997e7923649a75ef3aa8655335e6b066fc4224ac8b05857fd658261e46f2f24c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Size 3.0MB
Sample260930-eyzbjasv3m
SHA256 997e7923649a75ef3aa8655335e6b066fc4224ac8b05857fd658261e46f2f24c
MD5 2332a860b56a55474c41a5a3e01116a5
SHA1 f694e0a1650c6600fb6729e2b981b0fbd2d48485
SHA512 ae5bb841810cab5368ea53ad0a67eb66f00ad30a6fc9639d74fd1efca24012f448552d6b530d6451706d20429f228e1e498340787a826d6888d865673834e4a0
SSDEEP 49152:xZ5Rdken7oLKl/QkBwReh0Lwp3VzkBQe0TpuxBEAOHuij3:N3kGcLKxTBwIheulgBQe0wx3ij
TLSH
T123E5BF22BDA085B7C52303309D6EFA3D31BDFA70172545A733C86B2C2D74DA2562E667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
932	elevation_service.exe
3232	elevation_service.exe
1636	maintenanceservice.exe
2796	OSE.EXE
5312	PerceptionSimulationService.exe
5652	perfhost.exe
3300	ReFsDedupSvc.exe
2348	SensorDataService.exe
1404	ssh-agent.exe
3944	AgentService.exe
4172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b86708025f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e1697d9350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002e5d83f9350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a82da7c9350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf78fc3f9350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018cdd1409350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe
932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3944	AgentService.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: 33	4172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4172	SearchIndexer.exe
Token: SeDebugPrivilege	468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Token: SeDebugPrivilege	932	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
468	2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5816	4172	SearchIndexer.exe	100
PID 4172 wrote to memory of 4236	4172	SearchIndexer.exe	101
PID 4172 wrote to memory of 2708	4172	SearchIndexer.exe	102
PID 4172 wrote to memory of 2804	4172	SearchIndexer.exe	103
PID 4172 wrote to memory of 5316	4172	SearchIndexer.exe	107
PID 4172 wrote to memory of 4732	4172	SearchIndexer.exe	108
PID 4172 wrote to memory of 4788	4172	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2332a860b56a55474c41a5a3e01116a5_darkgate_elex_luca-stealer_medusalocker_mespinoza_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a8694be37cd50707b99930e85452bf1ff4c33ed0c9bf2499b03760deed0001e
MD5 ae8fe72fe7f192607bb9970880ee60d1
SHA1 e9512de197f05f3138d5e26728a0cbbfc051541f
SHA512 2feeec4eef6ccbc47d8949fa633cf6cc4b47d06ec9c3dc690002882c43c5e2178319391d1fa743f1addd108978ec2b52448998f331806a22b67fc08bf3b99ee2
SSDEEP 49152:Nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnLuij3:T3q6sjBRij
TLSH
T166D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e90e589bc788c3afe1a3d489b9220414b1c9191286e22d7c3b473e2ebaad419d
MD5 f94571f12b0d50d50d0be6d34e297d88
SHA1 33566279ca2569c50c164688ebeb561482a34633
SHA512 c891010e9b653c0d66af364dcd3c868f76fbdbcbf9e997c2416499449bbbdb637fb35cc6d6c5be70b54bd53fbc5d66baf9a0ba4abd76350ed43b5c6de7aa50b4
SSDEEP 12288:M1XLsswWkxy2lRq2czA85Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:6XYfDtczAmjukUenjhVjV
TLSH
T17885F12873E508F9ED67827CC8A2C911E633BC594760E79B03A496651F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 09251a5e7bd5a10e3249e8c4ee6cf1a67764f41d330d334d046110583d67c34f
MD5 fcd1002d6e1bf176dd30d4ed945141ca
SHA1 a9175ff50e8a4b1a1b47324829e1557a14d68c6e
SHA512 d15d67b7d579440120432879b0c84314d4712223cbe4bf0bab3d62b2939a55dc441f9668906edc4d93622c5a8ed90f563d5b38386a1915dd712035f35fee7a23
SSDEEP 12288:EXZNYVLeyUji0h90ZD0wxpGZIVuBrHsR5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:E0Le5ji0hmxSrMHjukUenjhVjV
TLSH
T160A59E15F6748331D073C0B9C5D2A69EE97230865B308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 05babecf5e035fce71e40ab29f61b6c56078acd56597a57c01e4fd3f754c17ec
MD5 7fb9d08ca8697b29f10d2b9f55ed753b
SHA1 b229171f9039b570c65502c9e8f5e9cb99d168f0
SHA512 65b68a88a0e068e7b225412924757c2943c362aff63bbb74fdec027343239643eb8b0b3031a8f099c196db7d70c8f83be2f47e9727fdf9ba9ed05fb7cd3facce
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuJjukUenjhVjV:U/ezSC6vUzPveHjyOuij3
TLSH
T1BC755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4d4b48d650e0cf2ffa871ae69558d42990946df2d1213a929bd02b4cfce9d10e
