Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe
- Size 2.3MB
- Sample261017-e5bttahv7k
- SHA256 f4aa1ca8e200a80abb071eb9583c9306b1b655862130c72cee65f18e2d81f92a
- MD5 e4327b63dc9e700200e7b12aa388cf90
- SHA1 b4eacad9a983a303bf7ca9123e9b9dc4bd8f5e6c
- SHA512 555c6dba262c8c4cdb9c01cd06323fa5c191580a305cbe11c43b251531b675d9e53f32c234840fbe9da13eadb6556eb2fff25925bc55d840e1b08c3c6ff0b572
- SSDEEP 49152:oxIPU/Edd1KelJ4F9fJ4klKXnjh/91Uc5fv5050xJITAEm:oxtFfJ4ke1Tv50axJI3
- TLSH T1F1B50121B641C075D7A201F50A7DE7B9093EEA2247395ADBF3E41E989D301D06B3A39F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource behavioral2/files/0x0005000000016ab6-375.dat behavioral2/files/0x000300000001a84b-376.dat behavioral2/files/0x000300000001a786-377.dat behavioral2/files/0x000300000001a785-378.dat - Executes dropped EXE 11 IoCs
pid Process 4120 elevation_service.exe 4756 elevation_service.exe 972 maintenanceservice.exe 404 OSE.EXE 2244 PerceptionSimulationService.exe 4372 perfhost.exe 2308 ReFsDedupSvc.exe 4680 SensorDataService.exe 1504 ssh-agent.exe 2104 AgentService.exe 3436 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\75d2bf349600bb.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe -
resource yara_rule behavioral2/files/0x0001000000009326-387.dat upx behavioral2/files/0x000100000000939a-388.dat upx behavioral2/files/0x000100000001b974-390.dat upx behavioral2/files/0x000100000000ba3c-397.dat upx behavioral2/files/0x000100000000a316-403.dat upx behavioral2/files/0x0001000000006276-406.dat upx behavioral2/files/0x000100000000bd4c-405.dat upx behavioral2/files/0x000100000000621f-404.dat upx behavioral2/files/0x000100000000a301-402.dat upx behavioral2/files/0x000100000000a2be-401.dat upx behavioral2/files/0x0001000000009354-400.dat upx behavioral2/files/0x000100000000a1d1-399.dat upx behavioral2/files/0x000100000000a0cb-398.dat upx behavioral2/files/0x0001000000006211-395.dat upx behavioral2/files/0x0001000000009b8f-394.dat upx behavioral2/files/0x0001000000009cfb-392.dat upx behavioral2/files/0x0001000000009cd3-391.dat upx behavioral2/files/0x000100000000994f-389.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4d88766f05ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052a05d66f05ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edfea963f05ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4bdd69cf05ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009243bd65f05ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000de8e661f05ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053c60075f05ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe 4120 elevation_service.exe 4120 elevation_service.exe 4120 elevation_service.exe 4120 elevation_service.exe 4120 elevation_service.exe 4120 elevation_service.exe 4120 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeAssignPrimaryTokenPrivilege 2104 AgentService.exe Token: 33 3436 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3436 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3436 SearchIndexer.