03b49ecfa19a76d34242d50849ec222cfbea1d7bf67e7bcf44dcc29d3619e894

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Size 4.1MB
Sample260930-d7estathqc
SHA256 03b49ecfa19a76d34242d50849ec222cfbea1d7bf67e7bcf44dcc29d3619e894
MD5 2e888e097907790ecb7ba2d0cdf59aa9
SHA1 e802802c1a6190ab72813cb6c8ebb5595ee78b96
SHA512 2581f42b526cb735d95048b33dfddeeb14a15b0a3528bec15ef9d5baf142e4c7aa78e9825cee0c1da0681fe7956129ad8dae71f65212bfe71087d008828cad69
SSDEEP 98304:RI42NLqv74CnJYE/RYIsfJ4kWrGvwb5/rn:YNEnJYE/RYIsfJ4FVD
TLSH
T1BD16E081B18580F7D472F67058E96BB64E78AE30577400C7B3B43D184A721E6F63BB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 7 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000d00000001c529-371.dat
behavioral2/files/0x000f00000001c335-374.dat
behavioral2/files/0x000e00000001c32d-375.dat
behavioral2/files/0x001000000001c332-380.dat
behavioral2/files/0x000f00000001c325-411.dat
behavioral2/files/0x000e00000001c324-412.dat
behavioral2/files/0x000f00000001c401-413.dat