MD5 f27ec5c7300151e275045eff371e3eef
SHA1 04d00ba7da79080226ec0b8e2713fd3c4f973357
SHA512 7c3b1b91270635b401402a75bebc5869cc0ebb6149ba99e88365ee12b35fa5c0e3c939d72acd0fb93017c36f49fac4979f917ca5e01afbd93c7582c02379281c
SSDEEP 12288:YVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im9845Ht5X6dk9zOfeK6n3hqF2F7ah+:YVbqPb88hv/l+YKjukUenjhVjV
TLSH
T128559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 093a30005557dcc6e56b3184c7ad53cff0a5507088534f4062375f98511236c3
MD5 9b5feb6191d05e06a9f90d83e1aadceb
SHA1 6c3e27c5f0238ebfcc211612498838f66597e564
SHA512 08434d5ce47a2b1712aaeacf6e72c2ae1f7ee14a116e64e86683509d4fabc2a01300f7173364bc992053507a2a145899b95d5e1330cfc2c1e8764c70b06d99a0
SSDEEP 12288:Xd95Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:XdrjukUenjhVjV
TLSH
T143752394976E24C4FB2722F495B3DC15F626CF6E96922B33D531F2982D7E13CA069013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 d1dce0f5a08317e7c8d4207ab4969921eb514788469ab94346c2a96e0e6b5b25
MD5 569cfc57704d02c7f25149b1f364ee77
SHA1 3e4aeb83659634e5428b8acf939e7f2702a3e6d6
SHA512 df77df13fe09d73722bce8f162737ff6b18dcaccc9d6c834058913a900cc7caebe079bab148736a6eb031526d3375e52981e7e8aa7abc350dd54a7f54b991fad
SSDEEP 12288:leBNUbTVO86UA5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:lJIUCjukUenjhVjV
TLSH
T16885CF3BEE28FCD2C27A5DB85A91C600E77278304B62A3CBD175C20E9E275E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 089fe56daec69dd9cc2833e8e94a968d3f6671cb495dd9d4341218a1ca569a4b
MD5 f936717d3f199ec443eae39f29da137a
SHA1 f9be3e076557c27692b3f280298b817fea868211
SHA512 cfa2ef109683c66e103c64076b91f8eb0b8a3d2f40f22ea1c54785711925201d3a3714199525c075b2ab56a4c60a36a485de341a81733fd3b21202c15abf716d
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:HQvGAdlCEL8c/DRNw5CAij
TLSH
T106267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2d49f312cb035d175ea80b44addeb85e09b8b42176603796f097356a8dee35ae
MD5 d7472e9491ac4bf95e3c1436724f9fc5
SHA1 98ab427c1b2226c1289759110c81317df16ecf95
SHA512 cf015b9087b7cd1f23c49f4925f12c84c12c6dcbb03d20a0358dacb501b3853f205c1d80cd370e713e46bbe980038a27dc5bf3051b349d47356fe70df78d1a1a
SSDEEP 12288:1AwSfxL/2Dc3YDLLmt0LDQewsAj25Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:W1ewsAjcjukUenjhVjV
TLSH
T13795E031FF75E036C77B0DB21B36C716643DAA204B611AC3E3B89A9D59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8855f9e56f4b11d6cf85f365b922e262dbab2ca314834aa3cd3e082040e5c89e
MD5 737aaa2b02444951f010d5b3f5ee2f24
SHA1 dca4f0ba62f6412c9f2de230996b3d8685afc99d
SHA512 794d7ef0e67d499d9748204dffcb08b7869df1745b45c8cf71696379916fd604f5a08971748a76d93c865e82e80fa448165e370af503af21151eca9f310bf6fd
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHC:cUEtQevvqc2W1cpV2tI32
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2607b89dc4637c9f35d483285186a63592f10d8f2c00ad641efd23c91c0fa6c5
MD5 31ada9e0b77a2bd809666c02fc8d3b88
SHA1 e19c40ea13ebf7399c06538a3e54e60bf1bf8f0e
SHA512 e78319fa08615327e971e203a5389f264e0f1affd4e5406dccebbe39e5f1da3311e11cd4ccb9763ea312a56edba9ee06aaefdf966e22b28c9e933d20fa13a53a
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zyuij3:foq2Vjnmcij
TLSH
T1AAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 697cbbd39fcb0f21a0cffea6db9043260e5105dc67b765f2b37ae97cc63ebde7
MD5 96d9398e686492bab5a57dc18bd7c544
SHA1 d98b9c346c8c614f08218eddb40f12f3bc71a524
SHA512 d9d509be8d381585775fe850575f513a3d959d2f25859e9bdf871909357225a7bc80931eaaae453cdeb8301ecd7ca8a0060564cddd329e8469ddf2193c703417
SSDEEP 12288:NAZ/GL3IFoiwtA5qy97S9uaYFLq3OU5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:NAhGL3IFoiwtA5l7S53ljukUenjhVjV
TLSH
T1D535AE80E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2160D11F0E33E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8640ff970b7776128f2d99acf358b6193c1b6d081801945ca0cd4af0941aa59f
MD5 cb3bd5fafa52d784513e5179061dbded
SHA1 320f4613914ae0d6d24fbe30aaf3b2bb7ed840e0
SHA512 74e6a1f34cff6c632612e2f749ae748681430f3610591c58444eea5603bca20997fa5974b53bf85920b4d28ebd09d499258d19b5a1a8d4f918ffad74866b1bd8
SSDEEP 12288:Kmw5HEjsChNYBFgl0WDm+Cv5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:DwupOW4jukUenjhVjV
TLSH
T16E85F14973A81CF9EA675238C557C536F7B2BC162A21DB2F0760C65B2F37221AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 6a7b97c77953f812991af400d4a8de42a620c82e6780ed6cf5f379d759db8af1