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeBackupPrivilege 2308 ReFsDedupSvc.exe Token: SeRestorePrivilege 2308 ReFsDedupSvc.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 5620 2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe Token: SeDebugPrivilege 4120 elevation_service.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3436 wrote to memory of 2824 3436 SearchIndexer.exe 100 PID 3436 wrote to memory of 2996 3436 SearchIndexer.exe 101 PID 3436 wrote to memory of 1212 3436 SearchIndexer.exe 102 PID 3436 wrote to memory of 2324 3436 SearchIndexer.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e4327b63dc9e700200e7b12aa388cf90_darkgate_elex_glassworm_magniber_maze_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5620
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4756
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:972
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:404
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2244
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4372
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4680
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1504
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2824
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2996
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1212
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2912 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2324
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 432e4d9d728975fa156ffe1adfc1af8c7bd9253c5f348cbf4ef0148d376dd781
- MD5 8b0a04b311b7b9c9f1b137f52226c315
- SHA1 e8d9bbcfa1ed39c68b3323509df66a44ce07bba2
- SHA512 f861e8db9857b0e32df38caa8e469776aa46d4ea560662fbf24974a2ebbd45ed450ad5b04bc4adacd16a06a55f2613399e8d7e0e974f6c29e46193b8626d992c
- SSDEEP 49152:Ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKfJ4klKXnL:i3q6mjB9fJ4k
- TLSH T16BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 783d7c209f29f0eeae632887bb0025b45cbd7d078eb2104091564e9315f83607
- MD5 b02c8a7a099a6549c7c1f168f660d713
- SHA1 98a9f997adff46914bcaff9ae7c25e65cc445372
- SHA512 2a1539aedd51f45e0190f31a3780579734ca51bca6df49f0248d74f9ba6c9676bfbb19a2eceecb8010dd1a4e45f744cbddaa88dec3539d28787f7cfaefd83016
- SSDEEP 49152:IkcgfJ4klKXn02/91Uc5fv5050xJITAEm:IIfJ4kc1Tv50axJI3
- TLSH T10B75123973E009F9ED6B8279CEA1C401EB33BC814725E79B03A099652F776981D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 c9eb3383aadfce2ccef9eccdae1637d6c4dd387677ae51ce823ea513c9711992
- MD5 b0c9ba2128d772b5cd9436a8f8e97c1d
- SHA1 b2332accd84bd126cf63cf33c44f684eba0c82e2
- SHA512 3038af408d1080f7e2ea00544e4178f60681f4bc9344935a6493d69cc6f59903a099d71fa5c333bd0ca88ac400237470f46e5438631ef493312a03c83a322584
- SSDEEP 12288:31XLsswWkxy2lRq2czABfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:lXYfDtczABfJ4yL/tNCJPXUQrPs
- TLSH T1FB05F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 8fe0465760df47cccc923bfe084a935c3ac4be6d5d9b1b21e1dc09d32212eb31
- MD5 bee1daad27c46d99ad580441e5a56599
- SHA1 8f7fa7fa98e7c006420a8365d12fe66df5ec2962