Executes dropped EXE 8 IoCs

pid	Process
252	elevation_service.exe
5496	maintenanceservice.exe
3452	OSE.EXE
3804	PerceptionSimulationService.exe
1140	SensorDataService.exe
4528	ssh-agent.exe
3388	AgentService.exe
2960	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e947bb7eb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009323-381.dat	upx
behavioral2/files/0x00010000000093b2-382.dat	upx
behavioral2/files/0x000100000000994e-383.dat	upx
behavioral2/files/0x000100000001b987-385.dat	upx
behavioral2/files/0x0001000000009cfa-387.dat	upx
behavioral2/files/0x0001000000009fd0-389.dat	upx
behavioral2/files/0x0001000000009b8e-390.dat	upx
behavioral2/files/0x0001000000009369-396.dat	upx
behavioral2/files/0x0001000000006276-402.dat	upx
behavioral2/files/0x000100000000bd4b-401.dat	upx
behavioral2/files/0x000100000000621f-400.dat	upx
behavioral2/files/0x000100000000a315-399.dat	upx
behavioral2/files/0x000100000000a300-398.dat	upx
behavioral2/files/0x000100000000a2bd-397.dat	upx
behavioral2/files/0x000100000000a1d0-395.dat	upx
behavioral2/files/0x000100000000a0ca-394.dat	upx
behavioral2/files/0x000100000000ba3b-393.dat	upx
behavioral2/files/0x0001000000006211-391.dat	upx
behavioral2/files/0x000100000000df1e-388.dat	upx
behavioral2/files/0x0001000000009cd2-386.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074d69c8b8d50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c90ad8b8d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b52f1588d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddba19588d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b91d05688d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3388	AgentService.exe
Token: 33	2960	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2960	SearchIndexer.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	252	elevation_service.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	5392	2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2232	2960	SearchIndexer.exe	98
PID 2960 wrote to memory of 3956	2960	SearchIndexer.exe	99
PID 2960 wrote to memory of 4408	2960	SearchIndexer.exe	101
PID 2960 wrote to memory of 3468	2960	SearchIndexer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e888e097907790ecb7ba2d0cdf59aa9_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2324 2336 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 afacb037d992d6c483e940db5f20b63fb83af3a4b48289a468899acbe7a9235e
MD5 a461359ef600c694a5c19b114f137b44
SHA1 2ce8ecf2f4f98e24aa85b40513d4871ef7aa958a
SHA512 4690b8a41ad44efa99eec6e73c7d414a548d6c1ddb7e43742f75fd1a5b4b48ad8ec6bc2bfa022b680d12415c2692c77d39208cdc504ea0ae2004c10bfa010fc5
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYfJ4klKXn8:33q6mjBDfJ4k
TLSH
T129D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ccda89db259dd1e2d7baed12589bb03c0479c2a9c3618bf2ad7b593a4db30599
MD5 db2861ad05c612b514310421d0c72f67
SHA1 098bec4a270067257a5282abf792db5a1bec79b5
SHA512 a445068d749e96db4042711966082bbd0a471c10b5e859ef4fb4e3db4e17a6ec643a8c5483c37dfff451f05c836b4f8b0b766f972d5827a8e36d8a51e37d88de
SSDEEP 24576:HXYyIwczAHfJ4yL/tNCJPXUQrP7BvXL6mRNJr5rLd1H5GhlOIjDGXayI:GwcifJ4klKXnTBvX7Nhhd1ZG/OIPqDI
TLSH
T1BC75122963D408F9ED63827CC9A0D001EB33BC950764E79B43A4D9662F777A81E3E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a46781853998f29ec94ebb601901db7c837cfaa12f3de0fe3b20916c39303eed
MD5 974aa0fc2a2f21e2e0a73c1906e456bb
SHA1 21e0ac8767362b5d781b75d40b156ca18808bf56
SHA512 61f4a3592971d85b7fe8b93fb4b539ef3b933decb7395e540f17cc1a514b2597ae7864b530392a6b69869c8d858bb5838209e96d24fd6f13f579d881c4cb3439
