c18b6258b2cd228d0dca7de227341ad7dec7933f0823129a8c1c62d36406a595

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Size 1.6MB
Sample261012-trmfqagw8n
SHA256 c18b6258b2cd228d0dca7de227341ad7dec7933f0823129a8c1c62d36406a595
MD5 8e68bc1a07afcaf50adda67445689c85
SHA1 3f0ecb3a62f8aa6c301ac83cc94456ba5e4247c9
SHA512 27129e460d15383ccb98b5de0c0d692049a815056cfc3b230db583dae2297ba260fb67d29d72990a6379d992e0511c502fd540367367e7dfeb12799a4590a477
SSDEEP 49152:0bhSnKAwCWjimXtgBwpje30jaNf1TWbdz:04nKAybd5U023W
TLSH
T12275E020B64180B4EA96817149BCEBBA443EE631473552DFE3E41D3D9E302D16B3B69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3424	elevation_service.exe
3560	elevation_service.exe
996	maintenanceservice.exe
6136	OSE.EXE
1172	PerceptionSimulationService.exe
1468	perfhost.exe
880	ReFsDedupSvc.exe
2468	SensorDataService.exe
1768	ssh-agent.exe
984	AgentService.exe
1132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\249d35f9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000de4c6f3e655add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005334417f655add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054f05e7f655add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7079d3d655add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd44ff3d655add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055ce843e655add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe
3424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	984	AgentService.exe
Token: 33	1132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1132	SearchIndexer.exe
Token: SeDebugPrivilege	3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Token: SeDebugPrivilege	3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Token: SeDebugPrivilege	3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Token: SeDebugPrivilege	3372	2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
Token: SeDebugPrivilege	3424	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 6092	1132	SearchIndexer.exe	100
PID 1132 wrote to memory of 3016	1132	SearchIndexer.exe	101
PID 1132 wrote to memory of 4840	1132	SearchIndexer.exe	102
PID 1132 wrote to memory of 944	1132	SearchIndexer.exe	103
PID 1132 wrote to memory of 1800	1132	SearchIndexer.exe	105
PID 1132 wrote to memory of 5944	1132	SearchIndexer.exe	106
PID 1132 wrote to memory of 2188	1132	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8e68bc1a07afcaf50adda67445689c85_darkgate_elex_glassworm_luca-stealer_magniber_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0e8a2263ee1ef2bb3397905fb508d07b4669d28a28031fa80baeead72e65461
MD5 a46c99358ca8ebea2208bb5fa7bbad02
SHA1 a119fca45ee344dd0dceae1026d3c92f53e44209
SHA512 ac28ab436fe4ed2d0e763355407db0650b8e0d2f2e37393efc4a67d907494d274a2fe1f7922fa9f71587089ef0860f38c6b0ae1f6fe87af2cea7c6af2b43a3e3
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDe30jaNf1TWbdz:P3q6HjBaU023W
TLSH
T146D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b0ea85cd33405b6cc32c3550ef5d25f90140f433e162a481b3c87d17af723364
MD5 7663b094c549576739c919d46beef138
SHA1 755ccfd7985224a344b2ebf7c47c4d409af857f9
SHA512 60a8bbee3c83a072373138bd995f5517a0f43a11c027e9764d19ccca6a1669b7e2dccbc4790f3d6221fe19c17708b23bd37bea025044e43e9147f9e8e00caf49
SSDEEP 24576:DXYfDtczAHgXe4i7ojhsP5Lgrk1TWb4AN5:Gtcte30jaNf1TWbdz
TLSH
T10465F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c9278f2071e806adfafe4afb41400f7794e33f3207f2eb89c81a4fbb4c38ebff
MD5 89c637eafc79c388ed14efabdb7ad80a
SHA1 5f2b1e0ff953577b0bbf15b245f891e7ceb1a81f
SHA512 eef5b0a917107ee0cd40818313e442d42d0ebf3a4bcb0059ae786c4fc0d11b38f62e9b6eadf21915895e3b0fdb0f300e8af2711c93892d32adca0836a34a56f0
SSDEEP 24576:X0Le5ji0hmxirMEgXe4i7ojhsP5Lgrk1TWb4AN5:XPji0Acse30jaNf1TWbdz
TLSH
T10385AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 46bbb90ff3e0bcba7e4444d5ad49794a4797adc7ba16608a10bb6b25134fb08b
MD5 93de97d445403440bb498b916081b7be
SHA1 b31dce9656af5a526032ee8668fb95ae85546c2d
SHA512 71f3d6ef9251c7c1d4ac04c68f44ee4d2db23e3eca4d41fbf57761028aac98ec3a766fbe5441575e60457fee577f9a8008b9317fccb67d8fbc64362205c30e49
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyu6gXe4i7ojhsP5Lgrk1TWb4AN5:I/ezSC6vUzPvxHjyge30jaNf1TWbdz