- SHA512 ce4284a22d4abd4da9b552503d03fa09d5ae431f5a9d2c2dcfd79704b2147c285bd4f2afae1fbcf83118d90c6845e8e8db79ef82122892ec2779186ab2d7ff92
- SSDEEP 12288:Wmw5HEjsChNEBFgl0WDm+CwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTc:PwuROWXfJ4yL/tNCJPXUQrPA
- TLSH T17C05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 65e79018faefe3fa817e8678f63579c5e79fad7c50d78db9e707bbdc029665cd
- MD5 04119b2a8dca86934040e4a7ae7008d6
- SHA1 c0f6f15532147fe62267fd63c061afc832d496c3
- SHA512 4523c2e72bb58d53375a6ea781d09717fe50f6a941a1259297c02356e1a9903357e2a0eb12f3355461173f1ee3a2b6b9b763b5dd8a534f82ad9423612b651b09
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRfJ4klKXnq:zu6JmIxd2dRfJ4k
- TLSH T11BD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 2322aeb009debb6229b6a2b3a675288b895b0c7d318796262ec9c5f1a4cfb622
- MD5 7d2c8b56303c1a24baa1b45bbae45857
- SHA1 30c0a3e78184b6c47a9227f40525d249b7a6612c
- SHA512 4595242a61f28b53252feff3b35d1b14af831699003c792dce797111521bee05a8fa8707b5e5ef5720f9258847fb3ea1a5612266deef01b12171190890e5950e
- SSDEEP 24576:Rfwvzk9RX6wkyAI+fJ4yL/tNCJPXUQrPK:QMnYI+fJ4klKXny
- TLSH T1C935D02AEBDC44E5E1B7923C89A7860AF3B178591B31C2CF029653AD1E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 7a1fc3ee40940d25b34f670e121def97f726e112ddeff08116128bdbdb0208be
- MD5 94dbed2da7de7528e61febfe644481bf
- SHA1 865aa1d7c6c950dc7d90415d501965aaf30706d7
- SHA512 8e8b4409ae7dffb8c290bf8d1077714add4cdcef3339c5dab7cdf93e69f61cbe7e586a98a952f1bbe6654466c54c25f85663de1b79103afd952a6e91c6dec883
- SSDEEP 49152:EMnYI+fJ4klKXnyf/91Uc5fv5050xJITAEm:P4fJ4k31Tv50axJI3
- TLSH T12385012AEBD808E5E1B7D2788DB78506F6B178591B32C2CF029653AD0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 3253ca8078cd82168f523e89b3379102df8a2c9d6056cd0a6f31c102a3f1cbc0
- MD5 7982304ee8215a39d686fb87de21e293
- SHA1 bbc3f0a26b2083f34a631726560bcdb0423d3d44
- SHA512 df5636e8ee9007f5173c7555c229ddeaf55012625141d7046837816db2bb47feb72f0b0d80d2caa0b79de6267807da41756aeeddacc833e16ea5bd70e2e20436
- SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hfJ4klKXnc:xySzPJfJ4k
- TLSH T1BC066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 4.3MB
- SHA256 babfb0e56f4172df117353b2ffa9bd4c3e74a29b1a4b8327a9bfcb9299889313
- MD5 0c7262a8ab7588e8e9062150d02a9528
- SHA1 386d799a709e473af652c3c71484ca009ed73c05
- SHA512 9ec9734af71fe6b6d29a36fed4f84c7ff69e9655cb802d810e39e935ca07ac66269702ac792d6d602a4c66190aa012e46ca4671ee4200aa63edae9cd2728f1a9
- SSDEEP 49152:0Y9rNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hfJ4klKXncKMj:zySzPJfJ4kym1Tv50axJI3
- TLSH T186268D96A1A801D9C5B9C1B98F1BCC17FB7134490335ABEB02E556835F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 fd4b270364b6511f192257c03152d67829cb12b39d188b77cb0dd37f4d8dc208
- MD5 f277180548f1cbde89ac4ff91585765a
- SHA1 97cd5ad3715fcf2f08cd0d6582d299490f75126b
- SHA512 1e31f3f171f99c72448fac34b8b9274a5a07f130cf60086cc414db023de5ecf99bf607c45558f9600de5edbbbbeeec677d012aeefce7c5aac4186bbc966244dc
- SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY/fJ4yL/tNCJPXUQrPq:u47JUQjqirIhCnDHUPfF/RfJ4klKXnC
- TLSH T11265AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.2MB