SSDEEP 12288:Z1XLsswWkxy2lRq2czAHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:3XYfDtczAHfJ4yL/tNCJPXUQrP7
TLSH
T1BA05F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 663ce9fc2cfd41db1751a955bfa8a75c7cd3c4b375879e0939aaec97749f1072
MD5 224938b5ae1e023b275711c29773876c
SHA1 d57ea4ab8b43902f33aeda7f2cbd184122dabdf2
SHA512 e7da3fffd1e8fc10876357bd663506ac383b005f48400b668a74d836890174692e8dd2da92ca32b7e0923cbce27e7608bf485e6ead6f6efd66e0ab4eda92a2fd
SSDEEP 12288:fmw5HEjsChNEBFgl0WDm+CyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTJ:ewuROWRfJ4yL/tNCJPXUQrPd
TLSH
T16605014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 fdbae8c22c7240d084d8d02cb64538fcd2a13c2bf282f6c228af4186c1db2946
MD5 d7b6961cba520b91da89a53be3f7654f
SHA1 da1d441a18ee8699603f9be3365172fc0a66d778
SHA512 f9ac83c2e921beeb6302b2d631acdb2cb7dc14243c9bc211e009887fabea7e31d3ade76c2b81d14196c451f2cfc89175d282b4b3fcb3a178d9eefb0d9ec0ed5f
SSDEEP 49152:AB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1ltLyvH88YzRp5/NJn:au6JmTxd2d1rGvwb5/rn
TLSH
T130E5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 2a785a339365d30b1b5c5d7cca184d612e520b3aa90844b571266745c2fa8016
MD5 61b6f5942ec8dc8f76ed8faffb219ff6
SHA1 b6e30f97fa584e5b9cfd50bc3b551991f75d6608
SHA512 f24f84403c3202477c8b9635d2eefa134aa71fa8506649298ad4287ce52fd088f2b000bac52b7732502fdf8efeefadc5367c049ebdb7c1a570fafa534d99395b
SSDEEP 49152:lMnYI8fJ4klKXn/6ltLyvH88YzRp5/NJn:uafJ4kLrGvwb5/rn
TLSH
T1D985012AEBD804E5E177923C89B78206F6B1B8591B32C2CF059653AD1E37FD46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 ee576636f2f2b018dca54cfd23b8f70f4cb09deb7bcd0c362f2169d6e48cd556
MD5 9a6f899bef78b93d4534a11b57db177d
SHA1 bec6413091376ef6862e75572cbe21cbde2a08f2
SHA512 1223c41c0ac31024067e51a2ff1ccae932dec22b701518007bccec08e9541a6374cbf5d239f3f013620c488890873c2a3c2e775ef7abbe21e8eeb4ad8d92880a
SSDEEP 49152:hYZzNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nfJ4klKXnSnll:MySzPPfJ4kprGvwb5/rn
TLSH
T149268D97A1A801D5C1B9C1B98B1BCC17FB7134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 162005120c14c88080400775684576fa957bc1b68454eff9dd79ef523cbe1cff
MD5 9cde72d10c6ef635dab51488eed271e2
SHA1 af9f2e024002a616d260e2348bbf11b82f2ed1d7
SHA512 bc061cf5e82922d21ac9c358f76d82d9857f553eb9a44bb15abcd837b06bc8344704db756b223bdfe064c0a489697ad64fcb723658b77a064d3fa4cf05bf63e6
SSDEEP 49152:x77JUQjAirIhCnDHUPfF/XfJ4klKXnKUltLyvH88YzRp5/NJn:BJiglD0PRfJ4kOrGvwb5/rn
TLSH
T1D1B5D01EA3EC01E5E1BA92788515861AEA71782E1F32C6CF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 32fff209e1020d7b836845c26224a59c33221912a90749658e426011f58a75e2
MD5 0d11ed7a82022c1dcf7ae65758de6079
SHA1 af0eafea76ba8b50f44485888538bccc603dadf6
SHA512 7496fb61164c8463ce309e1a8ea86b7b37147527d675eae2f6e46438bff7de690490e69ba0b5e971b0f78b3326aa47ed4e8ac8f75928ad6c78f5d83bbf8da599
SSDEEP 12288:oHTnv2x7bKpIVSXUPC3Qe86VhqhIdbnvOW:o7KVSXUP0t86LqhIVvl
TLSH
T1D64518017666CB8FCA6984325E33D1CCAB707D11EE04AF0773C9873F9576659BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 378KB
SHA256 a1b5571436a405faafa99520549bc7ab9dd487e0144652e9a96aff82b6692ea8
MD5 2591477e2e3a1853072019da36d5c298
SHA1 47e6e1737350d256f5e5a0f574aee237e4512eee
SHA512 8e890b6cf2c8eee6527a5377194465d0521148f36272033f858a92e5b63a5cca752806f9a5f5044dd611f927af346cbde1a2cc5c35cfcb8cad4a5394f79a47d9
SSDEEP 1536:4Wwkl2iOlHPk0CXRhIOIai36PETvfpydYxcg1TAvV/xLSv9ddOMM2l8llKMaVk9L:f/lNOl9ZJKhLhel8ld
TLSH
T11284E652B364E21BC5B580379471D29FAB3DB826EF412F023BD84CB5DCB214A7666F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huya-installer-5392.log