TLSH
T162756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 666259f0615c395bd9bc7cf299a488a7d9c4eccd537eb1347233d4ee92494ec4
MD5 c57b3bca1f08ed332292440413bf8df9
SHA1 87d91d0debe19563b78ad773e8c6dc455dfdd2a5
SHA512 e8f4f5fc76010f49cb078fd771318a5576c45c68ba96a57d93cdb6a335607f0f5666b5f2bc2f114370be1cfea8711568f50fbd36331bc212edf5ed3fa32e018d
SSDEEP 24576:GVbqPb88hv/l+6TgXe4i7ojhsP5Lgrk1TWb4AN5:GVO88hXl+ve30jaNf1TWbdz
TLSH
T163559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 948e9c7ca9f63a5b8bc6174fefe90ec2423639525777e560dd7bc6b78912859f
MD5 103c365ac33fc2593d7a075cfd495dee
SHA1 ff682901fb742469d1af177fbcab57926917add4
SHA512 d4552099424e3df1db50b24d54e35f504ba30e9bf18f462c9ad8ba01fd0056fd221e8b681701ab1f44aab28a3b2926ca9e2a611610c0554f120e644fecf4c02d
SSDEEP 12288:FRj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FRAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1794523919F5409C6F38BC3F4A0F7CB91F9E11EC025444D6B47E0BE9358BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6bd92a8d2a40493c04f0fb6b66b3a49a9f4d0d5dc55fa78d18755e65049b6b07
MD5 b0035806c938c3e0715c563d6292316c
SHA1 7e62f31815d454c3021468f61d10a65e1b8485e5
SHA512 50c3a57ef97af5dcd109d35fc07f83347da8494929a7ac279b05b1693ea999d368ddec2eb044d240bcb3aeab22334ebf9e87e30b63c144ee997d47231851646f
SSDEEP 12288:neBNUbTVO86US0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nJIULgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A465CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 46f53ac398095dbc898ecf6cfa891d1ccfec35ad7b65b1d323241f42009cb233
MD5 248cc67949b3b570593bff8841449d07
SHA1 1ede788ebaac4b7a78395b772619f1be15d84dc5
SHA512 158217fc708d5ff37830a3f2305491beb02bc7d43b1314dd0fdfbed11b9c572dc9440694b7f4489559f77f4a086ccccb0dbd20d56f31677b9656e28c23800657
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:4QvGAdlCEL8c/yRNw5CNU023W
TLSH
T1AB267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c048b19885a46c70a0791f8e02bdddb613caf9306b3c9237b1538d778fa402eb
MD5 63ca1cc2ecb621fbbe62f53fddeff7eb
SHA1 ca34da56546ec719c56c8a3d7ff3e498d7c10866
SHA512 cd38f9639cc77a2193b80a39c510e585dd35a5a0cb8221b8b5aa4ff24d684a03fdb348c427e54fbaba99723dc10a86d24f3149032d9c8a589352cea5036f3bb2
SSDEEP 24576:KdewsAjBgXe4i7ojhsP5Lgrk1TWb4AN5:6lj8e30jaNf1TWbdz
TLSH
T1E475E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9edfc4268a3952a8498cef6bc5eb2da3ddb49891479895b88cb0519b1b899a55
MD5 0e89abfddf208988142ee3af1d2675b7
SHA1 6a3f4e662a656fdfeff45257d17cac00bfa34d37
SHA512 cfaf41fabc3c4bd814beda023a1ae213538ecccfacf76752358bc61e83349a351810266d5f5c6f1f03d59f9b446cb5b83c89977267d68bcb3452ec3c7ea14094
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0p4W:4UEtQevvqc2W1cpV2EI32E4W
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35c2d7ef040e661fba769149f2bba3c2de1a753301630e8a9ef2e8b3a7adf555
MD5 e0b651bfae709efa7803239bddc42850
SHA1 70600939fc86d560b4c528aa53cffa73014fee2b
SHA512 86fe93c9689487adf37a14e053c2988edc24613dddb3770544ad2ef4d807bc3e9ae718ba1271d9e16ea3269eb0c2c1910b885b4b0faebf40c6d812830e33a640
SSDEEP 49152:/CbRquA/m2yL5zLfFiV+XenmE3/zce30jaNf1TWbdz:Yoq2VjnmhU023W
TLSH
T178D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 51dd2eba4bfa0fb97370d472711731244315e3986017f177ec8d7410cb440690
MD5 f955a68f74be5475812218ec10242b42
SHA1 3767fb16f9a5291236ace047dac64b488a136a79
SHA512 ea1980e51477f5f31d5b15044ab888f715504c689985ac9682b9789b3a2f98a13950e87b6eadaf35f6f022a8ffbcaf43a2cf0c45cb8236fd5c0f81c201ce938e
SSDEEP 24576:oAhGLJIFoiwtA5l7S53OgXe4i7ojhsP5Lgrk1TWb4AN5:oAMyFoiq5xe30jaNf1TWbdz
TLSH
T1D2359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2e8d2e8d2b278e98e1296eb8600c17a29620f1e2d0ec2eadade3c40d4c93eec1
MD5 96be36238771b8d70deb25e1d02acbc4
SHA1 5dd3f95dce95a2229ca66c992c64823e522c181b
SHA512 0502a045cc1f70d48a94633f76c5dd37732cfa1d0e0014b41a76767e552006152a12ec53b4c9da74a8734e009489c61bce042c6d6897c0f10e0767cc604c7dc4
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:uwuoOWVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10B65F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 16c240794b935caab847ac4002ddd997d9d9367cd8ca3729dc8320b9d945f053
