba9c9d04b252a33a96b66cda3cefc1cd8a8e7fb7d7f
MD5 378415419b1c813694bc46927b645558
SHA1 ec8b98c43a541a2377151aa4b333333530c9efb3
SHA512 c1c48f24ef052166231c3f9048efd6d47c54cc27e7611c4fae0c2c9a45093f946697570a4614643ce9d7cc95208da2d2f2b427bc15edaea4b9cf3151168da818
SSDEEP 12288:+iZwbDzzFEoS2cPvyGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:hZM3zFVSOGfJ4yL/tNCJPXUQrPq
TLSH
T1820501A5B39018F8EC67827D89549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 90fe1f58fef3dbf4ee881763e409849ff2199cab1186d9e7fd685d48915d7367
MD5 3f5b4b68c767b553da79a6b2c3ff4a0c
SHA1 eac231ff170523115ba83538009317aa6fbd5ca7
SHA512 1dd292e6af1a569ac6c79fa465162586cbbf29f376307699d3475336b9b3e62a260d8a6175a1e6ef79fae5de417b9b2e09647d07dbf66ccc55419418376f5f3b
SSDEEP 12288:0HfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:0HfJ4yL/tNCJPXUQrP5
TLSH
T1EBC423EB60D5948ADE1587F81788E001C7087ECA772F62E7EE42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9a3752510b84c5d9174e9b8e9dcaa4a50bd6beec3109d09fd482a78781b91d79
MD5 b181636d3de63a1bc516b95da8015573
SHA1 94e86e5d3e67fd980810ab590a069c34f231d37b
SHA512 7a588a05eeb00f355146c90a88e17e8e9c8194dc0644dffeb395c5230fcc5238f46857e6a15548b88594e81e7766ecf8453afb5f02ff7be4605903827d6a92c6
SSDEEP 12288:JLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:JLfJ4yL/tNCJPXUQrP6
TLSH
T17BC423AB60D59486DE1587F81788E001C7087ECA772F62F7EE42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ee1a06337fa473d1bc8c5de6310ca419da68ddec39a3116f83a68edf2c876e1c
MD5 f1c931a43688f2732840508a9dc5cace
SHA1 7408e739600edd10cc6f5fb6c7ac1dcb74e74892
SHA512 4b24f3f083f30297f8d3766e62dbbfe435d9ab22ef95013f53ce0fcad55d4b13c6f2c6dc24dd8799059b22a06444e2db625f0cc4ce695345e084fb9d06e443d2
SSDEEP 12288:8yPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:lzy6fJ4yL/tNCJPXUQrPA
TLSH
T154F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5cf5ef9af8b02c366d1a92eaefd4f8efcdcb54b993f9ec05ba005c7918287c7a
MD5 efab917aee328c9183be26ca6ee8631d
SHA1 ea6141def848d307b0ed1e182da500d1d85f438c
SHA512 f86c1fe086d4ed66745b0d9648d05ba17235b6a98061b9a2e162c26e1f159eaedaf74ccd1052ca94b49d880a92f3670cbe67915fa44deefbfd62d69a70cc6e8c
SSDEEP 12288:VHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:VHfJ4yL/tNCJPXUQrP6
TLSH
T1C8C423EB60D5948ADE1587F81788E001C7087ECA772F62E7EE42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 eb90804a0b09ee4ea86090014ee610fd492b8467d17ae3d51ba57faa174393b4
MD5 a3ba170c536f8f08d7a6b69d36ba8557
SHA1 85a14c239efa2442fb7337bebabfd0273a431627
SHA512 177336eb9b763469534371554aac506f0dabb0a44b102753836c935a18a338d1fa68fe74a41237dd861850252e8fa77cd229801ec99872346897b0c639cee51e
SSDEEP 12288:NHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:NHfJ4yL/tNCJPXUQrP6
TLSH
T14DC423EB60D5948ADE1587F81788E001C7087ECA772F62E7EE42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 84fcb8fcc3b069fe2bc5ab92b3355860bdbd8a4eacdd54fe87ab7d2e682dd86f
MD5 5441b9877197372dd83397aede25dfff
SHA1 107b4ba955a961abd91d1f0066d2e4549465c178
SHA512 277e9649cc25579b55c24caa4ce256c72acdb3d88fd50e1acacfbbe937a3d2f35b12091ff8a01dc0582a33580b8b6f6c8612d4a3b236d5440f71cec66e11d161
SSDEEP 12288:UyPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:Nzy6fJ4yL/tNCJPXUQrPC
TLSH
T12BF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 517fb34bd82ed1df2affcc53f00c4fd99c8bface92d88b152e1af1a974c4c466
MD5 78ee4e613781b6bd5a8cacf1b88ba7e2
SHA1 baed52ab2ba7265cc5d7e49ecb39ddfa7b8de174
SHA512 04f732cd6897e610e0fef78fba24ac65795fb085b86193dadf5d1e346c8f8f186e5e922b9ac7a4a5e346587f7d9a891f36f69f9a15efe962af3d8632165b2105
SSDEEP 12288:UCd91WYoaLHF3z0z04PDvhAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT2:tT8aLl3z0zDAfJ4yL/tNCJPXUQrPS
TLSH
T1AA0501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 302ecb22f37d62d1672ab231e52a81a0c9a4b450d8064370bfbf998a3653951b
MD5 178284bdbc614702c3f15f233afb9adb
SHA1 f2fa9e37a7d07b90a84e3aeb0cd1201246048165
SHA512 85b0af3932a0a0c390df7fc529e261cf4821eeb469ce10589e2a62f03bdd27f4c4e5f95e39b7f21a7cfa6e3c7bf225cb6057bcee0bc67e0dab0ef37ab0e08d4e
SSDEEP 12288:/i4e7+RdTfgwCHKy7GLbbdIvxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGy:/3rd9CHKy7GZsfJ4yL/tNCJPXUQrPx
TLSH
T16A25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 39f10db57ff18666db3caf510b259cccadb65d7fb8f32ede06dc609bb0a096c5
MD5 fa6abf93f5edbe17e4b586d47af50db1
SHA1 2cf697d95c61d7e6533f4e0ea1befeb2bfa48b47
SHA512 773334a8206ba915a2a7ec09d58dc2ed99256f9db91291dbc2d7f4b5078b07468fbf91510de42e82dd71735b74e194697cb459b039952445d752e0b51c31e7d8
SSDEEP 12288:RwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:RwfJ4yL/tNCJPXUQrP1
TLSH
T15FC423AB60D5948ADE1587F81648E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f64a220534d5c4720e67a494511ff571e72c43585c676433aa7e7f90421fca76
MD5 ce5c9b5631587dcf234d08200ae4e063
SHA1 99bb1cbe873714c8159f06c7a938b89abc63c9a6
SHA512 2fd74f2251578a79160b422aaec9c822695914f7c88fc0deba64df8e24ef46199fe9adfc06149c87e0e192048ce30fa85e830913d9f15b221f3b3a349d1bbb21
SSDEEP 24576:5kwvrk9RX6wkyAI8fJ4yL/tNCJPXUQrPYmcvQ/asw4NdIeJkmUje1wUEyBUsyJPR:hMnYI8fJ4klKXnQvkYej15VHW
TLSH
T118850129EBDC44E5E1B7927C89A3820AF7B178591B31C2CF029653AD1E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fe45cc31edfdfba85279a3aba197e07df1fc7f8ebb0e9099a7186845d1e2156f
MD5 3da6c686f2d3e6e1da54ec21e0886ce5
SHA1 9ce5743f76000e804049d989b731a7dd1a5b150b
SHA512 6b70c66ac46d54b15ab8c091e07b3f74e7ce5b9b8dbc1d975fadb019f66340939c89d961456b738f9a44784577a525b4e0c1d97cc607caa7532c329e6c0d6eb7
SSDEEP 49152:oYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nfJ4klKXnF:nySzP/fJ4k
TLSH
T169066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 26abac90490fafb0665a15a0148dca292ffefe862c3b76137a8657b6c76e7433
MD5 36e56021b6394047014eb19b4da7f809
SHA1 c4f46818ab31e885dc53c9788c40a71086793a4e
SHA512 967246c21a5f14b281c096fb4cb74d942cb929734f87ddba7bfe49b1088e1b65e740e1324fc68f0687ed99b78afffec69f8d259d08a1e77f2c1fb6d0ae4bc9ca
SSDEEP 24576:X47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY9fJ4yL/tNCJPXUQrPZ:X47JUQjqirIhCnDHUPfF/3fJ4klKXnB
TLSH
T11F65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8aced429ee80a648d2ce82c36803a72a301de1185636d4bc50014e546f569778
MD5 85cc85350b1ed430e254f0bf5609874b
SHA1 ecbff687655baeca64d5fbbb02e0868aef235a29
SHA512 c5582ccfae36301807b182e159cfc5587c3e6df239962bc7d24bbd598bff05487d90e091082b7da58711b04a953a874c79973d2fcea7847113a0b6b7a64b5f57
SSDEEP 12288:rpsf3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:c3fJ4yL/tNCJPXUQrPR
TLSH
T1AAE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 158c9cc8d3a47afedc69412f78e844bd270a26ffa774de4b6c59600e5ad58478
MD5 674d627d76fc8328298265eb05de8a77
SHA1 4934c3a99891ccb457ee28be9fda79fb03b81749
SHA512 4a7d934aa707048974cd91f105702195b356378682bee2fc0cdb5911dc94ef00c58ca5e0b1ab116ba5edc742af650f7da7cee6c3db16f8eee358202895131b30
SSDEEP 12288:scetnBqE1eep/5t8DunW+plN294B6xlCN:s1np8DuW+pla4B6xlS
TLSH
T15C4518117626CB4FC6AD40325E32D5CCAB707D41FE056F0373C98B3F9576A58BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 59a22237a7a369838d5396af5613780af2878c03fd7d28610f37729d3006079e
MD5 17a7635b25767782b46eb81992e2fa45
SHA1 e4af5e29263fcb708bd9f49c0fd2e2b8a3f58b8b
SHA512 05fc0ebcdd1a70997eaeb907b9914fa623f8a3edd33219f815d7ad919795ca07867bead368ae938b87abc2e69ee4a645757781d0181f34fb428e6e67f48d2647
SSDEEP 6144:RCsLBPdMn5qlPBI3iWrSuKWTJj0KYKDeoHgYguLf1+YKDeoH+uRP9g6Kz7cENTBV:RCs/Mn5qlPBI3iWOe71+QuAz7JNtoRc
TLSH
T12765E9415137E78FD1FA5032033A6A8CB764EC06B7496F26B38D447AD86AB45B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77A7.tmpKDF20260930000009056

Path C:\ProgramData\Tencent\QQPinyin\users\public\dict\Temp\77A7.tmpKDF20260930000009056
Size 1KB
SHA256 bf5c2b001152093a3f3853725f84371320e0624ff167be34e0d524681e3f4bd4
MD5 494edbf84c704a31492ccd0e04acf3ba
SHA1 62f4e55d07d0d47b7497d8cdddc6942b292e227b
SHA512 410c3b0d8bd2ae25a3b4d212435f6e2f327ba75676d06bd01d725371de141cff2474b6e4f048e3737b53f79e4d47eb0360fd074a8c07ad8c4a414c8c6c4df324
TLSH
T13931447C5185C61507A939E8C3E37AAE4C4D90037A30C6B6F437EC99E18BD5DF25A41C
MD5 SHA1 SHA512 TLSH

Submit Download

77D7.tmpKDF20260930000009107

Path C:\ProgramData\Tencent\QQPinyin\users\public\dict\Temp\77D7.tmpKDF20260930000009107
Size 1KB
SHA256 755e8ff075f39e81552b19180aea9d31ebcb657df9ae332673c67596976d48bb
MD5 290980559ef99940be3af2baf2d9347b
SHA1 a64d4420a6b5fd2c699b652da26f6d91ac441313
SHA512 9b287c837201572cb13db2567eb381528d7f2ed283072f0872538b1baea42cb901b0b15a4f28402cbbfa7412513417d783e56b66bf2d37f05d4e3cdc4f7a481b
TLSH
T13131447C5185C61507A939E8C3E37AAE4C4D90037A30C6B6F437EC99E18BD5DF25A41C
MD5 SHA1 SHA512 TLSH

Submit Download

imekernel.log

Path C:\ProgramData\Tencent\QQPinyin\users\public\dict\imekernel.log
Size 2KB
SHA256 87e647ac3b24bde3e9fe4fa1c181b50acedc7c5e8e0b9168d69bb7db7676bb3e
MD5 05ecd42b344a8cc7c88365e684ce1971
SHA1 762e59d0fa85334a9b5969da5c678b2b3a48f6c3
SHA512 1a519df8f9b9f4d73bd16adb4c9bb5c770ef623c036494052fd3db2c182ff13cc3e7c3d7df672ce4d6802944e97708f05495f85dc64eb6bc455318d92ddec173
TLSH
T1CF51945A1AFA0777F8F7DF29A8F2E52779387DD2F824DA4D0281034D0C22711A854F26
MD5 SHA1 SHA512 TLSH

Submit Download

imekernel.log

Path C:\ProgramData\Tencent\QQPinyin\users\public\dict\imekernel.log
Size 9KB
SHA256 7cb24d8a236a6ac38209d99bbe08e811021f77b690c63c10425790053585cc89
MD5 d84c156b4915b35e42cc090b30a61907
SHA1 3b87e3d15b65dbf7af6a39341b4694b65beb8dd5
SHA512 603ea02a6a2b2155358beb88380f69f841b6745de43755f864a63bc1a76b10f49cbd9045fffb61442f46e9fc5f105c058a36184ffecc56a041e760830271fec9
SSDEEP 192:iYsnYAYVnYTYqnYqYKnY6YznYNYfnYBY4nY0YLnYVYrnYFYynYo:iznVmnWxn/xnvEnQwnE/npcnYcnoxnX
TLSH
T19112A45A1AFA1777F8F7DF29A8F2E52779397DE2F824DA4D0281034D0C22711A854F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 551241f90dd60b7b6a5e5ba03a64921ecca9e1f915f1175de8e281ea498d8a84
MD5 a790b5e07fe67cd9994c107197fbc273
SHA1 c5904bc0e6ee8407f303f7b8049c996094d29e19
SHA512 0b11968e29a13770b74004e636abf018f0a20ddc8b405527ba1d6ba84d20d1b36249fd6057d2ee95835a0438ec69a6a47b46deff28b8157653f65c7fb5c7b40a
SSDEEP 12288:MM7QfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:NQfJ4yL/tNCJPXUQrP1
TLSH
T16CD423A751D49846ED7687F8164CE000D309BED51B1AA2E7EE42B4853FFC98A1DBC353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1137219b64346dd05bd1d1664c87b13629478a703cab5f8d3a412e402dfd4399
MD5 5a9bf98c71ada18084dc3ea6170e22a7
SHA1 78e33e186df66da1f64dccff2a9b9a6b95de3fea
SHA512 d4e5bdc001d4aa924df4fdc6f10fc72b74315fd378dbe558d014c3c7a0fc28a879c57ccc4c0c227ecd154c4bb1c0e12b1f3e05caddc921339b6f6c47aabc7f0f
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYufJ4yL/tNCJPXUQrPa:ugb4mBIBhGF9fJ4klKXny
TLSH
T18365AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 637659e7cee6f57d003edc24254d99c8e829bc2bb0194aa840a6aded6c3c7de0
MD5 81f83d1a6651af00bff66a607a780833
SHA1 978e7fd3976201f1c0fc94d79ce80313b177eb0c
SHA512 6e5330518758c0dce125a3f77ddb2662f10dd205b53baf8699b07db4ede9a0e6930fdd40ca408e86da891751f6614ff7a9399ad1a8bd5bdb0254838499e0536b
SSDEEP 24576:QGBcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:QGCkYej15VHW
TLSH
T10F05235CAEFE56E0D175A6788931D0A43AB43150B740A0FF09D399B19F727E06BB8E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 654c7835e266f7f24d12c5c80e4d16c83201881a9035324719d9215feb206ec4
MD5 d9101b5aa64176533c0148805ad94678
SHA1 4841643afb084d0941b988a49236bf5e583ba60d
SHA512 92c55e8248c2be3aef6af074eb577498c64ff32dc8d179fcc83d9bcbd3a89263a5453ba401f282e345f864413f355b676c0411cf14f9996d2f83caa1f0537d0a
SSDEEP 24576:CG88u8FpJqH1vzria7/mtfJ4yL/tNCJPXUQrPa:Z7ZFPqVya7/2fJ4klKXnS
TLSH
T17E35026676E101F1D47BD1388A868663F771B8150335FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d3d2692e9a42d7862556008cd4118fbc5acf93a7fc9b500d432f3bc2dc839bae
MD5 4e779d39efe2d6d0203e943d0bfeab5d
SHA1 040792e0e1ca78731c3453576ed67c492bfe423e
SHA512 a6e56161df480173349a899c850a1fba009e693314b1261c6bb005ab01bcaed1188f79a7af9f7e5d1e68be2ba96660d6e698d0d062eea0c6ed93b451463e0627
SSDEEP 12288:7HvUrBFrEjwaQpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:7PUr+NQpfJ4yL/tNCJPXUQrPp
TLSH
T14B05F16F22E818E5E676E17C89858209E771B8921312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 45fdcdbb3c328aa177d1c07566649db21a5739a0596939d707fb2025bd51b54a
MD5 7b9a9b3b0ea434a75309c78c0a765a6d
SHA1 52b32a1a6e444ea904a9db13ab16b1ab47c30d58
SHA512 c7bd235902210541820944ed36f0576f38498355bebc1416999376fa90b428d807c80469640e3808ddb2f1d4c4f516fa76444a57f91e3e9212683b03190aecd2
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZfJ4klKXnK:XG05lO43bEfJ4k
TLSH
T1F0D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 757122a406c6ca44be2c3ae939bce4246a1f596c6bfd71a8436c25e731d5094c
MD5 4a370ec2bf2dbccb3acf7cadc4b7fd56
SHA1 cc726de8f0398c00f05eca8050bd438ad01baea1
SHA512 f663e7ae0636ab4861f3af2d4a8d8f0a429d28dd59d19f565f9f8be5967ba2be21b0e98a3f4887e56e046d648031d35053b5751efabf33b076413405569ea333
SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnnfJ4yL/tNCJPXUQrPx:Ma5POZ3lJt2pasx2+mxfJ4klKXnJ
TLSH
T17F65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d102392cc24e1265327b4b700be8102a7e32abd19edc8380ad53c0297c86889a
MD5 f2bb15fc5c3eeea9c498e81b2c2fe010
SHA1 15e3811d84f320afff04d92912efd726c9e917c9
SHA512 10e5e80f0025758dd7b9e0d49e900f1c1666fa4332989565291a432b1fbe22bb1ff204185c4d9a53adad54de88a783249d0d4a68ca69b87e72f519056171e144
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FklfJ4yL/tNCJPXUQrPp:hNc/zEOVHFWfJ4klKXnR
TLSH
T1C6858B2623E901E4F5BBE1BE89679546FA717869133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 b965cfc5fe5fce602489c8c33732036db31223394827d271ed0a2e4ddfc602e9
MD5 bcf149046cbc1516fc5d84c7d0dbd0b9
SHA1 ea1bdee0535cfedca9aee2abf76257630155ac1b
SHA512 ab2460d83e4e1c8af2f67fcc99f1d72957161340eadb4684353f22ba8e7f23813529b04625e4bb274b5968a21b07579b96b1042c2e4a474111725440de1f95bb
SSDEEP 24576:L6DI8cvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:L6DIRkYej15VHW
TLSH
T17525124C67BA01F6D167E03DC6934141E6B1B060D75259EF0AD1C9BA4EB3FD8BA38E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 5df695fceaae353e50431fa80e400d320ee41f0122edb57c9fabb182771382d7
MD5 f7373ae5d3b6b570de115b693aa60c91
SHA1 56a5de391a15fba5b91d173f0a4e2f7ea1e0a6ac
SHA512 aded27280013bfc535f6e36d0539c12acbfd24069870d48e8fad48250245329e9dba204cb7d541827e2b90e710c838cfe363755a73854bfe79d1ea2f6fa2123a
SSDEEP 24576:ytykcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ytukYej15VHW
TLSH
T1BE1523049BEC46D5E6B516788A72C1E45F34BC10BB5092EF55D2AA7E2E327D0AE70F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 39e4ec059b43fbe1ec7b7ed2a8e543738ec0dc2bdfda3d3a4bb4b3b742166b27
MD5 f4c7ab49d4c64d7cce5a4f2f1ed11ef7
SHA1 54a7ef8931ecacd2344a09cc1839a7c386c57de5
SHA512 cb8da58c3ee8d1e5e87b203dea9a5bae7e0e1c9eec581ccfd50ef69b7e8c2e1aca7190db388346814f52cc00394bd9255d6f1fe286df7ccc72e748a243b411f6
SSDEEP 24576:EEcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:EpkYej15VHW
TLSH
T117052348DEFE4BE2E14079B84A31D2D81A786254BB8090F769D35DB18D723D29FB4E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 b28f8b2a32b2da0954ea3519968e0700995a74e3f8d4a034a3436af9c6c1caed
MD5 26413a1ad41d401fc70bbc624a3ca4de
SHA1 21a33bea7a8e3768d3d8ecb77651e8baaa905686
SHA512 d6e656295272803e358ee14fb6dc512977bb89953c305921c5e417f22cf36b1e18f533a1e207880fa69dea9440514702666c3144eeb1ac65b8bb44ad34445aaf
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmPcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:gTMwBtOm0kYej15VHW
TLSH
T16275C06EBAF846E4D1FAC6B4CD238512EA727451173292CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 2a6a016545cb407b11b73032a7b0d49294ce20a8d084471d01d8821478612470
MD5 583aef26030d9723fa7485538ca234c4
SHA1 15cf4136cd83d136ea9bf493529140be6a3f0bbe
SHA512 29508b0015e71d4a945cb8160f5c7857fd64f542b4400e615ee89bd83a4392b42f9457b10a39e926d342bf50e058e65779b2231d9f70b48219da7d21ada153db
SSDEEP 24576:mD3FHshBIYQgAUfJ4yL/tNCJPXUQrPyrcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jW:mDVHeBIAAUfJ4klKXnagkYej15VHW
TLSH
T12E85027EEA9C04E4D57AD2BC8A53C506E77138A9032265DB06D181B62F7BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 39cc8575a1eb409a667644c2d3f92d031f290995ae94c4c948639a7b08e46214
MD5 9a0c925722a0e368258bd0142590709a
SHA1 bccc8749bcc30d016b90fb6cc05ce91f9613fee2
SHA512 3aedf45f9b37e71fbc48922f3e71b77af51afe4dc817ce09a6201743e9314fb7932e59ad59b9a1a281db0a875b1bcc568f9f369849f43c6c700d2dd38060a513
SSDEEP 24576:JncvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:JckYej15VHW
TLSH
T1FD052344DEFD8BE2E24079B88A31D1D81A784244BB8090F369D369925D727E65FF4F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 b8699a182152677374a99b5123545b7770fb12b62dbdcbd73cf53f07fa4e6492
MD5 bee3b5e9aa0fa57f55d47eb05b8bfd86
SHA1 8dc65aeb1e91ccd67d92be69eb52ae8e0c6b314e
SHA512 4375ed1ee7c0661cf3544079bc402fce938c9fb8a46b0e67075cb4ae6c8066e2b895a4638ab427fe2d3955b81607f6843b5a12329de51cb6dd7a1abf68c1ce4b
SSDEEP 24576:x6UqjphcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:x6ULkYej15VHW
TLSH
T14A25234D9FE845E5E0755274DA31C16846B4B83227A094FF36D19ABA8F32BD09A3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-452-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/716-201-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/716-202-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/716-454-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/716-437-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/716-208-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/960-144-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/960-260-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/960-138-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/960-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1036-167-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1036-175-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1036-169-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1036-316-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1056-155-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1056-298-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1056-162-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1056-156-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1220-246-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1220-237-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1220-227-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1220-257-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1220-259-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1308-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-94-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1308-112-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1308-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2996-268-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2996-456-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-262-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2996-273-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3976-185-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/3976-180-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/3976-179-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3976-393-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5060-13-0x0000000003610000-0x0000000003677000-memory.dmp

Download

memory/5060-20-0x0000000003610000-0x0000000003677000-memory.dmp

Download

memory/5060-166-0x0000000000400000-0x0000000000B02000-memory.dmp

Download

memory/5060-7-0x0000000002900000-0x0000000002985000-memory.dmp

Download

memory/5060-4-0x0000000002900000-0x0000000002985000-memory.dmp

Download

memory/5060-282-0x0000000000400000-0x0000000000B02000-memory.dmp

Download

memory/5060-0-0x0000000000400000-0x0000000000B02000-memory.dmp

Download

memory/5188-469-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5188-196-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5188-190-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5188-189-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5188-470-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5188-422-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5536-221-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5536-215-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5536-213-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5536-455-0x0000000140000000-0x000000014013E000-memory.dmp

Download