- SHA256 9224ddf6a34ba9945ccafbc3e14265eb7294e9c593492c891bb143cc2925cb1e
- MD5 c82903392adf9ed59aef71bf47fa0e13
- SHA1 6692f1f49365febf024dad28d9937342289bc12c
- SHA512 df2d47e760bc73449e2d4f73e1fe78ea41a0a2866af1aed6ad0bfa4df11174eac325c2b3d860102e3c43313e18af88a28d0598a16b59b8b7fcfc5c903459a980
- SSDEEP 49152:l97JUQjAirIhCnDHUPfF/RfJ4klKXnCzy/91Uc5fv5050xJITAEm:jJiglD0PXfJ4k1Y1Tv50axJI3
- TLSH T133B5D01EA3EC01D5E1BAC27885158A1AEA71782E1B32C6CF1270837D6F67ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 b3985782930f002ec96e338308a1fab736452ac9e6d0b20541b459d9dba3701f
- MD5 011861d98cef216c92a59452569069ac
- SHA1 1e3e6a5fd89ba2491ce29dbf1288e36a244f3571
- SHA512 68271ae41fe70e62fc09911c3474f9d28a8e533ffc805ae2975ed0c1f876a2d6d05259c23ae0650678404469606c89433cd761fd60466130145d0624e102a164
- SSDEEP 12288:MMvsyklU3fQt7/kV73/Jx1CC2N/Wo/HxAG0OT9pxyZFKKcmencv:MqsysUPw/OPJ7Chkwv0m97gFnck
- TLSH T17E4538007626DB4BC66940322E76D6CCAB707D01FE04AF0773C9973FD576659BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 301KB
- SHA256 cbfc83d97d11110f3de482227ce12373fc0af0309d6d60fd87c06072ab24865c
- MD5 8edf5d70e06dc788646317032ba96a01
- SHA1 6577f30fd79f574fad1d79acde403c1960bec361
- SHA512 9e15aa021eb636108cc524532ce72028d52d9946ab441c62a085e67bd1b9bf0be1d669a4397dcc1340788fac91108eecae90d1cd01a5a97e3424ea981e530d21
- SSDEEP 1536:B1bMh8toike871uYzDx8etluqzqetTz/a6IM+66E8XU5suqPQunI07fc0cvf:HbU8ttOv7Rp/IE8XU5sueQqSf
- TLSH T1EB64F741B331E25AD5B740734671AA8EABB9F812AF025F037BCC0979DC7624275B87C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ExitBlock.docm
- Size 775KB
- SHA256 0aa9bfdff6f0037b78b3e10c9f650471b5cba2ff35cee68505da9e8a011c73fd
- MD5 6b5b97843db69c18f51992701b870fed
- SHA1 ee533f8eae44faee4efd8179a3930ba25ae79004
- SHA512 896247938b3ae1f7a9dd22d402117abc168624ac3fcc96a5e46604216131fc0ad6b27b5fb677d9ab0fd93f1088fee852993b5d610d69038b814c162f976b2bb9
- SSDEEP 12288:nG4/cL4HDRc5iNi0f7mqoV/iYf8uKOH1lk2UnhKs4F8MPDKP7Zc9CWlKuZ6jSrfl:nGkcUNzS5DKOHk3KrFLQ7E1lbZ6muEl
- TLSH T154F42368E8D3FEB8F9931B75652B15A498DE2412B1F3D59105843136AFFB73A2047E20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ExpandRequest.docm
- Size 776KB
- SHA256 6fbdfc0ed9dbc076a4354cc1a6c1831975910d837a37bc13d90bc0b127de051c
- MD5 7d3c837aade4240f1c1ecd6ae4a67aba
- SHA1 96ce2b5dad4a1fd71e9e2851e218a2d5fd665ea5
- SHA512 7cdea84093758da1fc9a82d8b8c461a98ab26f929c5c0248da6c513a2871954383f7d5fc85070759d9bd650a60d140f729e4341fc5af0f290cc7e3782d0a7809
- SSDEEP 24576:4Y/j0cQuF+w73l6UrKQdJfs5Ev9rZE9be:4ZcpFrIUbdJfs5mrH
- TLSH T1F805333DC7670485F83FA2B4979E7DD8C30A228D2C16ED422552D2FD81558FA6863EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\SubmitExit.docm
- Size 776KB
- SHA256 df36928ebfd415dcf2834664f311af72de032e508fca1a9a8a02ee03ef5f9a42
- MD5 2f5fa1de31b1607787512d7aa0f06749
- SHA1 d4ec7ec5f87569fe46381d86f2beced7fdc8366d
- SHA512 1042bc16bfcb5de8661b46f5b603a28132879a815a2a7ea368f7b9218c195359c8a201d5256a0665218501a5ab52f3c701017ae27b7fbe18096fac97406b0852
- SSDEEP 12288:GaMGdQ/cL4YDRN/iN10f2FO732e6UUuKhy3QHfDi9U138Yi9HCaSFGilUfe:pVMcfNr+g73l6UrKWi19WHB+pUfe