MD5 9bb37c7c95a82a4c2af31de603c8841c
SHA1 f189d8caa66c8a49bcb4b71219f54276903cbd09
SHA512 677e1f9216150151f3ca9b85e4b64f5cbb099888b864f07a96469e229ae5030c89c430b20e2f4fc9480cae5bec6af565aaef491cb0ca5115468673d07a07887e
SSDEEP 12288:IBZ1IyQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2Zu8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F055129637D420F9E29782B8D4F68B41E7B13892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 542edfdffd75971a808c77a0d4cda3f3e69b2ef0d8c8143cde900b9665e42924
MD5 44ed2527e554fd60160ccffb4e1a54fa
SHA1 69179c48fa7d2233430258557202ffb0085942e5
SHA512 1888b6c94a29d7882e47ab12c78899418b225de8d8684bd70ba96a5fcafd337e53bbda5c3669e697309c6b925753eb1eb5e7a67ec90db60db551eac57ceac675
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:0QRQyi36YOcPQLvw2gAf+PN3WU023W
TLSH
T152667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 43b6aa9fa34c88a3b3e952674866c7f81f830b2f199b739b3c1206935e3f97f7
MD5 02c5ae09aa74bdf758116aaa0b619c02
SHA1 76cb7f9d57c3c1726fa788fe0579b8ac9a110f15
SHA512 0e8e60c4a76fa7a20cb173d6458a765cede91178e68401736665ed1b7333c0ffec81720e55449e6c858c5d85a8544de4e0eaa7740a5c31e4f3a822430dc56ae6
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:DQRQyi36YOcPQLvw2gAf+PN3WU023W
TLSH
T1C0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9050609d8a98f29cbc38c0815db25ef93eadaa04ce57843639cef61895c12010
MD5 b46834ced38c9a173743a897c0e253bd
SHA1 7b2370f2d69fcd87ff6dbf30d09c60b09033e2a5
SHA512 7aa45d7ce57606218c9fcb25cf64c58df37990890fc59a5a251ee02bd85e99675e9f3393177c7d013ff370a211bcf2a99132286f76d0b96942ef097883a2ffca
SSDEEP 49152:k68Qg55nhheWu7PNU3/se30jaNf1TWbdz:OthWRc/sU023W
TLSH
T140B54933B2F20099C04DE1769F4A873196E27C758FE0E7DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e9ae980229dc1ae88d89e2eaac56776289bb9fef55a00c2865f631f1b5f84c0b
MD5 f02f0bc8e733d87bee30ea28adf8783e
SHA1 97d10e8badd55d26bc337986f81be8cb87abfa67
SHA512 5c2ed248d26bbbe9897fa3d0680c4aaaa51434a4223100adab7e8bd3a865ed4d17bb785ba14a63c792292424bcb8302b23d7abacca32e4dafd7d3f03024f1042
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Ly5112gYy5azzVvL69nLKnhZHU023W
TLSH
T1B6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a3dd71444b5b9721e50807c1179c1985a97a0f2c0301abc27615dc6d8085e22
MD5 9ef060c72416a4f26af622812e77461c
SHA1 acb78d31779963b2204127ed8c05fc58dce16fad
SHA512 c60818e722198eda7d8a2f642cb1565bbeb13025ca6b7df85e9dbb1840ac7379bad24fc2dc9e60c761e6c3d7fe174db8c2611009e858e96387a448e656bcf179
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glee30jaNf1TWbdz:zu6JmVxd2deU023W
TLSH
T114D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c7708b882d49b67340002112d52b5e676ea170a385f7cdfd98f0cbef0abc63a2
MD5 af1c91ac8ef81a7e85f20dc1e4128fc5
SHA1 e52c41152cee7861c45d74d0fd807358122c1081
SHA512 815ea6f19f6e4e62e6a9aa00dbfcf5ffb4fc2ba3acc5737f9be116248438c02059e414f1d1b92bc75e1bd9d880fb74af06cd3b326bd0180ee7a646f99a4f180c
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xye30jaNf1TWbdz:ImifPbRhU023W
TLSH
T10CB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 80f1341d0f3f2ff87b6307c14a417df27691c8a0e6c0048bb2dd44c8b181bff7
MD5 b6eefcc1b9882f5580e348006b9d9089
SHA1 fdef897b7cf1882af50e74e483089c24db434d23
SHA512 397b953fbc79c892d5d6f012278eec87ecbc5dd7d6fcdc1689e44228fc17a0b5528c75409c877dadc3da7d3cbb9e3816ef401c5c1b1d71ecb448714255d8f09f
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqTe30jaNf1TWbdz:o5dKTi61TU023W
TLSH
T1D6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ebdcd4ae2c3a881050d125938645e4a322f832d02eba0c312a8e68f0e7017391
MD5 6fcfa860ea3f86f7e1507ab94f0d6ad7
SHA1 1048ba9aea0087f75a04745ac5d58ce8874fba6b
SHA512 6e7b5234b70a8779b990edff241d2cb5c8564182b3bbc7796d4aa0dc286464e8c20362e20f2095cce0a22f554fd0416e3e4420a0e4b6ad40c54ce2a5b0e18030
SSDEEP 49152:PhtSn8EApI0figngiDn0AP5wue30jaNf1TWbdz:eX2iyphlU023W
TLSH
T1D995BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 171655ee3f92939a1ca371701b0b8fb93ceab61a6e2c8728b205c88123a5cce5
MD5 b4a2de8dd9e303e8dd7165d276ecf855
SHA1 9ad5a161a6b08f5b16fa5484e0a873c85a1edc59
SHA512 08207de2a95713e0cefbfec1453c224950cf82c9b19ce63832cd1a1037348f92f25705e0a778b75db675e659fb756ffde36e49952f76ea855969a383dd21c5dc
SSDEEP 12288:Sb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T173452391AE5509C6E34BC3F0D0F787D1F9E02EC2724049AB17E0B55359BCDDA6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a2fdebdfe88d2167d06293a80dea04830ca49c83ba10ee2c0862fde14537c7af
MD5 9141203aa012c5e95f34ded5fd40c1e6
SHA1 20c4adadd77802de0ff05746c54178ebb32bb632
SHA512 c418988747f0dd9e21c1ba28c6ffa3eaa6342e575adac0ece37518b7617ae76d9b933a200480fc05aa9edf2eaba9417624eafb7928f353cd4a30d5c6a77434f3
SSDEEP 12288:Zc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E9452391AD5509C6E34BC3F0D0F787D1F9E01FC272404AAB57E0B55359BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 36983e8d457dd0c1216456d55d407a4b18a6e0e52a4b3201952552bf092c55a8
MD5 138295cdbac4d8aaaf7b39627e3a9c4f
SHA1 771e543818ed5e1037ebca7ebeaeda7b88b305a7
SHA512 3cd56b3721512701e66d3735d10e6d8ea67d218f0cdf57a6dd0a2d15e7d945965624439355faec9868c50265f57ab65e1e763801f424d66a0774c316464fdc3c
SSDEEP 12288:Nq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T181452391AD5509C6E34BC3F4D0F787D1F8E01EC272404EAB57E0B95359BCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8bed73aa2668ae7e7480569588c8a0b32356a19adaf11cddc83ab748605205df
MD5 40e3a710759cddb2248b94a09c88909c
SHA1 75a5789ccbd45c87084b48a282bba7decb7347ee
SHA512 aca74ee2192597fc1358b7e068423dd4dee61e72c9acc5db100ed2e581d793bc2954547ab3384cd59ac57969c78472d2442e077fc569abeceb1dd59ce3e80374
SSDEEP 12288:cVB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A94522526F5505C6E28BC3F4C0F38791F6F13EC173118AAF47D069530EB4AD9AEA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5128b2fab69cb43dad6e0b26edeaba845bb051641aacfd2c93b0b69b5144d2f5
MD5 8ac986e5ab790bb4ea95b9b6adb15a8b
SHA1 cba83d191ebdfbcaf5eece292e21e0e76073cb05
SHA512 fb2d4ec3e8ba3a6ea7b39974d76b357b7cf3c5d23daca5fa696d90c00947d794d3a321af8e746d8fcff7e028eedfdd0b3dbb4ed6ec9ee8c03a3f93397e319865
SSDEEP 12288:TJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11E452391AE5509C6E34BC3F0D0F787D1F8E01FC272404AAF57E0B55319BCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 33fa2879d6172bf1ff4a54b2468214a088221bed8f650115bbfa78347ff11d7b
MD5 7683b77a29ffae8316c09f39d4685b76
SHA1 ead5ede9ecabc840aae7318841aef382a6d6f772
SHA512 c0fdca7a1cee56375c7b49879654bcaa04315a262e6d4ab511f85c8e43e76efbc446474051244fa2e174030dfb28abdf8ef1d070e930eb331542864254d122cd
SSDEEP 12288:840DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:85gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B452391AE5509C6E34BC3F0D0F787D1F9A01FC272404AAF57E0B55359BCD9A6ACC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d734edd3896359fea76d6b63de4b5e322b16d997cb8f99724ed56a63e68b27ea
MD5 232df9c3821091a066a8f35084bdadc7
SHA1 311f42935ccb99350c1d7f869c875f648f6dcfde
SHA512 04892ec271ad11e56cc41cb53ed56d017fcbd8acf621c849bf14c96caa6d94e5adb893a52221aeaff43f16adf36647fd11df5e4513f8a2305913e77314892a7b
SSDEEP 12288:pk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:plgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A452391AD5509C6E34BC3F0D0E7C7D1E9E01FC272444A6F57E0F55319BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2ba1ff6df65995834c04ea40ab3ab5c14a2975d5bbb305b72ab577f2a1263b05
MD5 486095161ccfbf640ae678aaa51a3f09
SHA1 a6dd3b3833d83e5812175464850c2473807d2f8c
SHA512 f411c11cf6552859f644a1028849d55c6aafe82c747ce1e874eb8a86670d0dfedc275ede63e68f1c281620c0f88ee509ce3027390562387930453fc7a0464e27
SSDEEP 24576:eZMSzFVSO9gXe4i7ojhsP5Lgrk1TWb4AN5:eZMSzfUe30jaNf1TWbdz
TLSH
T188650195B3500CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F737A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2984e5b1f577336a31c00e50ce6d852c2bc60d43e1ea41c37d45cf620e819973
MD5 2998bf397f222be9ce2501279e4099c8
SHA1 122c45790bfbdc4595a25be1144d36e798a3ac48
SHA512 59586be276ad2efd0599211a61e1f06c355d5ae62a2b1e4a8b815bc72c0b7c15c7a20c17d56f038164cba6ab5a03509be66b928933b8416d10d243c3dfd4ce2b
SSDEEP 12288:o/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:osgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E5452391AD5509C6E34BC3F4D0F7C7D1E8E01FC672404EAB57E0B95319BCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8a64b37ebd4c05ba2ecef5e6bd70c0290e63fc495b5e250430f333063402de25
MD5 83b44e502443256501359686178bf501
SHA1 e1573a173b25f2c890802f7e41949d6f237bc828
SHA512 4753e8e34131398c7d90221b6eb08a4319b00e62745292f04b161687e770e01b2c63f47ebff1c7024c21e925d119b89985c91c5293a68539539eb159e1edbbc9
SSDEEP 12288:oz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:owgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D1452391AD5509C6E34BC3F4D0E7C7D1F9E01FC272404AAB57E0B95319BCD9A6ACC868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 22787d3336be7771f61d706efaf91200ec4d384a7f62507bd5a4317b4742ee4e
MD5 cecbb7ba8eab3055db925d6091017f0e
SHA1 a9c29fa407912293759911fd22be1fd18cec9bb7
SHA512 98f8b8ca58fde92fd505e206d45efe43cab1c6e6a97ac245c8b224ff91c8e9f406edd831e664cbe216ebf6cb7537a7c63088f54bcfb5605a16cbabfd8bf5c3cb
SSDEEP 12288:JyPz5L8Q0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ozyxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11B55015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 223ebf7ad5d703df084b8fff4bdcf11f90f7c623d8c5cd184074e5cb739e32a8
MD5 034aa8c80685551b7e317ed5e9bd7321
SHA1 e2d51d2a2d777d3cb479565494c457600a97d883
SHA512 2ad27a41532eafcdd47e57c48b1f442c850c88e584ac8f86215321f81dcc12c632d09b225312dddba832970307e9b9e023158836dcdeee111ab7b0cd2b6b4b2e
SSDEEP 12288:i/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:isgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T117452395AD5509C6E34BC3F4D0F787D1F8E01FC672404EAB57E0B95319BCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 809ed6dddd4e8cccc6bf64c89e6fd7acdbbcfed18191e2e185d0cdeb36ef884c
MD5 3373f33b416f3f7212b01f388b0b4506
SHA1 821ab8b373ffc88d733b5a2bfc2dbeb943b6dd72
SHA512 b02fb1c13e263f1c02478dd20022c9d7d1cc9bd9fd04b8a807e380f13961a94f9645e40254cadb575abdf84f468f5dcd6d5af18582fb8e37a827db9632419dab
SSDEEP 12288:1/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1sgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T153452395AD5509C6E34BC3F4D0E787D1F8E01FC672404EAB57E0B9531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 78e3b3c871dbd4999302ba5a805ff6ed7046b2253ae58126e0975943be16a0ce
MD5 31f83c47c6cc7b31f59ee999d2441591
SHA1 e389bc0703ec245f665834ad663c73214a78a3a9
SHA512 e0d2da4f150264c6e4916dbca3e433d6372f52647466c3d7d4407aa723c1fe4ab9e10b3b4b158d575e1685959075dd6669eee1dc0bd1f98f7b82ac5eff0161a6
SSDEEP 12288:QyPz5L8Q0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hzyxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B355015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2eb90a45bbb4c9131c339c7e01ada425261c98d0043388a98c606b93fd26824a
MD5 08cb38a2e9d3e1176db354ca7b9c65e2
SHA1 5e944baa534a4dde1f52cb83dc6fe54e3419d4e5
SHA512 ae4698c3184b643bd5a76ed726d30b562323af39d1ab917af4bf213a62a23286d506f68ebab59cf91af57c975863cd35d42bd2f633cf7505b92809d67804ae25
SSDEEP 24576:QTHaLl3z0zDzgXe4i7ojhsP5Lgrk1TWb4AN5:QT6Llj9e30jaNf1TWbdz
TLSH
T1DA6502A5B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ec5a6fa4ae2dd6cae879722f02cb6e2e4c657a47f0d9ea7b9628b0d442fa46a9
MD5 2f817eb5eb95b69595ce5e05bde94db3
SHA1 8712f5e28aeb2280e507ab908ea2e1c7f02aa8f6
SHA512 1e98520863b6138477e2e4157b25ff5c529abb3d0574794e9011f7ea6e2e812ac81ad57d23ef7048cef9236865e1bd67e9531dfbe53b159397c930e507c325a5
SSDEEP 24576:w37d9CHKy7GZfgXe4i7ojhsP5Lgrk1TWb4AN5:67d9CHKyaUe30jaNf1TWbdz
TLSH
T15475CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 623f8357d5798141dba66d1f93f566b16cc9cbd989bc9053a6bfcafc40f4c431
MD5 bad110f413ade429daeef5f78fb884e4
SHA1 7fd07dbb94c3e0547b4c294cdc5430160987b169
SHA512 bc89cb07001b07231d91b3ba659233dcb30f921ed26017bcd4f0e97aabf8e861c347c8f76306597752be9e223ae64847475c5b98f7065f466617aa6410429827
SSDEEP 12288:EK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T164452391AE5509C6E34BC3F4D0F787D1F9E01EC272404EAF57E0B55319BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ab4e7a8e74e59f04e1c987fd6ef3ec957f12bd24c77c230a87ae51516ce22ac4
MD5 3b3214277b2eb654621c25e6e002c481
SHA1 56bec141f77a16962f8d1db2d853d95927fa477b
SHA512 6ac8bbdb7b32ccaf88ca91ecdf217741f42dd103a3da0889cfeb47d4c46f3e61f6ad729274b223a0c99c300e231ec6373d4d1a01cd8d150e8d618992ac915414
SSDEEP 12288:aw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T195452395AE5509C6E34BC3F4D0F7C7D1F9E02FC272404EAB57E0B95319BCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ec0acaec41ec0164672c7fa37a8ba9cca85553dff44631d93c5aa2ae8599f905
MD5 5823b2387374b3de160bdd41a5a48770
SHA1 a156a5080bb8d18241e201ba1232475bcdb4718d
SHA512 e0af643194ad2c8e9d26a46028ef06e8188b66155aae1fdc1c97950574ad31375d15bdf8c6978ff50553a2fd73eccf3d960830669f40e96209dc2ddacd73d35f
SSDEEP 12288:TV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B9452391AD5509C6E34BC3F4D0E787D1F8E02FC672404EAB57E0B9531DBCC9A6A8C4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 24c479fefb3bc0626fbcc4dedf4928515a4425413b4bbc2fd34c2176245a8183
MD5 efbf939b7b4c55d2925661f42f8bcd71
SHA1 dd32cd1926cac4b1b64ed55261010643f386c0e0
SHA512 fcbf934b99485d7fae87fe9a6353fd8522782277b9b4d97b570013449e7529f445a938d361aa0d332c8fcb54b9a323f4b238bdbd4428eaca548e15312c809069
SSDEEP 12288:r/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rsgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B452391AD5509C6E34BC3F4D0E787D1F9E01FC672404EAB57E0B5531DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ac43d850f98361749e510c0b08525ae389d16ae738471544486fd67ee71384d0
MD5 5f54f8949fb9bed5bd11832c0da50f98
SHA1 f7199a3331e449e6710a1941d426d51d27a16f7f
SHA512 89cf7bffb6dd0527cd47b0233ac617542d7f2766ceec416b7eb925c1fbf5855973983b93c733bcea6ed728e7b3b35e6f047654b5c2c4fe2ec49bc61c6407641c
SSDEEP 12288:TK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EE452391AD5509C6E34BC3F4D0E787D1F9E01EC272404EAF57E0B55319BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4c1eb7c439f710b4fc2b76704ae95164f80e3dcc1c9c1c17315eb2a4c3f5bac1
MD5 548f6a331dda0bd175f7fd14ad3e5933
SHA1 ebae9a41d2c7b8ee206078ed2c2190fa3ff3989d
SHA512 d0de702ec946c377a9d6c375ab564a049ee039c847eac91a98671624aec5df915835dadd12127303d24a428052c06b4b3f80a18fbff84dbe84c21ccef1f9eac1
SSDEEP 12288:5H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FD452391AD5509C6E34BC3F4D0E7CBD1F8E01FC272414AAB57E0B9531DBCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d74c639de795f26b8e7230d499748ebd71c3e526d30df58596de62c2355a6599
MD5 14199e0071e47814c9b1cac2c9c33c07
SHA1 900c9693f9d3c0f87f931afc55d5f29aace025ad
SHA512 3b94103b8c25e54e26670eb4fc0e4801c535922dc0bf7fa99681537f31f702cb0b8cc80a3d06f9179efedd925bdcdcde7397480f9af2f77ea296c81fb4f52910
SSDEEP 12288:FJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A9452391AD5509C6E34BC3F0D0E787D1F8E01EC672404EAB57E0B9531DBCD9A6ADC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f8b80448c912ac5f7f4803ba697bd04f2c163d624a7b04abfa485414e5b0ab3f
MD5 145d9a6e6b064f1ed52d46d519e4a7ab
SHA1 8837e097a6ecc9f65c0c1cda134ff15316b7275a
SHA512 e108eb92aec1c0e29a6aaf6299fa8d24163006ec296f05b8d90cbe063f031ab90221cbd25207462c399de7ad73366f81a11ffa7f286ec8ddfcc80c09e14d1837
SSDEEP 24576:9fwvok9RX6wkyAIggXe4i7ojhsP5Lgrk1TWb4AN5:7MnYIne30jaNf1TWbdz
TLSH
T1B585DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e48a0f974e3a6f47b5ec671f0bcc960dee85849e2b345f8530bf0cca6d621fbb
MD5 a76f58c33de9b6561bfd047207be18ac
SHA1 37496e56d988c5ed7f84487bbd8abfe4b9133b05
SHA512 edb7cdca8258893ebaa699b826712b0583d1180053f2c1175ebb3fde68b4cd2b1e3babdb38363c8d0742ad36a78fd999886a08f90a1a2c6cfa42cb46beeb7ee2
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Oe30jaNf1TWbp:fySzP2U023W
TLSH
T175067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6ca0f7b446558eaf89ae22b5f456b6d77f4468db88da25da860f17e0c2ddfddb
MD5 1c0b92a58456be800416441f12c4843e
SHA1 32ee5457e2fb0b00ce8c88e684e8c3044e53db7c
SHA512 99a0269c3d07747ba073bbb360897433f679ff3cc19da898c9a683dffc3c1cc32b0bb844a3910186f419db0d77ac8a862d353315e79ea17252d77f2a6e11eb64
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtgXe4i7ojhsP5Lgrk1TWb4AN5:o47JUQj1irIhCnDHUPfF/ee30jaNf1Te
TLSH
T1F965AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7db179bafed915b2e6bf33f74e89e2fe72506711f76fe6d1b23d381a831511c4
MD5 26c4655e378312a9496b73ae547235d7
SHA1 5571667ba10dab68d30496d0222b3cfe0312ab58
SHA512 27510f5194ab152b78d31bbc703eb2384393ba7769721969152eea2ff59109d6c6c93d15426b7669bae3cc8562d7f1298d204a09bc6ba308c187feb06e2b469a
SSDEEP 12288:UNsfv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:l8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11855F15AD29802D8D15E92B4C3968A41F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a147927badf70933e94984ca3afede220b39aed70b2c6b9c54772474ae41ce0d
MD5 1fd49fd82caac7ad6babf6b6ff397ef2
SHA1 2ffd5bd03c39456d8a46c173c71d6bd2cb821c7c
SHA512 75d37757e879a30bcb10f9bb15f72dd6beb7b392dea0db26634284796249921df1e7ce3fb3c5140d1f1b09f3e96070de6d6521858967d830ff4d19af90f36707
SSDEEP 12288:3m2jkgU3fGkct3NRP9IJWSajmrY6hW0nQouNZ+Dv:3m2jtUP1ct3NR1BSajmM6hNnQoaZ
TLSH
T1CA3518007626DB4FC66940322E76D6CCAB707D02EE05AF1772CA473FC576658B6F2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 84457b6edccf76bd7e3529c5532550e26f752c05a1829e5ecf52a8b284b35673
MD5 e42722d193139d34732d529b4f6a04f8
SHA1 f16c6cb9d10d3a4a175b55302235450ef6eb287d
SHA512 24848b2b74428932afd7f0ec38aa272fe566a76c3f1cdd3bff3ede5a73dbfbb8820358d6a577bf4a0a2cddec7a7e46a37f83e2e8116a2d39048df21c608b78c1
SSDEEP 12288:Y96/NYwOgJwSFw8/fYHqzKDqcJc9mdrWnyX20d9wpFQVd9imuIlMtxSiD:Y96/NYwXRw8/fQuehK0fKF6dwHIlMW0
TLSH
T10E752A415577DB4FC97E4037033696CCABA4AC16BB893F0173858D3A886792EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b60fee5a64521460c5b72686aa6f64a1af206693f63e4cd63bd95888956469ec
MD5 544c7108f995c79441b41121b961f92c
SHA1 09bd6d9285942e4bc838c58f46be1f9c38c3a2b3
SHA512 2c33bf062fbf5ee3ffe029752addc9630de23cc53fc7ffd4c3cc81fdb2db08af3d4352258b2de8c6880f6dfa0291d04bf2c9e340591263b97c4443828a0ab41c
SSDEEP 12288:cF730DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1244523629F580DC6F29BC3F090FBC760F5653EC1270089EB56D0B69318B8DD99EB8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 025de5f7a4a26d5218be0495937fb0b0171711e8b5a8cfa691016e24ef5a7bda
MD5 feb5560ada2355ab2b38ffe261c083c1
SHA1 a34cf3e61ca67e302921440b80acb4677dc97f1f
SHA512 724d7391fea9742ea5834bbc24da16b123a8ae41b496aa20cf1f37d2f6337222792de3d10786584826785fa6dc9eb35cd1e2173a34551073cc7de5b25e9cb7d6
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bY6gXe4i7ojhsP5Lgrk1TWb4AN5:Egb4mBIBhGFoe30jaNf1TWbdz
TLSH
T16A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 83fa33635eb5a47ffc6dcad6af72999236f809938b68681b1059ed917b0cdd0a
MD5 5e697f01bb8833eb050242f76d6aa472
SHA1 98e71cc0819c0df66d45e333e07fa7698b51c22a
SHA512 a76f36164b770414cc3ae574f16a8287e3405100abaecc3242c9115fe3ee27d392490a7e3f196177666b097bae8d820c9090914ff9248eb5a1484d7964c5fe33
SSDEEP 24576:NG88u8FpJqH1bzria7/m9gXe4i7ojhsP5Lgrk1TWb4AN5:A7ZFPqVea7/Ve30jaNf1TWbdz
TLSH
T1BF85F16577E101F1D07BD138898246A3F6B2B8111364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c049721ded34d8dbb55eb8b9f7fb5e7a2d23925957d11f0b9897ee4c1acd3cf9
MD5 e4a8712466f0c700b913bbf1ce17794c
SHA1 7beb288a9ac17c997deda032af07ec462933383a
SHA512 8f707cc688325cc6b0b1a3c40723e07e799a8c997a19983c5ffa396b70b6f8cb88262104d6cdb9157b2764f2227f4dc5fa129ec6ee444ae42b9d892f48f07a6a
SSDEEP 24576:6PUr+NQpgXe4i7ojhsP5Lgrk1TWb4AN5:6JQUe30jaNf1TWbdz
TLSH
T1EC65E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 10fb8545db1aad668a7dc557183fa118ac7907fac3d539dde5dae8d7810aa1a4
MD5 0513e51cf047d30223caa9098913d38e
SHA1 5c567c7e4e1069f55c7b656a4e11cf3b2706cbbc
SHA512 661ad2a1244a311e8d0dfd0c8179f587e4fe1c3e65768812154866a590414eecdedf40a59aec9b2eed260a447ab474779b76557e36a5980ccfbd9e90a87fb190
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEe30jaNf1TWbdz:QG05lO43b/U023W
TLSH
T19BD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0c91a350f5668c31c2d7edca03b7e7a566b13efa2ae8a9531c4cf1776188e3b6
MD5 7ac67861234b47d5438fa3ef58486cdf
SHA1 f26520ba8d12c365d4cd2f6edc24d408b8a3d721
SHA512 657ffbe77eeec7c4e74e4ad54237961dc39af35c987f6e3050235421483cd24d7a1b3efcf8df171af8719436742122b93d54afc4914fbc0a8d0514f9059425a2
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnngXe4i7ojhsP5Lgrk1TWb4AN5:5a5POZ3+Jt2pasx2+mse30jaNf1TWbdz
TLSH
T11E65AF5EA6F801D5D1B9D17DC583861AF5B1346253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 08cb2d35ba5ec8a4ef30065a03e598a1ae4710cae365a4bf2cfeacf1b62d8124
MD5 7b45ff0cb5824513e2e9dd38cae9fcb7
SHA1 df952ad939c89710ae8e72fbb031c408d30bfcd2
SHA512 6e72c8b02b4b9c2cedd4f68ab1100f31b437e7a0d1cdc4f82203f38636f5bd6f436a512e56dcc9d5ae161e8540ac3f4e662e8e5fdf7bf96b5a81f62c2a276da8
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fk1gXe4i7ojhsP5Lgrk1TWb4AN5:oNc/zEOVHF1e30jaNf1TWbdz
TLSH
T10C858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f034f9722d510b8e503a6c328abd4c5d23ab35687f7117ace1ac03ddf4a62d84
MD5 2049eeec1b5084eca3d07b228b85cf4c
SHA1 35ae9e2a53907eede41f0ad8b01a3600c56b23e4
SHA512 4f2e4d3eb6fcc2116719f6faf3cacd4c82e8ad9ab8d8f81e97040fe2d06bd4f5c9ada5e3ee4122c3056cd15cf1b79e3099e6268487cad26660005e0f3cd22e68
SSDEEP 24576:L8kNvNnaFeYhJNtmZBm7gXe4i7ojhsP5Lgrk1TWb4AN5:L8MwBtOmie30jaNf1TWbdz
TLSH
T17355AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ba548b358a27f8c9a243959c6b38b94a513d21328b681daf2e8315ba73f2e106
MD5 c2614bbb56ab0bb8e73f68f3a87f5971
SHA1 7956c68feb46405bc5c3a63857d4497cdb6909fa
SHA512 48fb7fd82d3fdd50aa195e2ffedf88d01224b5a2b4d47010e380a83da8f4732721ee911e017576c6035eb4494904f9afec06b03127b0fbe307e03b4ed977dc45
SSDEEP 24576:3D3FHshBIYQgA4gXe4i7ojhsP5Lgrk1TWb4AN5:3DVHeBIAAPe30jaNf1TWbdz
TLSH
T14A75E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/880-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/880-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/880-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/880-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/880-292-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/984-126-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/984-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/984-132-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/984-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/984-134-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/996-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/996-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/996-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/996-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/996-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/996-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1132-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1132-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1132-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1132-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1172-248-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1172-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1172-65-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1172-71-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1468-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1468-277-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1468-77-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1468-82-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1768-120-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1768-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1768-113-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1768-111-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2468-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2468-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2468-311-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3372-2-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/3372-75-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3372-0-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/3372-6-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/3372-7-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/3424-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3424-20-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3424-14-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3424-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3560-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3560-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3560-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3560-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6136-53-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6136-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6136-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6136-214-0x0000000140000000-0x000000014020E000-memory.dmp

Download