MD5 211c9ad251fa332d3b0cf8f723611f9e
SHA1 0553a0a0a6d88260cdde68235f984e62ae9c4e10
SHA512 acb64f731c0e9c7ef60c693656310d5ea736dab5d0959cb41733380d0fdb0377867dd17990246f75e0d03519539c427325e50b8f10272f8c0207e1f3abd2af5c
SSDEEP 12288:qRZ1Iym5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:AZu/jukUenjhVjV
TLSH
T14F75125933E830F5E26352B8C8F28905E332B86A637213DF553592A91F77AE51D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4fde1fee8498f4aecd659e9fc8940c7b01ec3605f1d382b6b96fce9fe1bf19b3
MD5 8612ae538929b26821747f658c21d43a
SHA1 d3b94b64e9158fb84016ade346e12802223035b1
SHA512 00da020260f0143a89a9c170c4b8c0124ad1d23a64209b546caf4241db20afe126b10aad51b5e545012d6c642936ff36667d2ec2d2c95b75a4082a310efa41a1
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ug:bQRQyi36YOcPbLvw2gAf+PN3Fij
TLSH
T18F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5fc1a07dbdf7769a4f3849bd657daf56c3eb0d8524ea1fe77f94471198e36f6
MD5 4826cd47103a4a1ac72a217393d6a393
SHA1 8016eb33e76d2d1f05c8c89e87c9cacfb9d3b3f9
SHA512 ad9ee9cbe601168a60c21b9259e199d6b127d4959b366cf2587e82c0a762c8ac51347ac1ca348047a945b7fc0ed5200b704f01fdbd5fb2d742a7811defea72ec
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ug:+QRQyi36YOcPbLvw2gAf+PN3Fij
TLSH
T1E8666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7bc943efde12bd20ffa5615e2955746a3d97e8c96defbed1bfe0f69794b168f5
MD5 e296f38d37da3831c9ce94f62ae00f04
SHA1 75014d16a1400d747684035f33d1a8e08501c8af
SHA512 e4f0ddf80dcc0811c1a68eca15614896612a1cbd92528086bb3db84f2039a25da1b79176b4a83b9b1d812598f24ac7c34cb9501b9df80e56ed344e7e8bd072d5
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0vjukUenjhVjV:D68Qg55nhceWu7PNU3/iuij3
TLSH
T194B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bd44cd874e5705075cc26a8ccb1db0cccedfb88bbd4deae422c1c185e5b3ce1c
MD5 4fb99fc636be458a2fd21937c4afe526
SHA1 f71ce15464d4356eb3d7fa4a747ca22e485ab5ce
SHA512 5fb15308b7682560132b20a11e76491e2b8528a5f6be5e8e20bfe5eb77da34307f8691b9aecf6d1a7e4fdec86251e7828d8a101d47b1c889be1f1ad45d97c08c
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:Cy5112gYy5azzVvt69nLKnhZ+ij
TLSH
T1C9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68bad4a42b07524b74911eff8e2b25f1291a414cbb5fb8436d7588d434ca1315
MD5 a5e1f8bc182021daf06ec6f302332540
SHA1 bb469841bbca82e4ca29563a219ef966ac7c025d
SHA512 1a5db3758556c5597533481c5aee155a3d9eb85fdd9f729c1756b71df7743a38f7d8e399c1bbaa11f069e8de076cedadde9178e9bf66b1c23f684456280d0e13
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glYuij3:tu6Jmdxd2dNij
TLSH
T144D59D13F1DA01E8D06AD078974A9233FA62BC490B35B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4c80c38825d52b015839805624953a7b4ab88031c458e3ad4c46068f6ebe638f
MD5 fa79e4bea7940bd2800a1b116bb14a65
SHA1 12251488ed26c6a77dfafb4012a72a347d705eb0
SHA512 cabc9270432ac1c7ea5b8c5b7aae5e576c96a67ab3e84aa39207d80411116938d82d31db39d24c17f00ca9e78465e10eff19fc2e9db5304449d6362337056cfd
SSDEEP 24576:Ahv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3yjukUenjhVjV:c1hpsNoJpF1A63U44CwH7R4xEuij3
TLSH
T113B5BE13F2D900E8D06ED17887569632EA62BC460B30B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbe5ce3c2a58617c248f14648b2cc2acd96c0f4d65483b621292fa2d2b9b8285
MD5 a8b5ca468167cc67f507d9f861833518
SHA1 8c77c0ea14ede8cd4e1e6820440e9648a66840cb
SHA512 afc4131525336d131231f714284172d7a8b5800c8601e0a5d6b1080e8623a6510bcfe6e1fb1a23093b21034082ffd21b6c1423cdb11580be3f1757899658e61f
SSDEEP 24576:K4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnq/jukUent:eSuZQIY0Be2KcRVtOnks6NMHq7uij3
TLSH
T155C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b135c482b9c9d2ca5e4fca5b795b5a447fd4739fbac788e49d86aeb0d9031d7
MD5 eddc8a48e7c44d0849816e8eb7ec33ff
SHA1 cb866af4db98e1509a6381159b50ac76f6e4829a
SHA512 36e28f11c0027279767f69bf30e175b87a87720928fc23891e9b5a162cf98eefa6ca642ffdf851c4701a10be6933fb10478faa756407cbc68a368614d988bb57
SSDEEP 24576:hhiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLyjukUenjhVjV:hhtSn8EApI0fig3giDn0AP5wIuij3
TLSH
T10E95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 3ed8249ff5f668fa610a03aeb8d01b39fb903077da5d12b656a74f1d90568499
MD5 77307e2ed4bbefeba0b61958c88cc8da
SHA1 64819854020ae762711fb56021c517f9f744db3c
SHA512 48233a0b8ecb4a98fd6e720e996e5fdfbf7cfc303495d3d965951ac34bd20b26f40a6e1cbecb863a14515dd438f041bd47372a5825cf0dc911772d3ad2a99ba0