- TLSH T1E80523B8A0035D75F2438AB594AE61C444CB06DA503AC7CBA3F9F25EBFD6D245006E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OptimizeGet.docm
- Size 777KB
- SHA256 7697ba4991074175a9ab0005b8124d5e32d3ac42478dcfbb1b223e654273fc44
- MD5 826339a12ad4f560007cda1f45f49700
- SHA1 7f915656882a02a748fb70a025f430362c2df2e5
- SHA512 6f82a0f1d31525b04df94e9984dd4233842a74e87b1d49440713160cd92450d278f747587a01d337ae06c1521df155e28b8a07fac0e9b683a22690dd315a7158
- SSDEEP 24576:nsRVHoGrQr9Maj6Lt5ghs7X/sQO4ra3nY4:noozCaj65qcOaa3nY4
- TLSH T13F0533D446132061EAF64BFBD9D399578E627F2792FB0C90CF211B904C864D6CA81B9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 0e315bad15d9b42ecc00521ad9fb262c0d2e3b62d67f8e0d537e82f10701125a
- MD5 05a93d92229be25a088b71ba5723f537
- SHA1 4b640a1f00b3d6791d3beb08700e1e35780a6b39
- SHA512 13f370fc0e6795e1d98c02db264b11f2500898920906556082d82bc011251ce16a70017f0abbd2ff99e006aade4f02ba7ac9cbaefe526aaf00413c39c52b8027
- SSDEEP 12288:/M7yfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:0yfJ4yL/tNCJPXUQrPR
- TLSH T1C6D423A751D49846ED7687F8164CE000D309BED51B2BA2E7EE42B4853FFC98A1DBC352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 27b42c600d627137ae88541fbb8dcea891a6405022f67b0b578dafcf1999bc8c
- MD5 9575f1452691e8e6a783d270de10e9cd
- SHA1 fdc6c736f9fec78ac008550fe817ad10eaffacc1
- SHA512 fd6a9b16a6d6645d3656e39ec1419ccd993f35a7464222ec3c0c04b5e7fed6ac34be18bf0d2aab95779908c03b7259da33a21729a9ddeee6b3a96c865b8d9c8c
- SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYQfJ4yL/tNCJPXUQrPL:Rgb4mBIBhGF/fJ4klKXnT
- TLSH T18B65AF1E22EC02F5E0F5D2B89DAA4417D6B278160732D2DF1251427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.3MB
- SHA256 da8a4d9f188be2fc2b7bdb520c9d1becd9f2e487afcbbd1f89add1394ac36749
- MD5 95482decb48944ad4165aa3ef4d5019f
- SHA1 7ad90f215ad212ad398ad707100fc9b08a19ebc8
- SHA512 5f579e1b3caf2ed30a6ffd1c9514704370eb991714fc4704c39b8bfad56da52fe899316a0e7ee6c8355e167af32056d6c1eea9b689bf51e432bb9ab108cd71d8
- SSDEEP 24576:szkNvNnaFeYhJNtmZBmlfJ4yL/tNCJPXUQrPZ:szMwBtOmlfJ4klKXnh
- TLSH T15755AF6EB6F845E4D1FAC6B48E238112E6727861073293CB9390C13F1E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 62066228ac372db2f97f2f5bdf05021f1c8fd051023a421161ae447914f03f83
- MD5 74938d1f68ecc572f09ed7752e94fdc4
- SHA1 ac5ffce6b12a3b1d4daeff7fa7903dd9c5b2c459
- SHA512 a218ccec844a7a65ab7b55ddf6dc070bc9bd18c5af8ad53d705ba5b13a111e2ab65104052cd314348244b6064b254d169ca79815d4369fa166aabe0a36ce938d
- SSDEEP 24576:tGPWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:tG2/91Uc5fv5050xJITAEm
- TLSH T17C05233921F219DDEB3DC9738E368412B97271A057099AEF45A1DAB48B18AE43D34F1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 4f9c39577fcc368a8d727cb5653d6c8cd8bd56bab6b8412bcbd82a3dbc20acdc
- MD5 17c7e631cc2cfabbdc8cf4c92b2836b0
- SHA1 ef9f72a84bbdab2e03ca90ddbdcaeb98d2dced69
- SHA512 ed0969324df7fd471e0db00b752fd3212d8958bfcd31953a1033893db9219e2ce46117e3df64c4fe19bdeca4bdcc843c03e828a019afa1c584ca0ad6ac4484f7
- SSDEEP 24576:jG88u8FpJqH1vzria7/mPfJ4yL/tNCJPXUQrPG:S7ZFPqVya7/ofJ4klKXnu