Path C:\Users\Admin\AppData\Local\Temp\huya-installer-5392.log
Size 948B
SHA256 bfc2fdd177365e82a702301593d5d28dfe1a763cc5aa8e560c50c269a454f505
MD5 464d1bece0b80bd41c4335c32097a3a0
SHA1 9ff1b9f0e212952d7c8447fb8dc38d8429b585fe
SHA512 e61fe49a21384b4286aa880dc69baa077fbb510357e7cc2a86161db1778fd620767bd35d437431c166589dfce8a577038f2e48ead4957602fd2fc41783a03791
TLSH
T13C115BC979DC04BC362DA91D81E999CD1C0C732B9556EF30737584C51B8A876ED3C151
MD5 SHA1 SHA512 TLSH

Submit Download

BackupDismount.docm

Path C:\Users\Admin\Desktop\BackupDismount.docm
Size 774KB
SHA256 f2613f3d7909ad5673ea843fafd14064763ca7509042b66aab066daf8ec1d1fa
MD5 589eaf95ad177b7e3f7023ca54f80a23
SHA1 869186bc5354360e679fd5020fe631befec6c777
SHA512 9b5793cdeab82d0c318da81c379e12af37ecc017cb0f9d3cfa69eac1bdddcfca27730b9cba177c461be6381b5ec1b92425b07e0bceea6c94d1b6d7e4e5bec31a
SSDEEP 24576:gQ687jr6V/DMDag5gdCpdISrsDyxvXJYHzPAO:gQ6UjexMZqdujADyNXJS5
TLSH
T180F4335C2EC0ACE5E71543B9B5FC954890EF077718D7DEA4A728B3A24AB91CB1723123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportReset.docm