SSDEEP 12288:BF5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:BjjukUenjhVjV
TLSH
T1D6752358A66E21C5F71322F0C573CD18F516CF6EA7522737A63AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 95161027ce591ceb5bc61cc1b0d957c36867a1220f79d9a854c5a374b7d43c05
MD5 4475ac424cc61f3bb2cd306c91e0af8e
SHA1 2efdf436706e86db0f4d243d700bee6f082d957b
SHA512 44ee9d80783516d8074bef680607bf43e451f9a5558975c231bfc1fcdf0dd4babd71b8393a2d82be5c79d31ca2cb166aa2d1aabd2042d8c1054fa4d706a1e6b9
SSDEEP 12288:9S5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:9gjukUenjhVjV
TLSH
T13A752358A66E2185F71322F0C573CC58F516CF2FA7522737A63AF2942EBE63C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 ae92bf47ae32cb891a1efabd4a3bcb45c4255eebaa7314e8fe376069c331d1b2
MD5 51263ea32117079a9b347c0394c74a90
SHA1 f52d0546eba77b7fb71670d9453f416e65a44cfb
SHA512 e360a55edb7de939155a78f321c79ad5159265014983f054ff9678bdf6f72a099c20de2dbc19e1fb40edcf59d1f4dda8e2e53c81971d192d1ca09f7cc5454516
SSDEEP 12288:aI5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:a6jukUenjhVjV
TLSH
T1C2752358A66E2085F71322F0C173CD58F516CF6FA7522733A62AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 35ffbf35e394ef1c6705c1001fbe199d8f69c3c1f21d4f765e702eb009b8ef82
MD5 df5047e561f963bb45a37a1169a0cbf5
SHA1 8af7c03baac1444d7b982eb99ec96d046d9f5410
SHA512 b974cf648f8062335012c7712dc3232b78d4a026840854f055c4b69148f3f3ba4c9e5c2f2c0e50f9b4cb0d035f59cbec34145dcef7521469dba0f6e45bc8f157
SSDEEP 12288:dVz5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:djukUenjhVjV
TLSH
T105752354676E20C5EA23A3F4C573C815F236FE6EA732277F9621A2941E7A37C6038513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b13da0576c2621572f7c5e44cbc39e11a2e9107d9736e6a0c099031e3ccb1310
MD5 1c9e7964d692e23f9133d7091ed2b89c
SHA1 044a2bf1b96a449768020d1c2a469bff7dd25b92
SHA512 67233a5ffedf1ba2f8fabb304e1b01204a6f33bbabbf9850223e6c183dec5173a749478827a4637d9e75da2104778a025a435e339c12701c26aff39acb60a4fc
SSDEEP 12288:Gr5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:GNjukUenjhVjV
TLSH
T162752358A66E2085F71322F0C573CD58F516CF6FA7522737A63AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 e9a237ce4b3be09b2365391bc99d2d7edf93a2aba69818eeabc343b006cc06e4
MD5 02b52dc854e7e4df95f861c751b6726c
SHA1 0b25658ac6f8cae95081c0894b74b598e64e69a8
SHA512 3ba14323783e2b235408c119ed42ff4616c753cedfc6acc11bbd2d4f1567a9d0e0ee7e5a8f309cbbe363247b0e474b170ddbe2c99a0b9454d972b8c624b8656f
SSDEEP 12288:l+5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:l0jukUenjhVjV
TLSH
T1B8752358A66E2185F71322F0C573CC58F516CF6FA7522737A63AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 304dbb64ca1cd37a617729f4578dfd159430402802145352e5048e8fce8c4d97
MD5 ceff76b89f094664d9d7bf6684004ef8
SHA1 51acee58fcbb8cb9257722c5257b3a455d5fbe48
SHA512 1de9b5a39462a86460de69bde0245c0be4fd63352a5a48b81b2900ce959196206f7cc60d2b4fe9f385e35833884e112dfed9c8920430a324fbbe5f07b0c0819a
SSDEEP 12288:8K5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:8ojukUenjhVjV
TLSH
T127752358A66E2185F71322F0C573CC58F516CF6FA7522733A63AF2942EBE13C2069067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 41d99ac93d8e3b5d5d7e0af5d188070af36b38cab2130100ffa906de69a81ccc
MD5 4ad8b8f6b5cdbae400e7aab6044f8e42
SHA1 c12d32e193cf850148f6c2b243ebb1f9d35da302
SHA512 9337df9d4a95aaf31be0d6e59e4f654990adfbc14c891489eef82409f512454e88d0081efe749db55e44f4f7223e5dbc37b9a6128fcc5e4cf2d384f8a4275211
SSDEEP 12288:fiZwbgzzFEoS2cPvyy5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:6ZMIzFVSOAjukUenjhVjV
TLSH
T186850194B39018F8ED67827EC9628D05E6B2BC5A0B60C71F13B436661F773A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 5bcb235017f1940c7c0d1e1a39cbd613ec52d242e6458f07aeb1b5e0409d2a81
MD5 9c9e7bf7679b78a41b4197b922ff3149
SHA1 3b17a8e31232b8753d88ecfecef07a96a547fe25
SHA512 c61d689179aa736457a6894969d661d6ff04d0b595f3588c05fc646380652d64e4ac1730a3ccbac89c1433bc9083d90eb6611641e71d4bf5047c436d7d05b861
SSDEEP 12288:WJ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:WPjukUenjhVjV
TLSH
T1B4752398A66E2084F71322F4C173CD58F516CF6FA7522737A63AF2942EBE53C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 cc983219ae98f8271cb76089e629e0ffc1c1847ff6a6eafbbe539b1f8a562cdc
MD5 5e703dc0183c4e3864f2c26fc643ef0f
SHA1 52dbcb301f2c3ae8bfd657681ea58766c0e2cfb9