- TLSH T12635026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 d324b3e453e8db896126db4893637a7c84e27f3534246d411e87657e6c3b3d2c
- MD5 9754c5023b9f6e1d8f76145e6206b628
- SHA1 521afbfd1a870a1f143c08611f5d975b852d164c
- SHA512 a3d40a5e13b3cb5b84470a3085759bc0e7e1d3c620dd8a53b9761d969e967075308757430a9a4ca59ba11121517d738d80177d4ad27b3b1c4af6d0e98248e05d
- SSDEEP 12288:/HvUrBFrEjwaQLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:/PUr+NQLfJ4yL/tNCJPXUQrP5
- TLSH T14505F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c362ba67c546315d90ceb7984e230495f04473f6c6df4ac882c924005f5de0ae
- MD5 80e765d856813fb2313aa0a6a3a745ab
- SHA1 887f9403f92503e01b4d97cf4bd08cb9b07cefec
- SHA512 6940019922216a4c9b1222f85ec0969b2cb8ab6c287ef5c52380fd194825548dc9d7f9627309501a114d630ea20a9412a9446cbdcb5566caa3c1aa6353577883
- SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbfJ4klKXnL:aG05lO43b2fJ4k
- TLSH T13FD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a63ddba92d38f85d688979332b0d275f8750a66953aad2955f2b3f8f0f67ad64
- MD5 292896ce93050dbf576045ed936c17cc
- SHA1 061f4a57edc32832d7e6fa8603f5757c1a9641c8
- SHA512 e353c464b9c7ab908902c56c3b9efa03c8cd56a2130cba28af269901a9a79d12b3ce2446036da8ea324e8799a33320c51ecd5050cd7ae7e730458001d3b5eb30
- SSDEEP 24576:nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnhfJ4yL/tNCJPXUQrPn:fa5POZ3lJt2pasx2+mDfJ4klKXnf
- TLSH T1F065BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 0db4970d2d3b478b52e82792a9eaa88b618d452fe4b792ce1084de47926f2adc
- MD5 59809edab9e399c1794ab5a0d08f54c4
- SHA1 89b8c64c09c574d8c1cc7172ac5ce1271abd7ae6
- SHA512 1ff2101ea1afc47bf2a505c1d0854d19e06ea8f3d33d9c553444e114f5453217c4462dbd249bd7f31f2814ea7eefa69619298b407e1fcac40c5b5b4ed57e6662
- SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fk3fJ4yL/tNCJPXUQrPN:/Nc/zEOVHFIfJ4klKXnF
- TLSH T11A858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 df0a49bbd9b76ce9304ad7580656e130918b870c63357a7271155642d893e1ce
- MD5 5ee5c24b33bc35d30fa9986f844b7a5a
- SHA1 dd9064c4eb2fb2a57a2be506fe30cadfd9030731
- SHA512 78afc88765c679f45167884776aba195e7c22640d7c1748d95b922b73170ed6f7f84ced3bbaa1e1132ce297550cc3c6e31d8618d4b291a341fdd9c40a796d5df
- SSDEEP 12288:/QcMxWDXN1Dp/fshBItT1IQgAmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+Gs:HD3FHshBIYQgAmfJ4yL/tNCJPXUQrPU
- TLSH T14E25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 400113bcae2f97107b278982555256531d718bb8dd555c43c0d67286aa7eb107
- MD5 f637f120bcb05ad1447606f66f26b542
- SHA1 f677a41640cfb7fa5e01256cffc1c942712e2d40
- SHA512 36fbce8d73fe9a6f598734bdc6ed213afee1d00a2e94fffc01af19b5468f744bc2845f37018b43fed4a3c194fd8a82f5dbe7f61759608e21fee0102a6c799de6
- SSDEEP 24576:dPoIfWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:dPoIm/91Uc5fv5050xJITAEm
- TLSH T17C25026D237601FAE16BD03AC6A34401E2B2B17187165ADF4694CAB94FA3EDC7D38F41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 be92b6d4b618ed916c64c9ef19ed831fbe3498caec2d8fe648942371e528f5cf
- MD5 6921497ee88212fd7bb26fc7a83da243
- SHA1 e5b66a123cc6c0c453e9d1ba8db2bd613aa8c9c3