Path C:\Users\Admin\Desktop\ExportReset.docm
Size 774KB
SHA256 7d46b388a8307f4ab379fb0b936e973b7327afd8a3e968f1d803230461adfc7b
MD5 aadac57f1944675d5199f8eda2fd1ffd
SHA1 752b2b80afb9fc0882c289e74a34f01cbe6f952b
SHA512 b57babb1fec8580b66b9e4373402131c3fe466bce0e7c3f93f134c78866a5a27b44bd53c14954b8e068e13d88eae67c8947d441a2f0087004845d6b6773b998c
SSDEEP 24576:Asb8pnrQr9Maj6Lt5ghs7X/sQO4ra3nYW:Aa8p0Caj65qcOaa3nYW
TLSH
T149F423D442026461EDE70BFFD9D3E6674E627F7686E70C50CE722B509C820D9CA42AED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopWait.docm

Path C:\Users\Admin\Desktop\PopWait.docm
Size 777KB
SHA256 8e004962a436197865000bf3bb61ea3864596429c5d1758ea9e2961695f8fbcf
MD5 7d3afda04a20849baa121b1b8b3556a1
SHA1 2a6eb07047c92897f685499898030231f0b04065
SHA512 dfd6438317c12813a745b6f3d16c61a56ad389b87376df4a2a89d5b9f1c0a28e723b66c1fc8a81ad44dc0c58db7ba4c001af796dc24e5e022aa28e7442193a8d
SSDEEP 24576:gTEw6D32/Nr+T9Y7PD6eOdlt+Pc82loDLk:gTj6DAKTq7/OPt78qonk
TLSH
T1120533D0D951BFD4D2426E385473E684614C15739B7AF7C33220E36DAF9BAF20306A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendSave.docm

Path C:\Users\Admin\Desktop\SuspendSave.docm
Size 776KB
SHA256 214f04c760f9b661814bdd6b5c966823afa8ef316f8589eb33148af391a1c425
MD5 e435849f81d12847766865a7f3ec7091
SHA1 e9ea6e5b86472ddfc5d418d27c50513136c807ba
SHA512 4a727d555f086c41f141637305673b9014d77fbbfc0b29375727ad6608b1eb53e66bb2ea7d4de1a46efed0b59128edcf7b09829e84a9757568e706586f0f65ae
SSDEEP 24576:3a6M7jmq2r/3ckTwj0o674vMItfJf3polR2B/7Izt:3a6kjmP3cQwIo6740yRf3alR2h6
TLSH
T10FF433684F8060A6D34707F5F9B0F72C228F48C6D40176FB787AF1A8329E6AD54B7466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectRemove.docm

Path C:\Users\Admin\Desktop\UnprotectRemove.docm
Size 775KB
SHA256 00ccf98620f14d6dafc6b04ba7896e3d5feee60f9b2e7fab63318233d4f5f8cb
MD5 1b03a6f963e672e599c7b17aee29d3f8
SHA1 cac3f388ee6472721b498ec0b757cf39ea274f0f
SHA512 2216da3bebe052322a5c6b73c12e6807e248e20f8b23df02d20facd884422b052276b2589683d9cf5d24d1bf34365aa911a04fd93248cf7c287f998d4e02c5fc
SSDEEP 24576:B66M7jmq2r/3ckTwj0o674vMItfJf3polR2B/7Izl:B66kjmP3cQwIo6740yRf3alR2h+
TLSH
T1ECF433684F4460A6D34317F5F8B0F76C628F48C2A40176FB787AB1F8329E69D58B7426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterExport.docm

Path C:\Users\Admin\Desktop\UnregisterExport.docm
Size 775KB
SHA256 f1d9cf658e3c47e93d7716ce15644b581df0aec6919b0ef556635423e03b4e6b
MD5 7f981c3006a61343de7bced830478bfc
SHA1 7ad92a3d60d798884870abc0d0744a50c91a056f
SHA512 e05ed08adf40ff6214a31639c482197711d2627a07d50d204d95378c70ec40c35d9e3531299e3a170cd72037e32ebb400c07121f29df3a99f4f60cd09e18c332
SSDEEP 24576:t76M7jmq2r/3ckTwj0o674vMItfJf3polR2B/7IzE:t76kjmP3cQwIo6740yRf3alR2hf
TLSH
T126F433685F8460A6D34707F5F9B0F73C628F48C7980075FB787AE1B8328E69D54A7826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopConvertTo.docm

Path C:\Users\Admin\Documents\PopConvertTo.docm
Size 773KB
SHA256 eba299395ecddd536ed8fc595453bc7adc7d645003e5d69686c5dedb1f629303
MD5 72a06b5200e97ebadfdd7ba252bf011d
SHA1 a27daf9901d3303c4755108d3a2b3bb15861860c
SHA512 30aa914799207f89e03a4bd55717ac9b6bb901aca9f07df141433a81d0149db2159ed12ef6685db3c0604eed42a3c8ce3009a18df7a955a385d0d497e4f4a860
SSDEEP 24576:vP687jr6V/DMDag5gdCpdISrsDyxvXJYHzPAP:vP6UjexMZqdujADyNXJSU
TLSH
T1A2F4335C2EC1ADE1EB0543B9B5F8E54840EF077318D3DAB5A728B3A64AB91C71723127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 778KB
SHA256 0da72df06dcca981419f104ef9d2f0af6c1765ecc59bae5b27b90f96c8535717
MD5 cbb0ad2d95b01807a55bbdb7de9c4b8c
SHA1 6a1890157dd475f1be64ad2755c9a6ae868384a6
SHA512 c2e851c963acddd753f171f3c56d9724dcd0ee24c25b2f074ab6c526cf7188e790be3119d00a827c94941be7a77233925af49c2ac60636235195d9045c7bd72b
SSDEEP 12288:su7wrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:PeTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1E105238282F80067F5BD7B300A7962216C75F84A6FBA98EB6C505245FD707C33A79B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cd1d0aeb7d99e15d3b84eaf26a774fa3d30a3e027f15f3121f11b436dcf0b360
MD5 5d389b70507f3fca6390d3780852dbdb
SHA1 c6ce2b40e9cab7cd45bb7a8113b7aac6800e0bee
SHA512 ed7b8210c2e29e4ae4082597cb652f684cebb2c49c89960f838624ed4657e72db5f8154289aafdf61a75444dfa2cd6d4b4bdf062f33e68d782cc1a5c1dc035f1
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYSfJ4yL/tNCJPXUQrPx:kgb4mBIBhGFZfJ4klKXnp
TLSH
T10A65AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 b3ccf0de25bd1768e3fba8e4a736eb6c168843c7b4c49d76604d0a04dec6e90c
MD5 3ad001bb7cd59abe02400c7550720679
SHA1 c76e0f41c811781be696849f0fe33f3fe4dd4bbe
SHA512 17c79cbeb5b9302e8edc68adbc04f07959ee9711bdd34d83d88aca1206773109d6cffbdbb8915c04e87dcc2c9a3d2cfa2a3fdca0a58f77d7c62f0c6ba5c332fd
SSDEEP 12288:E6G8rgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:jGqTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1E805229A21F520A9D43EA73509756122BCB1B4516FB969FF08E09179EF703E23239F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d915700ac6972f4887fdd00daae794dbc783f859c7d7f7ebf764d8b68e391b0a
MD5 a162c0f302444016173895b614695648
SHA1 1916e54a2a2fe38719fe0ce3203dd820f5290e6b
SHA512 5cbfd8b160064f9fe5328c650edb4463c04a940097c03d690480138009eea654708e8cf0707f360697ba8a5ca67475c8c008956a0ce639803888463c98c9500e
SSDEEP 24576:5G88u8FpJqH1vzria7/mpfJ4yL/tNCJPXUQrPp:s7ZFPqVya7/KfJ4klKXnh
TLSH
T12D35026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6111f34d978dbbd09960e7d6fb7025717ea67390af82384ba07476a71cfebaad
MD5 2e659a06eed50f431d740aad9bb3b516
SHA1 a91c695394971123bc6c9fb3788671beef97564a
SHA512 0b24db823dfc9640356831336fc14614bec69cb30463a059adfb58592dac8bf31809a1a46ece7c3db8998b9dd0fd4f56aa8b880bd4f1975f2f7bda6064320cf0
SSDEEP 12288:gHvUrBFrEjwaQ1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:gPUr+NQ1fJ4yL/tNCJPXUQrPL
TLSH
T16A05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 3.4MB
SHA256 87d6fca7a427dc82e791fbf43fc2cc8731eee529453401c94e645d75f3e30860
MD5 6db97e2596a20470d9a1a3730ed17174
SHA1 83593610c0adde5d8223e62f30a2d45ab61ed5f8
SHA512 037be24132dcb72748aa0e4110a32d515e85cff553df48f396554ce50db0ed8ecda07b0cadcc8a8b647169625c65930c5530b788f8e35fd33b0d97844af38bd9
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFfJ4klKXneWltLyve:CG05lO43bUfJ4kArGvwb5/rn
TLSH
T18FF5E06A62EC11F9D0BBD17CCAC6860BEBB23815033556CF02A486A91F27FF5657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fe3ce2dafc103ef9b04b8d47bf228f061317240bdf0edcb18b43809130349fcb
MD5 b154c2adb8bfc80ddb2664fb087cc14a
SHA1 f0b7f6af4c06213f371f5aa399670b3f12e5c611
SHA512 07be9fcad55967b1edc256552ac7a918b712d29e267e8d6ea2cfc20b5f5ab99cbc27c4288ef1e302bd36949dbe12b4368eb8c44653940fd35f7b6156bcb7335a
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnnfJ4yL/tNCJPXUQrPG:Ha5POZ3lJt2pasx2+mtfJ4klKXnu
TLSH
T1B165BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 edf1f73e65a27b212f7aaa4cbd1187b6156131e50dd628b31849c968bc031865
MD5 18ccf399b9889e26245f03a564a328c0
SHA1 57e0e0ad8c223ecf29fe9bdead5012bd54b84575
SHA512 6cd4a0978c187a9106c8d49ab397b4c4fc70dc6e14a5b5c87e503d86f5f3ede0b2c411d864fda5ca3d56e3222eefb32ca07a82a2edbf30680230afa1353a3271
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkxfJ4yL/tNCJPXUQrPOB:wNc/zEOVHFqfJ4klKXnGB
TLSH
T143858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 86e47a0e5738d34502bd9ee4a447287f64ab8aa5f743b58efa68868a558fa8d2
MD5 0c503214539661ba4977e6e1a95840ec
SHA1 7e7fefc5908cab8725660c537a6b6651cbd3660b
SHA512 d3fc44956f0d6f9250761ab5e2a281514385b6149bce5a841fa9322d11e6f71947f57fa597c0a42f2a4fa7482c7460318199b6db276f4a33516dda6b372d9d84
SSDEEP 24576:J6DIqyTBt3byAUHWreGf+jY+JqRp5fl9NJn:J6DIfltLyvH88YzRp5/NJn
TLSH
T17425015D23BA10F6E07BE13D86920102E5B2F0619B6659DF09E4C1B99EA3FC9793CF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 7e0f68eb36617d93560396827ff3e8a69d521f7bb03c1dc4a34888e799a688cf
MD5 1742f6e4750925847af281d7991689f0
SHA1 e046e77e728f2b1a55df7e10cdc61f7f704be3d2
SHA512 b20ddd357990381c73d9e0109c9f7c85f632e790fcd0628c3165e75c4e554b06157d99e4117a2229a86d6cdb1125da975c8f6cba650fc358d7edf0867de97717
SSDEEP 24576:ptyETBt3byAUHWreGf+jY+JqRp5fl9NJn:pt3ltLyvH88YzRp5/NJn
TLSH
T1B215224153E410A5FABE27384A7242619D71FC106F7696EF18E0E22EAF327D27934B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 ae3d3a4750af619c990b65c6ea4aa8d9fdddd318a475653ead5ab9a7ebd69029
MD5 d18b7a3676df379b8b129d13e236c3d6
SHA1 5b553d2fed3b85eb41739b43e90885a34b4f942c
SHA512 ff4ed377250a0bf2dd3a96ed2ff6dd3ddf4cae3bfa09c7ca02e614207742b73ed080ed22f4428f5ae161c3cbe935192b2ab0bf5b7b7b4d22e0339a7eb3b2f00f
SSDEEP 12288:HYN0rgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9b:4NyTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T15205238652F4106AE97D7B350676221268B1F45A6FBB58EF2CE08255EE713C33239F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 2767df15584a367ef9e47271aa0f8d7552e2639a5f9894c76290295ab03d531a
MD5 5e1d563d93710ae902e6a55b207d1000
SHA1 5ee3a880d35a2ff897bcd3bdded015bd05b7358d
SHA512 8a225fb8386dc439b9aebf85ebab825e8958207b4b7a1504b38df16c4731b836025f41d592a333693311c666feadf88f4e7e2bccc5df8b2c05f08182c41a1f33
SSDEEP 24576:CNgdLoTfaidZ/TBt3byAUHWreGf+jY+JqRp5fl9NJn:+gyTrZ/ltLyvH88YzRp5/NJn
TLSH
T11B65AD1D63EA05CAE2B2D635D9721493D633B4315772C6DF2448C03A8DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 5b43a3d5f45d26b787653c8d980b23ba73ab84ec99ab23c05c1436797794b88f
MD5 e1e5dd3ff151a9fecd02c01725e56818
SHA1 71c6dde6ecf76181cc572559fe75defd9675ebbd
SHA512 0c510168531643680e07be87474363f1e7de7dbb1e47900b0a726af2f53eee30189b68e46a651457d8af49236eff11de8b52961aca1e64e6f6d52b5d1267da05
SSDEEP 49152:Agb4mBIBhGFZfJ4klKXnp4ltLyvH88YzRp5/NJn:At6fJ4kbrGvwb5/rn
TLSH
T141A5D01E22EC01F5E0FAE3B88DAA4417D6B278161732D2DF1151426D2F3BEE85D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 55e3df04371ca9e063cfce007f3f209036224c8286f3489799c1bd20e4346525
MD5 7057752296505bcf844f3d0e97b350e1
SHA1 e4f56f5d9464872e54478d42bf46a02aa0d38d6a
SHA512 6e9d79d2fb3a0f665f903c632d6cf2972975a1e83220efc05d13f59b6e2f6adc173e5f73c344b18fed6b6bb88a94d905b3f2e7b4cd9bc093f92d50728bd416f8
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmfvTBt3byAUHWreGf+jY+JqRp5fl9NJn:ZTMwBtOmfvltLyvH88YzRp5/NJn
TLSH
T14775B06EA6F805E4E1FEC6748E238512EA727451073293CF5290C13F5E67AD89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9cb77023a9387e679447504024bbd372fc803b438eff4b0d272e76292ac87daa
MD5 e259b5b768fa94006139ea5fca5d5b1a
SHA1 bb0bb03ef08672a7ea60f520e27c28ba1d49f78f
SHA512 3e61053900825ac2f986b1d8947f8958555f7a93b7d0936b3b8d12b443565b1a2a656f5db07b854430822e1ef0ff7d3e5525c59b949b9bc43038dc8439aff539
SSDEEP 49152:4DVHeBIAAEfJ4klKXnkJltLyvH88YzRp5/NJn:RfJ4kZrGvwb5/rn
TLSH
T15E85127EE6A800E4E47AD2BC8A538502E77178E9073665DB05D081B66F6BFE43D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 6f62bf7c4da6d5667fdf0be7e8f43235624563617c47244b8c9e2c382a3bcfbd
MD5 5421d20a66ac53b9092a5e6b397564c9
SHA1 98dd8fb35cbcca6f548094076ff2598ff44739f7
SHA512 012f0340349724231bccb4529c3fb5783df21fc6eefc9bbbcfc46cab41e9194dc4ad3bd4f18089c456080c503dc2166d0c54625edf5f4549874cdac7ca4d6f91
SSDEEP 24576:RJnJPbzB4S/TBt3byAUHWreGf+jY+JqRp5fl9NJn:RJnJv6S/ltLyvH88YzRp5/NJn
TLSH
T18C35F13DD2A810E8E4B7C274815A1756FE71386D2F2669CB18B4D5347F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 e9dfcfe91ab5900424956435bd8651e3b918e000618a32b6b4bae8916420b620
MD5 b1e8972dcd9a5717a40cc1940712aad5
SHA1 dffeea08e4ae28ba1e30fb7055006ae81396f0e0
SHA512 48337cec6c4041a7094bb535a6e63ec56f91055c8eb44e5400d3c34e4b58a9cc469a889577e76df36faef2187eb9875bfbe9cfc166b6b50e5d6446b290525ff9
SSDEEP 12288:yKrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9NHV:yoTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1C80523C241F400AAF57D7B350A7662126CB1E44A6FFA59EB2CA05245FEB13D33279B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 cc7e21850dcceb8b40ecc87e14e13d70c9dc22441662a050e6a6fe2c5a0f16f6
MD5 3816c5db2ff0b2934a5e1227037923b3
SHA1 25f4745517fa60c0437aeff53087bbce6fff653b
SHA512 e9834a252f992d0782fcb3bc827bdf10f664f1c49dc0814b53959c2953e8d5f7c80cb8e40e0cae38b8cde216262b78244ada4019fd63aaf4eced3d7ab30e7ee6
SSDEEP 24576:q6UqjpUTBt3byAUHWreGf+jY+JqRp5fl9NJn:q6UVltLyvH88YzRp5/NJn
TLSH
T10515238A52E410F5E47D57349971822288B1FC661BB659EF34D4827EDF31BC2623EF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 4788b84c151ae8a9a81df9b702ba9639432d67f4245a8060c59e959d5b8800d1
MD5 21d0e1769795665869efdd017fc54190
SHA1 8b7de255b63fa3cb2752068edfc87b70a57638bb
SHA512 ce11b2c519dcccc6d90be570a23c69bad2f7aed5f475484db1638f9833ed59991ffcc157f4668cdf42ab2b3bde35a68ff8b77f15f221cfed907179e71221df6d
SSDEEP 49152:aCLHGeeV5ijCmlDWDkmltLyvH88YzRp5/NJn:BorGvwb5/rn
TLSH
T17EA57C05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 5404c87aed9903adc8fff2c722332ffc5d82259033cae27a736e141f137c1d8d
MD5 6fa872e193c6e33dd1a2c01e0d606953
SHA1 8c7e5fcb4e423feb6127f9da41728a1e9c4aa1fd
SHA512 2c8c6654c144db910236c8b72de93f0b5f5d89f5181398ac6c1057994af817fa6dbc5bc8303849ef0675077a80028df726266e2424a642fda2e1b2ab3628f81b
SSDEEP 24576:+rcmR8TBt3byAUHWreGf+jY+JqRp5fl9NJn:IcmR8ltLyvH88YzRp5/NJn
TLSH
T14A25024EB2BE00E6E1BB923C89514216F6B3B031676257DF05A0C37D9E636DA7D38B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 f80dd1815b4f8e768b55df1a08f614a78ad73b3b4d1cf75199296123485c19ad
MD5 e18170d8a801a30ed606808b952d1fa7
SHA1 b2285398f1b40b46792bb096dfe798fc287f9747
SHA512 c31e8726c0c7025af55b48461b79fa5285b67697a82e19147a8cd1f953dead9725b1fef84a2d8663aa2271e4b8f6a667b7e208c010047354c4e25adfc144e4cd
SSDEEP 49152:qDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS31ltLyvH88YzRp5/NJn:L3Upow8sBcrGvwb5/rn
TLSH
T1E4B59D3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/252-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/252-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/252-307-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1140-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1140-116-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1140-308-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1140-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2960-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2960-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2960-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-358-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3388-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3388-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3388-154-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3388-146-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3388-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3452-341-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3452-84-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3452-78-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3452-77-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3804-343-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3804-101-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3804-98-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3804-90-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4528-134-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4528-128-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4528-126-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4528-351-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5392-1-0x0000000002D60000-0x0000000002F10000-memory.dmp

Download

memory/5392-15-0x0000000003D00000-0x0000000003D67000-memory.dmp

Download

memory/5392-100-0x0000000000400000-0x0000000000EFB000-memory.dmp

Download

memory/5392-0-0x0000000000400000-0x0000000000EFB000-memory.dmp

Download

memory/5392-2-0x0000000003030000-0x00000000030B5000-memory.dmp

Download

memory/5392-9-0x0000000003030000-0x00000000030B5000-memory.dmp

Download

memory/5392-19-0x0000000003D00000-0x0000000003D67000-memory.dmp

Download

memory/5392-20-0x0000000003D00000-0x0000000003D67000-memory.dmp

Download

memory/5496-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5496-64-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5496-56-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5496-73-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5496-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download