SHA512 53c255650472d288e587a28b6d72f064baf8e44488f97749598d5cd14525104aeb90a6a68d6538a43452f4f80526cd755f707c68308ffd0233f5394e137abf7e
SSDEEP 12288:Tt5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:T7jukUenjhVjV
TLSH
T1A5752358A66E2584F71322F4C573CC58F516CF6FA7522733A63AF2942EBE23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 61937b042e696e688c5cb0d2c6547aef701a41f9f850bf1069a5d066e6f8b003
MD5 f9224348962f8c2f36b4c5ddd2c8b9e8
SHA1 1ef14608d208651d57a609027dcc29c613ed9ece
SHA512 ab6accf3a2a31211b5112abfca104a9aa42a12910681bca4715e73cafb3fbcfc34f51dc1051388c8045ad7bd58d9b1efeba3269e6cfb4e2542a90dd4de12f774
SSDEEP 12288:TyPz5L8m5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:ezysjukUenjhVjV
TLSH
T1A185024773A530F8E2275278C8625E01F372B83A47215BAF576453762F3B2A45D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 fe94de35c284dce102a8a923f44a6723904be6b3b311318d792daa39122da88d
MD5 0cb04325c921e55ffdaa715b6936e191
SHA1 c2ca1e5eafb2dc4f988343836029f43c7d5b6146
SHA512 939a75c285e91ee0cb4150732afb76562204d522e05b6661ead618036c44ee0dddfaf9f386ac52eea47dba47a95a9fed95c1f76f34f3d1840da1cf68dec94264
SSDEEP 12288:nJ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:nPjukUenjhVjV
TLSH
T1CA752358A66E2084F71322F4C573CD58F516CF6FA7922733A62AF2942EBE53C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 f8ddeb431a0efaa2480a16f434f9a8017050783bfeafeeef435d3b0931e9b5e2
MD5 7b13a26ccb29c5e1ed251dfed5957207
SHA1 4ff3e0644433812eed8b2dd900b70ffd8bcff85e
SHA512 c2e44df777608b639619c8ca00415ccabd1ebf95676eefd6d41915be74d8626814c9b83d57292415d3671fb632e443f5e3fdbe9eaf7fcf44eb3387df6bc30485
SSDEEP 12288:cJ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:cPjukUenjhVjV
TLSH
T1EE752358A66E2084F71322F4C573CD58F516CF6FA7522733E62AF2942EBE53C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 7d2e75c3b8a5d35a8a8d766ad359c573f70bd1af4f9355bff952c809a97e8707
MD5 9ce5af18b41dbb72a9d187db890f6491
SHA1 9194889f4799d775f9a7f22b963bb1903dcf7e92
SHA512 5a953b512e197ce08089148167233c6e210249770c11fa2b29ca30f39146fb45450d59c4815e116df6c2139e989b6a8f903ccdb40ee7cf04c659e59c2239ee30
SSDEEP 12288:CyPz5L8m5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:fzysjukUenjhVjV
TLSH
T1DD85024773A530F8E2279278C8625E01F372B83A47215BAF576453762F3B2A45D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 fe654a56712b99c439df0f0d8a62369524413c4eb3af29cd8f869ff4aaedb9ad
MD5 8ada7f692247c1ad0eef406b8549e688
SHA1 4053860b88515ed2ce22a06b243ecd50ee9a149f
SHA512 4fb22cad18b7674b5bbbb0cf92a9618a8cb5ec002ca387b21948184e21a82e8fbc1177fe09ce0abefc6a48e00a1d4c2493be4c047ffd6f7ffc94741422c11d38
SSDEEP 12288:UCd9PWYoaLHF3z0z04PDvhY5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:tTmaLl3z0zDqjukUenjhVjV
TLSH
T16F850194B39018F8ED67827EC9628916E2B2BC5A0770C72F13B436665F373611C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a745ad0216c37b8225e79468af373a3188d6d1b1858aa7f063ce5251818646d4
MD5 6ec0cbcda70326209bbaa0901293f7b7
SHA1 d8429727b0e5fd83fb2364178ebe7f638e0f0c8c
SHA512 6600313f4e9f58d2ba37618f34ac9be6722e1d9eb372ddb63ac9178447b8f7a300a32ee3c49f8247f07a84cd7899768aa9fc527de8212f28447145f52db264d8
SSDEEP 12288:Xi4e7VRdTfgwCHKy7GLbbdIvn5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:X3ed9CHKy7GZejukUenjhVjV
TLSH
T12095CF90F3E810E8F1B79A75C9728511DA767C5A1B31DE8F03A4665A1F336E18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 5a90f91e7f2adf83a21a72244b5cca6ce8ab52abfffd078499fada903292e010
MD5 4ac0791c9434e1bae4442763d6e04b24
SHA1 3230f7bd51a5ff14bd9bef4b2ff3549249ec5d43
SHA512 50d8e7e74023a8470c1018e8628dba0aa23e80bf7067928951cf338efca3ab95463d451c97508fe99e112548e668b0181264ae7a0501fa2b684d5b586ea76cad
SSDEEP 12288:ro5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:rajukUenjhVjV
TLSH
T111752358A66E2085F71322F0C573CD58F516CF6FA7522737A63AF2942EBE13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 86edc945b0958f0161be7b558d1a512a3bb4e268c68b56a40fefe8c8c3bf00d5
MD5 ebae0e7dd67c9dfea6c7c1c7b6895d88
SHA1 b191cdae42af5344fe45affd5786db6ee5f876cf
SHA512 50946c73d3e890358e6bd5eb166885b1755abcbd21c3db74a9a9bd11548b0d815db7c61b159200ba6acb1baa691e3ed730f87badd1b15cf92624dafe10bd3ac7
SSDEEP 12288:qG5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:qMjukUenjhVjV
TLSH
T125752398A66E24C5F71722F4C573CD14F516CF2EA7622733A63AF2942EBE53C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 eaed3ea6bd3b85edb25d167be5360b54fcaf4acfd75881c1a4362ed9afd34cef
MD5 aa5b1995e91322fd1915e0b96f6df384
SHA1 cdd41bb97d01b4ff2a0efd1ec5cabb9ee9b24452
SHA512 2ef90fdfb7896151f736b62705e1457d3aa2cc879b01e897dffe9dd0be4630c11bb36e07f34192371a5f1e3512ccc7bd0e145c522a0cba6f591b258ccad13989
SSDEEP 12288:4n5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:4RjukUenjhVjV
TLSH
T167752358A66E2484F71322F4C173CD58F516CF6FA7522733E62AF2942EBE53C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 837908bd4bf177beb2277923f32f92d44a6ce60f00186789073ca306e49f912a
MD5 436d9ca94072fd4bd7fa0aff8a71d772
SHA1 08b5dc570dfded69b2f6b8820aebf7c1cb57a139
SHA512 a2d3bb01fb82c23d55aaeea0bedfe2cd52c4d0012dd02939b67c933846f858ed7a42317be8ed4a5da43539ee7441f2088566ad7308089acb4ba76e5325aef781
SSDEEP 12288:2J5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:2PjukUenjhVjV
TLSH
T102752358A66E2084F71322F4C573CD58F516CF6FA7522733E62AF2942E7E13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 c1a6a4af33d588e7357ea9a664601d34ac2c620a7aa8c34bbd2657514d1e1926
MD5 c87d7b4d3055ac1969dd3fd02240a9c5
SHA1 b50e0b45966e4f2e1a5c9ecf0e1fbf9a833737d9
SHA512 154aa92d307ad9aa049e1151d546b4d04f4b59cf6780fd19569c63d48d6373704578273d5918bf12a487bb6e497c677108620803c81ea416ad6bc0d8657af707
SSDEEP 12288:Zo5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:ZajukUenjhVjV
TLSH
T11D752398A66E2085F71322F0C573CD58F516CF6FA7522733A63AF2542EBE13C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 cabef372a5e5acba65fd95210f6fdbed63763ac277bd3c506e712ed0328a4102
MD5 b0a4185472b9bbbfd849df0aa66e71b8
SHA1 9b190e41ad5ca65541acf6c292808bf327a79913
SHA512 ae5b79778bc23a5e6ff4a440499ce9d14e214c68940b150b75e2b0bef1c65cb4c8f223156ca670ed10ac6e5c50ae7b4b0910ca4050c06370a7009978860ab25a
SSDEEP 12288:Zh5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:Z3jukUenjhVjV
TLSH
T194752358A66E25C4F71322F4C573CD14F51ACF6EA7922737A636F2942EBE23C2069017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 6ecacc55a647e482cccc426e4442e71c513b99e371e80c4b0be11b6ea7345014
MD5 7e110a650af9324ee4e38e638dd792ef
SHA1 dc20e67c4dd090a701750ec4f1d563d7f9db8ba6
SHA512 9d53fac161f76075f8ed4232d620969180612c0fab2d787e9027d5bf67b3d4f2bd21f6083002c76e90beed57589331e4d6214098a661eb9a61ef5224db368c4f
SSDEEP 12288:Er5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:ENjukUenjhVjV
TLSH
T10C752358A66E2085F71322F0C573CD58F516CF6FA7522737A63AF2942EBE23C2069057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 ed8de57ce26b66c4c60825079672ab4d3d7f884858c85da94b36ab8a57582500
MD5 fb8eeacc3cce19643011d1f69e888cee
SHA1 32acb3747eed721881ed261d738648564170eb1f
SHA512 8fc121813338e17bfd904e40eb1f3295bf0b02c68765fceada6e9bb1d3982ab7af9298d92124dcef21fcac9790d7ef012fb0a581fb902e626c1aaca6f39fb66e
SSDEEP 12288:mfwvD5uQ64Lk3tRX69qkyAI5/5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:mfwvPk9RX6wkyAILjukUenjhVjV
TLSH
T16395DF29EBDC04E5E177927C89B3860AF2B178691B31C6CF025A53AD0E37EE45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 18e21b2e7d46baee752bc6db7898f1a6a4ccc70bafee0233fb7c07b0dd88cbb3
MD5 910d8f7c09577a0504252f8f6701c71d
SHA1 4b0bf86121d548957626707e866e38359c32daa7
SHA512 e04a4f72443f72968b15ee6edc8204dc3c7f011a4a6befb76f14753fdcce5ff60eb8057be3a84dc17a16072cc9d3a7194fcb5fba5a67c2ef036b56f624b21dce
SSDEEP 49152:xYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ouij3:cySzPlij
TLSH
T1BD066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 82f7311deed0855f205d9b6e0080c83c4f865e12dd5fa0649af42ac565ab98a1
MD5 30b5c934d28b9466d05197fce959ab7e
SHA1 09a30d678265d27e622d378e0068d249fee99238
SHA512 8a47ee61d9a13266ae8a31b5290ecd2df282b24f50f02b04a2910ad8737fca3e82aa4655635c60bbc092d64a22912929849f044aa6f826739d9d84eead56908d
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQjukUenjhVjV:147JUQjTirIhCnDHUPfF/Yuij3
TLSH
T11865AE1DA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270837D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 83741670ca7bda410a3067b117cdce913030e0e0b779134a1fbca0aa18e6b31b
MD5 91562e4b2f0b59bf1bb141d3e7f59368
SHA1 a99937e4f5bac3837e3f7a25106a0fde3fbed737
SHA512 1fd21c53772dd3158d9ae75f112a7db377a361cf67161ddd3a9fc3215fc2d9ca6f71a6e70c4bbf148d3e81ac67bbff31e8c213c7a646171685d41ee492be51b1
SSDEEP 12288:l2sfZ5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:n/jukUenjhVjV
TLSH
T15F750119D39812D8D16F62B5C7628A40F333BC2993E193CB52D0F17E1F7A6A45DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 960KB
SHA256 ece96ede77f7dac57a9db4c4f729b2641d5893b9212495e1da40f5fbd1e5d5c5
MD5 7b6dc04cfa5d4c2cfb9242224d543f0c
SHA1 41492d9fb9991df0ed6218b73aa83293eda2592a
SHA512 46564ebb6a245c65831a6821173909c1211778b9035ca18f682f80fe5fec8287f04dc60ddce80e20d9238d28d00d52a1f6e871ad3c6c0e79b5bf163552d2398f
SSDEEP 24576:Yh8UPcVQED5vnY/1cxAiq92dUaRMCul3:c8UEPD5vnY/1ca92OaRMCul3
TLSH
T1E4250711766ACB4FC66944321E37D6CCA7703D11EE08AF0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 03c212e8cfacb1c59e53ff71aa8cacedf9b9ad1c374a3c621679faa01dcd0859
MD5 81085738daa40ece9004e95333e79da8
SHA1 e8c9b6c9404353688fdf42d27df3286cc0120a55
SHA512 9a37ea68e0911e3668a02e675ed640bb1db9fed75af071d3234626054924dff09de43e7fd2725aafa726c00bc48d309bcd06d4ca962f75067c2e26c52e6bc4b2
SSDEEP 12288:gURD0VEVhnH+ddD5vnY/1ch49HRLAoKAGF:gUVmehe3D5vnY/1vRLAzA6
TLSH
T16F65E9416137E68FD1BB6032032A5F4C77A4EC16B7096F26B3C9453AD86BA51A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 eaaa322618e90ab198388a4e10c8556116c8ce60011dee6735fd1f6cb346049e
MD5 e4787ef0dd8ebea2812ee3b66c656474
SHA1 7041f7bb2028beab1840a90496c27e939878852c
SHA512 81246dfaab11f6dcf67d8b43bdc972371e9f885969382b8fbef166053b84222fdd7ad9fdec309c2c8390beac4454cc857c1ded884a95d82a80b73fc45b05f922
SSDEEP 12288:PW7x5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:SnjukUenjhVjV
TLSH
T18A75235493AE2885FB3722F08077C824F11BDF2E9B5126B3E525F2942E7E6BC6479107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 628849ce45336823e6dd7d71bd06d03c8dca943c220f6e3e68a5b34f8685130f
MD5 7051f62f95e00f58977b9c2e2f4b1c01
SHA1 4463d15983d94193307382abfc3975af8ca05a82
SHA512 70e0a7c918c216c0fccf39fb79df26ad821076c0c62ea19bf6e77c0fd2df65a9d56033393f7444e8e99984e538d0c9d78a93f9001a2e4e055f87b61be02558f6
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYJjukUenjhVjV:/gb4mBIBhGFmuij3
TLSH
T10965AE1E22EC02F5E1FAE2B8CDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b460d1380b54e6c70442f79223a7d928137e64a95283c5a5ce0038b3839d5dde
MD5 a2c27d051d54576bda8d76f25507c18b
SHA1 2e082ee3b447d82c517a600e20832eea365920c8
SHA512 978c0910b8cfff56bd69209f49e8e3443a6beb185d153a82747079730b23a47de580286f2d6d347f332bfac3cee583000e4f5db1af2bb38fdac89a71aa55ce84
SSDEEP 24576:MG88u8FpJqH1Ezria7/mAjukUenjhVjV:v7ZFPqVTa7/Ruij3
TLSH
T126A5F16577E501F0D477D13889928A63F6B2B8250360EFDF07A88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 959d38a1ffb7142173b6c053958f6a87064ef5d9427b4897f3c1e5d240dd6c61
MD5 1dbe8dff2ec1e7bfd0e6e36af5827f18
SHA1 a1c587b2be2b3d049f859409eb2509b19f3be1fc
SHA512 8e19dafd37e7d4a751bd8a41309b06ed4cd866dd1c37625ca0f2732547585d3edf0a2f2d008d0d68e16d550a2398c02add982a6a3ac4bc9b6d16cc6cd9584ccd
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKuij3:XG05lO43b2ij
TLSH
T11BD5CF6E62EC11F9D1BBD17CC9C68A0BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 deaca120c0c4e5ba92d40db86db0c4aca261434bdc43ddb5747b605c3c684437
MD5 7949dd88e5185a4d027b15b3c7b657a1
SHA1 b34a197351a011f89c201b00f213834986b194a5
SHA512 89a5c422e4e34a285c855e4351444728e2039be4ff5013902fdc64d904c9eca47415a7e69d9b4b8ae30e93fb57b68c1eacc974321d728ce6b6da96ad6afd1dc7
SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnGjukUenjhVjV:La5POZ3BJt2pasx2+miuij3
TLSH
T17365AF5EA6FC01D5D579D17CC5838A1AF5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60c2c4d7e9dac9f41bc87819d280826050a7457774eb15fa5e0235b9e1c46f26
MD5 80e23d9942498308e954d1fac587bd0f
SHA1 3dda241cad3198b29372f7561894cd95df2ec737
SHA512 9226f2436d0db293107342ba33cb44b7a9b79231ffe6ee9ed40168eb1238b456c88eaad170d996d744561103e024c551c6ab515e97d2e42ab4906cca645510da
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkYjukUenjhVjV:VNc/zEOVHFxuij3
TLSH
T13D857C1623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 881f1ae4a4bedfb5293684297b94deaaf5785f5671c14c2604b67ab966984225
MD5 a6c23e939d43dbc3a0b057abc430fab0
SHA1 10560105148a33b19893ef2c606a47c8954b0ce7
SHA512 dd5ea6434032e1ae4802ba0f36dc00ab95b6f8eeba2eca86c6c4923e741fb1d39ed80fd30c4b738eba0ed409ebdf269154be8f281ae70888ebae16b5280e7caa
SSDEEP 12288:vQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17+5Ht5X6dk9zOfeZ:vTkNvNnaFeYhJNtmZBmSjukUenjhVjV
TLSH
T17D55AF6EB6B806E4E1FEC6B4CD238512F6727861173253CB9290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 bea012cc606536d25986ca6301f10742d51a98d3c5bc4388a1f12697a23f0d5a
MD5 fd90a78cb648a99a21426e98f3f938d3
SHA1 0e04ad6f6debb04e288691050f7185df4b77db46
SHA512 81ceee1b2913fcec3202695ddcbf820895d8d2c392b52c262f8c9a27127de0248032d0c162fdcc465fa2e85dd421a7784d0ca1a5baa5db2ef69a91b8f200bf1e
SSDEEP 12288:bHvUrBFrEjwaQu5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:bPUr+NQEjukUenjhVjV
TLSH
T1CE85F11F22AD18E5F677A17C85928609F772B866131293DF02A0817E1F67EE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 49e721f340762feaf9e8375313189152dd2ba75f75bc194059d6df3cc9ad4c59
MD5 0dbc2da7066c92b050252df9de59cca5
SHA1 b7bc50eaa35b006a8b3107d2d0074b8fc7629016
SHA512 ea93ec9a42a48bfdbb98412fa08e7db35ff3f5afb6a1f280f71a2763da057a3db3a7cbf675ea40a109bff8fb0992e3ea321cd014d239134eca5cd731f2b2bc70
SSDEEP 12288:bQcMxWDXN1Dp/fshBItT1IQgAl5Ht5X6dk9zOfeK6n3hqF2F7ahCjCyrc6:bD3FHshBIYQgADjukUenjhVjV
TLSH
T13F95E17DE69C04E4E57BD1BCC6638A06E77178AD032266DB0294C1B91F6BEE43D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-1-0x00000000024F0000-0x0000000002557000-memory.dmp

Download

memory/468-6-0x00000000024F0000-0x0000000002557000-memory.dmp

Download

memory/468-7-0x00000000024F0000-0x0000000002557000-memory.dmp

Download

memory/468-0-0x0000000000400000-0x0000000000712000-memory.dmp

Download

memory/468-88-0x0000000000400000-0x0000000000712000-memory.dmp

Download

memory/932-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/932-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/932-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/932-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1404-315-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1404-128-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1404-122-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1404-120-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1636-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1636-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1636-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1636-38-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1636-51-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/2348-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2348-319-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2348-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2348-114-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2348-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2348-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2796-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2796-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2796-199-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/2796-53-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/3232-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3232-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3232-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3300-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3300-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-333-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3300-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3300-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3944-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3944-139-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3944-133-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3944-144-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3944-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4172-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4172-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4172-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4172-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5312-233-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/5312-64-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/5312-72-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5312-66-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5652-78-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/5652-266-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/5652-79-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/5652-84-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download