- SHA512 593a4ea7a23ba1c12161c95835e54cb98fc41b0baab609a70241a891fd8fc881f8bc2355c440ba61fc83334b4d556f9de422f983738a45fe04f8b3d0c3f32032
- SSDEEP 24576:htyjWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:htR/91Uc5fv5050xJITAEm
- TLSH T11815221463A415D9FBB985718F3380509E36BC209B0697DF56A1EB6E2F38BD86C30F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 5b47f845f1d589f9c3a89ec17e3d24cb114fd0cbba0ea2b86a61212c9de3b926
- MD5 2eb6425ad1513012555da6da6c687dea
- SHA1 f9fd29d2ffbbe69df4fefdb6fe2bda57af27e737
- SHA512 e4caee227247d1a55f82ddbf0d0f53c28a0f3798da510db3541bb74c96c9c4358408840e30f8d28fb6464372e7fd211dfa8b2676e02ed2b2f082334184bcea33
- SSDEEP 24576:geWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:gj/91Uc5fv5050xJITAEm
- TLSH T12605237952610EDEFF68D8734B3B88009637B1615B0FDAEF95A19B944A1CAD82C31F1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 a188099f79637a45a96096758a71bf4a00556d3482a4e5e6e50b44c5a39ac990
- MD5 5e13793ee5f22955ee749a5a9f123895
- SHA1 8e564e0fde9c731da56c65f269af94ffcc9d56e8
- SHA512 f48701c968e72818d87c14e6f009a62b1b4bb62bcf7e6de63961d8d646616769fc2323293c92c0cc406311730d51ce7759ac9701b74e50041acd2a6469674cd2
- SSDEEP 24576:93gXUoTfaidZ7NWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:1g5TrZ74/91Uc5fv5050xJITAEm
- TLSH T16665AD1D63EA09CAE2B2D675D9335493D633B4315772C6CF2448C03A4DAAED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.1MB
- SHA256 9887f3601de957b2f63361eb3eba679d800d0dcb204c8263981efc98110ceffd
- MD5 aa92aaa2f2849c1f2abea91ab0f7bb2b
- SHA1 9d81ee85f346dfb5d52a5b7fae7e92469e1daf59
- SHA512 8d61a26388f030169db204f4e140aef1cc57b4840aa1f4a5fd2b004760547d6ae4e4cabaca8ea1b4d953d7be2a08f94359396b23eca33c9f94685ab37765ef91
- SSDEEP 49152:Sgb4mBIBhGF/fJ4klKXnT3/91Uc5fv5050xJITAEm:StYfJ4kc1Tv50axJI3
- TLSH T154A5D01E22E802F5E1F9D2B8CDAA4417D6B378160732D2DF1251426D2F3BEE85D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 2.0MB
- SHA256 03fa60733e12f3e2950e65fde79fd71b4c96cb0d78319e77a5663b5053f19aaa
- MD5 aab555cf4bece068722342971822ac68
- SHA1 6a861f53cb40d02a405541c2410bdc61e82ccacf
- SHA512 87cfca75bc11392687a7074ac09e8f8f11ef63e71624d2e3cbcbac48877ea830228183b0dfcf3622995682e354aad42d99c15693146aec2685fa3410ffa906a6
- SSDEEP 49152:qgMwBtOmlfJ4klKXnhn/91Uc5fv5050xJITAEm:PFNfJ4kK1Tv50axJI3
- TLSH T13CA5E16EB6F806E4D1FEC6B58E238512E6727861073293CB9390C13E1E679D85D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 e2000c6bf1e471f5f1c26afb5b0eb4dcc7116b456f667a09759dd7beaf1bd851
- MD5 2eb49382eba17e465ae68c7f67bd45bc
- SHA1 2d572ce52da5d9d54f88d225d896f11f80e56932
- SHA512 5a0fada9e353049d2be74cf9a8818cc5cf60209ea796597287e950c3e19d0e3d5734f61bb9d32f9b689eba0c056a2d1e4cd14b7edc0ed56d1fc6121a25cb8ef3
- SSDEEP 49152:WDVHeBIAAmfJ4klKXnsc/91Uc5fv5050xJITAEm:tfJ4k+1Tv50axJI3
- TLSH T11685027EE69804E4E97AC1BCCA638506E77138E9032666DB06D1C1B51F6BEE43D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\TieringEngineService.exe
- Size 1.1MB
- SHA256 63409c226db115602b2140eaa20c073b28499302b6e312635f476516f168d41c
- MD5 d0b38843f9bb14359158964e29e59b7d
- SHA1 7c0660be7f8b17c4c863d319536e29e00c05aa47
- SHA512 9593613b922dbee0c9c5642bed74a30d446fc152d34d6cd6a337d9cb9b0d0479a131aed88bfaf49bf714360fd39f038cc1855ea95146bb673ba1f7ebf7f5c10f
- SSDEEP 24576:yJnJPbzB4SAWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:yJnJv6Sp/91Uc5fv5050xJITAEm
- TLSH T1CA35E13DD2A810E9E4B7C2B4812A1A59FF31387D2F1669CB59B4D5343F12EE06939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 796KB
- SHA256 4ee7f8d1f0815d89b15f0f3bf9feacaaec5f1efa329d37f8660077d390ac46fe
- MD5 ee58f10b2a552195f35eb2bbd74bfa79
- SHA1 14ed422c424014aa2ddcdf3ece13102ccd203cd9
- SHA512 9aafdecf9ca3e6f2cce1ecb46405d02ac14bd9e86e90dcbd453c9c9d7722082d36cb2a5266a101ea1cbffa62be361b53f943fae7760174020be45811008972cb
- SSDEEP 24576:aMWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:ad/91Uc5fv5050xJITAEm
- TLSH T13405237152510EDEFB68D8734F3788006A2B96519B0FDBDF96625B84565CAEC2C30F2C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 940KB
- SHA256 28210f9f1192fa8b29047d51a118b4ef8e42efc7f5f6091a251c937d1bd85fe7
- MD5 b1f6b84110326695bbc9118a7936dfe6
- SHA1 a750f49de7fddf76c3b384c86585701db85690bd
- SHA512 87ff057d1150640e66be514c070238839b95ae3dc41e789130e34238d25dc3871629a189ef3062ed08ffb788c985c331220c025870643a2389b29521804624a9
- SSDEEP 24576:M6UqjpJWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:M6UF/91Uc5fv5050xJITAEm
- TLSH T19325236D12D018E9FA3D8570CE3680258572B872171ADAEF72D4DB7A4B34ED85C3AF24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\vssvc.exe
- Size 2.2MB
- SHA256 300bcc8f499de231b919ff1d719db180fb982c7a1f959a9e7242816f15b0998d
- MD5 926c4067853d8a0bd2d306e877b90360
- SHA1 511a369ecd9ad08b0c163c20a110355b30551255
- SHA512 9acbdfc42da9a65cc5ea0fd0fe995f1847e906cb3cf185e4dab35e326015dfdbf74d15aa93383b445086ac1213b4d43e5a32c7f0f7c09829d407d44f0ddb9b73
- SSDEEP 49152:WkLHGeeV5ijCmlDWDk8H/91Uc5fv5050xJITAEm:f2V1Tv50axJI3
- TLSH T170A57C15A7EB4184F9F3CAF1CA2694169A327C509B34F7DF4A80CA6A1E32FD4D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\wbem\WmiApSrv.exe
- Size 964KB
- SHA256 03105301a143a991d0d249140024d2bb169baa0d8ac2783290fa96f14d30e395
- MD5 a2b2f4b160f3690da1b2517c349f44df
- SHA1 c195d807c573c6874ff4b67e5e91bc97ea68e4f3
- SHA512 5cb2176048a7aca44b434a6160786db235067a8c7b9fcfee7a80c0abe1374cf5c9ca4dd3cebc096478de5cf98c633305ebb6fa89d1d549c65bab8c9b8cb225ec
- SSDEEP 24576:crcmREWWOkFF9YRbcZUcfzdqhqXtqM50HZUZxuRFh4T7IUoAjlq13k:2cmREb/91Uc5fv5050xJITAEm
- TLSH T1B025015EB2AA00E6E2BBC1788D524405F6B3B0705702A7DF42A1C77D4E6BAED7D34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\wbengine.exe
- Size 2.2MB
- SHA256 e6209134eff2fe1bf281ddb1f279663b0fcc138c4ca9a0fedf7c1d0883c29bc9
- MD5 51c69302073e341138adfce1e5e37075
- SHA1 744764b2b61935915875393085ee3ca708bb8a79
- SHA512 ec5a4bf380bb07ff1fd27362931af3470a1921a22c739a7beb0ad790afad61c88ce14dc173de3ef977045694853bb8c6ef8b9e2451ac2f81d26139b2de3503fa
- SSDEEP 49152:PDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3QV/91Uc5fv5050xJITAEm:k3Upow8sBnX1Tv50axJI3
- TLSH T1ADB59D3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH