e16292d87f47b6dec07fb2535140bc68973c3cf1a78a68395b11628178f612dc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
Size 1.8MB
Sample261022-26xt1ayt5m
SHA256 e16292d87f47b6dec07fb2535140bc68973c3cf1a78a68395b11628178f612dc
MD5 67d9afb6b239830e5638636fe3843a97
SHA1 65dc780182adff64e9843d89f56fdfe067b3d390
SHA512 a861956061fb17a436d62de3b3ff3c577ac9aac2e85aff8c8b81dc15c658068a141563404389a3247c827fcee3b806c5360cbc8243b872547e66e31b1fe98ff2
SSDEEP 49152:tivdgblGeOJxj5fYoPi5SW6H8DS52tdDpbRZy:thGb85SSDntdDpbRZy
TLSH
T1B185BF70BBEA813AE7E2207259B9D35E062DBD614F3180CFB69C094D9D709C26E39717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4584	elevation_service.exe
2360	elevation_service.exe
4064	maintenanceservice.exe
4880	OSE.EXE
1196	PerceptionSimulationService.exe
4356	perfhost.exe
3852	ReFsDedupSvc.exe
3936	SensorDataService.exe
5764	ssh-agent.exe
2220	AgentService.exe
3456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\49342e26b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004dbe35d37a62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ab330d37a62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcb26cd37a62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbbf68137b62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ba973d27a62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4600	2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
Token: SeTakeOwnershipPrivilege	4584	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2220	AgentService.exe
Token: 33	3456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeBackupPrivilege	3852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3852	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4584	elevation_service.exe
Token: SeDebugPrivilege	2360	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3716	3456	SearchIndexer.exe	100
PID 3456 wrote to memory of 3504	3456	SearchIndexer.exe	101
PID 3456 wrote to memory of 2932	3456	SearchIndexer.exe	102
PID 3456 wrote to memory of 1652	3456	SearchIndexer.exe	103
PID 3456 wrote to memory of 2144	3456	SearchIndexer.exe	105
PID 3456 wrote to memory of 1732	3456	SearchIndexer.exe	106
PID 3456 wrote to memory of 2912	3456	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_67d9afb6b239830e5638636fe3843a97_darkgate_elex_glassworm_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2584 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2584 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4947ef9ad618922f347a7f36489981927c4c3c60b338f57fdb3147b96568d87d
MD5 49d7514485c069ef3763d103f19a6bb5
SHA1 cf72adf5fc642012f2b65f297192863650e9de06
SHA512 f2f7dbbcc54df7be01bf7f18522a23161df497a8d82671ce272173dd657b2f3ed3d2cd6faaac364143e993eeac849b1adbfd3797cd2ca7012ea51d7ee09b6e53
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnE5SW6H8DS52tdDpbRZy:o3q6HjB95SSDntdDpbRZy
TLSH
T1D9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a5b6c874d2cf069b7bb4f52dee14170d40493c7136fc415893e8098b597e56b1
MD5 b70901b69d44d7549b1ee9eda9308c5e
SHA1 6ea10e2ade12e40987e4ee979c7098c2bac0bf7f
SHA512 b5efda40e5ce94493e58b7b9d8b3be213fa0e83012e61bfa60333e0ea5243a85a6ec9a7a656a83945508f0eaa75d32cac5fc12beaebcc2b842e3440610a64e70
SSDEEP 24576:uXYfDtczA55SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ttcG5SW6H8DS52tdDpbRZy
TLSH
T14E05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 84bb4ec79325bfeac35a8243393f28fa8bf2c296a0b97f72eefd7f6133d92b8f
MD5 aeb5bf58e8448c941164320bd0dbf41c
SHA1 4f75efca3b91ecfee1c98c6b502ee0ab169a5585
SHA512 11d72c44c005c2a5c2b0333ce4705b4d59b5416ecaca2ac8c4c3b1a51634585234404a6844068db8d74bb004c6f553c54e2edf0effa721f48b2204324ef00c14
SSDEEP 24576:A0Le5ji0hmxirM05SSiVw6uAX8DS52tpz9ZRzbPmSZyo:APji0Ac/5SW6H8DS52tdDpbRZy
TLSH
T105359E55F6748332D073C0B9C5D2A69EED7130865B308ACB4286D77C6F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5bd8aa816c1f097b6dc8b1dbd3215c9a44a1b2ab670db0653af880236df11a9
MD5 ac346a50e993e7838d3931af8ddf305b
SHA1 18d836bad2edcb68e0676873e1ebccac90a75f2a
SHA512 994bc9a994b9d1044602f556c419d6ed9e683e8c6664c7f0b456930fdffc9619841d7bae6a283ad02e35bc4c0e10ac21b81f77e47b68ae69a19fa88baf947f85
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuu5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:L/ezSC6vUzPvxHjyr5SW6H8DS52tdDpO
TLSH
T1EE755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75a49b9be8581e1794fa2c7186f3bd1008810c9a40cc496b37f4b9d297db0753
MD5 16d5df64e71165cc7b257f822d5ea2ad
SHA1 0d81e7248e2970008a36e5bbbaa7566a0c0d8e95
SHA512 eabf9f751d5c8136bb585a3df28d9d1fffa4f72371d9a2768c0e742814f15d5ae30d4f90abef926ec5ee307f9d015fba765ef25fba8c1d24fbdd975f6b455711
SSDEEP 24576:4VbqPb88hv/l+6t5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:4VO88hXl+w5SW6H8DS52tdDpbRZy
TLSH
T17F559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f81a1a53febb47c1f5d82ea07018a7ed50de4e943efd353eea7798dc13bfd065
MD5 08d370ce8b4df424d1ae8b72bb676d57
SHA1 1b902c8161db4cf219c858d2236c81e51e7541a3
SHA512 046c2e585e1742383df3a0b5e244f6971e5e63972050db790360d398856235b90ba52fbeefffcd18caeba1dcdde5bce0bb06dbfb40954f7e404b21561eefcb2e
SSDEEP 12288:jR45OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6z:jR45SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D0C423C4479030A7E31F0AF3F1FA96E4DA18EDED8404663B4E717687CA3998BC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 396135ef1690181f2abad037a2c6e6ff12496e79bd7d92c0db038da0c8e39235
MD5 30e07197a605c78545fcd9f56c7ea99b
SHA1 5489cb44d6c16f598f74539524dcb265e12ec7ce
SHA512 886401fcb6b929f2719862e74058db3e32d5e6239d845edbf7e96910b8eb3491d010ea864ef03fe1c8b05ece1870c0ffefecf1ccb23774826da25ae0088ec336
SSDEEP 24576:sJIUl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:sJIUl5SW6H8DS52tdDpbRZy
TLSH
T1A105DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d1b2ed2e34463babac3196b89826343074cc99e04c9b5457b378b34d13b6f12a
MD5 c54420aaf0ed6d895b3e29120f1d12e8
SHA1 8c51b3dca57d6552a38e8fe2e4ec5ed6403f598d
SHA512 c79ec18fce4552a1eb14235bd6fc103dafdb9f470ad0502e9e82d56abd907cde86c94e89f720ca7790d106c42d67745b11c7ce5c120ec96ee7bd765838794bc1
SSDEEP 98304:BQvGAdlCEL8c/yRNw5C+5SSDntdDpbRZy:+vyEYc/y3w80SintdDFRo
TLSH
T145267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 36cfda82931333b4d4c6b95f4c5305697259611d013f5cb1fb9fff13f847d873
MD5 3ae4374aa69c6fdbcb29716e7e5bc036
SHA1 0353e4fd1cb4284c80995cde172bd848aa67227a
SHA512 4e1b49460130346daca93338e61d0c1b92b7ef4b22666d0ac7c07ca739af10dbfd3c5676863572b9d58e9b82f3fd0ab12a4bf658b033492e38fcedabc99e8ecd
SSDEEP 24576:PdewsAjP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:VljP5SW6H8DS52tdDpbRZy
TLSH
T1B815E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3fc3f2d093a5bbc359ed17c1f951134c19783ee76b8e1cd0298c9d416cfa49a5
MD5 a4f565a2e59a6de059224a2288bd04d5
SHA1 1c6ff53990c06dd2bbd7849ea9946e8d4e39c454
SHA512 94e5934dbbabacdb2265a68eaac6d5b86b03004ed045a1ec86911fdadffc28e896fa5de24b1055ca60e94e53e270932d14682bd78ddceebad7deee71dff7bac3
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpSintdDFRo:zUEtQevvqc2W1cpV2EI32YedDFRo
TLSH
T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3669991c1211b264c34a2c235d468ccfe5cd063548b511ab713b122026960695
MD5 ef541d5595db8fdd689510d8b06c070f
SHA1 3ab43b699e7fca7bb9d62fdb8a1e723580ecabc3
SHA512 0e6c222bb77abdc5969427ad6d227df32313e7671c8cce0d47c5a7a38734dc2c8bbfeb7d3bf9b3a1053b83eaaa2724894c81187fcd34a48612198363dbca8967
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/zv5SW6H8DS52tdDpbRZy:Woq2Vjnm65SSDntdDpbRZy
TLSH
T1F0D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 06a1f1d070aa0789823ce16c14102813469ba1c5bd24d7a39accce865fac2281
MD5 fc08cf88c06ba6b79b9867d38d748c9d
SHA1 15350d192fb79bb0a84c7793eff21d37b0b99b89
SHA512 3f9e5b361819edbcd5f6ffc12313bbfed83f14c1d475a9b5ce8999e4fa6bb9ef0c36004dc5bf976af477d6f624d12e28851893f78a3c7f983db9d87cb00b480b
SSDEEP 24576:JAhGLJIFoiwtA5l7S53a5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:JAMyFoiq5K5SW6H8DS52tdDpbRZy
TLSH
T11935AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 347b63ba9e517d73a7a61176bb46a84ce05eadfe66e1eb7540d4fa5b68b54f1d
MD5 8ca1d779d3d13dc03fa3d21a101fc896
SHA1 4ae7ab9fb258fad5b74ac8b379006c601785000c
SHA512 386eb6a30434f8a3419044fb0d9b4c58c95ee438d1394832c2f0bafb83a57ecdebfb2fa1bbbd66e82b8ab9dc04a0d7e2d65924efecba49f1403c085a2b409925
SSDEEP 24576:UwuoOWL5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:UwDOm5SW6H8DS52tdDpbRZy
TLSH
T18705F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b4952debee33c369f4afdcd2ee3093c2620b4e31308d1ea2e6c094fa9a9b5be0
MD5 930fe8519f21ce3afa4e303c43cbb059
SHA1 2dfdadfbf13dfbb36282f35da612e31dc7b76261
SHA512 1c90813cc0e21d22ea73136771e73baa6dbb01160870b8c6cd3195a2e4a148e8725d3bfa447fcda631a1be7b56eda0faad758d4f11b0da233ae4be38211f23b7
SSDEEP 12288:CBZ1Iyf5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6W:sZuM5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T165E4128923E030FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC65E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09636ff14b82f90dc5e31804df23a18681dfc9614ae01975847279921c1e7a7e
MD5 2216a60c1040a228e4fc030486260d2a
SHA1 cde4ae29263433902e1878ae970127e62a826f0d
SHA512 acb911e5141205f3680468cf85a419959bf0476169b1b1b3a4bbebef78a14dbe098481b7a38c910ff9005aec91c8e39810965146cdd6bd75396a18c5c9022e1d
SSDEEP 98304:jQRQyi36YOcPQLvw2gAf+PN3B5SSDntdDpbRZy:yQyiKayX+PNzSintdDFRo
TLSH
T1D4667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55ecc4d10556b03ae7477a7854188d9de170178fcb5cde6ffbb9917bda72d2d9
MD5 19397ef12cf3ac11352d3b34eefcc518
SHA1 3fe69bbedd59a45f95fbbc6c2655e922d75ecba5
SHA512 5c7fab01c485bfdebbdb2e7bee0d8e34757f465c4bc0333adcd3bd21784b003074d3ee861b59a45c26249f1f4befa2e6a8d7b7765b988c999a5d10f95743fb4a
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3B5SSDntdDpbRZy:cQyiKayX+PNzSintdDFRo
TLSH
T197667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e2d3f5b676632ba15243281c152629669d8d77522cfdecad73ed95b99bb25ecb
MD5 869afd88329ccb981b67cc7e067c204e
SHA1 4c886d069bb81f7da3e7f5e30337312f3acb7522
SHA512 6f6c13b89ff585329647525b2e05d70a7c8ecb03af9e973539025c6b8ed7afd2c15d9496e9767080383c97586eede8d87571779604f296652f178ee39da1dc77
SSDEEP 49152:I68Qg55nhheWu7PNU3//5SW6H8DS52tdDpbRZy:SthWRc//5SSDntdDpbRZy
TLSH
T1CEB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 50a8a36ee6b588be917634027ffc4bc6e77350c721b6460d98b0094a51977aa3
MD5 19c3f2404d01e551ec4ed6cd0d244ffd
SHA1 005d7ac5cede434718749bc39358ec3e96299c70
SHA512 aed919d448faddf2dd30c30ed32bc3526fbe08ca69f4c04a72cac5a0ea0b78acebc96b1590585394a3584e4aad3de480aa7b70ecefad3d6aed4164eadd2d37d8
SSDEEP 98304:ty5112gYy5azzVvL69nLKnhZ45SSDntdDpbRZy:QLIHmWhISintdDFRo
TLSH
T1DE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9c5cec96dde7381c0fd61ce994d5b53150b8436ce20c88e27418c7fe7ada2f4
MD5 1db5ac4ec89d7112e13b0c093340a476
SHA1 ca30d51d7dcb8aad5cbd0e189a995db884f341bb
SHA512 a900702094643fe334b367f62a27951539b0ef990cf34a47069692b7d340b8e7f83bfbf8932ab060b26bb4b2ed55f291d626f6cfb7192adc109080b5650dffab
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glp5SW6H8DS52tdDpbRZy:Xu6JmVxd2dp5SSDntdDpbRZy
TLSH
T1AED59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 214e579e92225e36b3ae2a7a2e6f2f03a2c6e18f640cff7da66c192c9ccb9bed
MD5 55c63668a49ae151d67f6957935ca25c
SHA1 86ba9c0851d83ad16086674c713f9c9c2ea74049
SHA512 1c782daa7ed601cd2032a292342231da3f73ca4ebfe80d8d8f10d82616d626ecd9b4df56cbf8ad5ac54494e55f3328b56deb1dce2cb9ec11e9cb1a8bfd486cdf
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xF5SW6H8DS52tdDpbRZy:amifPbR65SSDntdDpbRZy
TLSH
T1CEB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 62321ec6115372c7405254293f862fc45e914c9009af439e1de6caf42b0e74bb
MD5 37b5b91042d56bfc1248ca6e1e28e4e8
SHA1 abe4ff3cec362c79070fe7290035b365d5268f69
SHA512 787d5847f90ce484a6da15f414f92b8d50a06cf9f7d7b9da71718a8f3b3bd942b8c768a2b5eafd2e43adbcc4e1b6e0085f52cec3ada0fc9c490bc01b01933279
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqM5SW6H8DS52tdDpbRZy:C5dKTi61M5SSDntdDpbRZy
TLSH
T1BDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dcffdb301cf61f3feba7f86bb14685730d10f46df456ed2bbcec0272638a164e
MD5 6b101edb7db4e89f1c7086c3d69d412e
SHA1 911330ca284e466b416dbebc675d986a5f6bd2af
SHA512 c097a5f7602f034e3a880d3c398baf4bd1edf36d775de7c163e5e6b6c47b34bb536d7d0866c868b3e971ced7e5130930bc97f15e035e8a5e91e30cd0666983e1
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wJ5SW6H8DS52tdDpbRZy:3X2iyphG5SSDntdDpbRZy
TLSH
T1BB95BE13F2D900E8D05ED175C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4e50c13a2c48e9278dd583124113a9da8d7e97975d2808168155e52776efd532
MD5 6147fc20f4c1a6161c0c361466ea8cb6
SHA1 5758d99775e923250d0305e9cbe80f2731fe860a
SHA512 12643a6238b6c7106b236de6b921494e45c82f7fea0db87859ad1dfda2bb0ac96f64b4ec379d4e8b67a94b6334552d0af76c8bfd001e18bbaa2df59fab856e94
SSDEEP 12288:hw5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s6:hw5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C2C423C457A121EBE30E0AF3E1F686D4DA0CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6d14ec17a8207a1191ec1e7b97f9d71dc1c308bbf92ac1d5abbde9cb7c787bdc
MD5 2f3e4518b46c0fa9ac6db2f635c896b7
SHA1 7237a0e623896409dcd8c6dac8887b3db54caf2a
SHA512 10db6e11898356fb3a309a9990d6b8fbd29c847cd7e11ee6703d073d5a1fcd1145c1c2b1a8d180cf7d4e700219aeca9679f6239fbb331b47bc604d3ac14bd183
SSDEEP 12288:wT5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s6:wT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BDC423C457A121E7E30E0AF3E2F686D4D90CE6EF9408623B5E71A147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2ecc267fb4337c217663eb1a13c22c18a96a1d742b47dc8d71e3b750be2efc2a
MD5 453a0d5c8037e80f6599c1142ce2b570
SHA1 93e36868edf5a52677621ad843a8c4caac30f70c
SHA512 de73d39f3ebb154bb3435725cee4590df2d69993fdd6fd8f45a2b099d327bda2f7dedd4e2b3d062a76133b7585338e0cf94b2f41800ec7d41d8df7f7d9a1fdf6
SSDEEP 12288:td5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow64:td5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A0C423C457A121EBE30E0AF3E1F686D4D90CA5EFD408623B9E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0689144ffdfac63bd11eed8e2c2b603d385f486aa6c5c918a56ad55009c5f222
MD5 82db22cd65ae4a20b4ad215fec835ab7
SHA1 b7878281dce507d01277921ccddd287f53ecf6e6
SHA512 ea75f1530d740725cf8d440d1a6cdc286ba9548b84ad7551cc37c9cdd6768812f708a6078cfd561329738709f5318b6d785ccbdeb74e759a744f7f6b91f3cbac
SSDEEP 12288:KV65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:j5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16FD4238417A120E7E51E86F3D1F682D4E628F8EED524637F8F20054B8F31BCB9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b2098f9624e7bb59ef9a4133df8a38a6e989d404573c634e0190d485d093a05e
MD5 2dcc9286ec0e29c03e1f022ae1332c55
SHA1 73e627c330222b23b6a3d79d7e264b7a9e44910b
SHA512 e6c7df0b340a80b874e4a890eed2fd1c29013cf16f26cae0cdba3c4cfd19effaabcfd55fd7358db2860e59563e8e92b2cd1195e76edbd2f17363da75104a6a66
SSDEEP 12288:Ci5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:Ci5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F9C423C457A121EBE30E0AF3E1F686E4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 67e1618cae573a6245c4ecd63b151bacf3ae1aff933e14511292da80fdf572ed
MD5 89b9472a8e6ab88d20ee754e693bfac3
SHA1 3b1411967e7e6f1fe62dec899814f108b3116777
SHA512 2d2d380898044d627da996404fe8b686ab090532769c8d3a43506adde3219582cc7d43c46a93b46be263843dc64c58f5991b8d3c80cf82a15293ffa3bb9909a2
SSDEEP 12288:hn5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:hn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F3C423C457A121EBE30E0AF3E1F686D4D90CA6EFD408623B5E719147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0264de9ec9bc27be2337f3af6d4532551c03f074973d640d4bf804b46e03b7c7
MD5 35d1f4c178c7b8ce4cdc19a6f9f38485
SHA1 6110370bda28e4e313a3f77df732cd160c3a1278
SHA512 fd8b06a035ee030fc6198a9a64ff20a9a960e3ad90ce10fa2410933d430034deef0e5ba00266aa20203708605470f4e42d9329cd88825bd19692f3e0011f671e
SSDEEP 12288:B75OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6n:B75SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T129C423C457A121E7E30E06F3E2F686E4DA0CA6EFD408623B5F719147DB3598F8636429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b0eb89d5050a778e99e36f5beec264a4a1142e8e44cdfb96d47fcc14d18a3c18
MD5 7c62448c369dfcdd9f412a7dcf096584
SHA1 b2fa63f8df3f7d2a560a59f6d8e0305b61dc3296
SHA512 f83d6ff8cac41f06ac0daf47ec071ca68993c8c262a728435c9e820a7e99e195ba940bbc0d6c7e1e4370ac64e012e9584a02c0a71f85f5ce6c2f22f30a4ae561
SSDEEP 24576:YZMSzFVSOz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:YZMSzf35SW6H8DS52tdDpbRZy
TLSH
T1AE050294B39018FAEC67823FC9658945D6B2BC5A0760C62F07B436675F333920D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c17f50225940a5784139f73d08376152330149ca7b0e263abb7475982d25dd59
MD5 b398e8b2caab971fb7e7e1eaad9ed43d
SHA1 7b78eb1fd22614f68566386804d6074cb522720b
SHA512 7a764c35dc071609b46bc383ad3b45d6654a4e3e2c7aa9c65443b0f24951258b5d0a22b3abebbaba1b3b76491aec1f460c34ea90d4d063ae58cf15a0d3cb02b1
SSDEEP 12288:tc5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6A:tc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CDC423C457A121EBE30E0AF3E1F686D4D90CE5EF9408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0d1ad0a43557ed9429bf7c757dd012a27e81ee917d221d7f934408ccdee0d97c
MD5 385cc11d18f0658da455e2b256160c12
SHA1 6e721ec63eb6a241dc95588a30e1bf4dfc8e243a
SHA512 d72cb20b3a516b751b8fdbff3c365fa5e4a553e58dac1fd8a3f8c2718beafd31073e4b511074663447d67a34ab31d2c69c658d38ab60233162c3e1d959017108
SSDEEP 12288:QI5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6A:QI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T173C423C457A121EBE30E06F3E2F686D4DA0CE6EFD408623B5E719147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 afe64bfbf97133a330a244b8d1846a65bea8164d4d3adf34c2d111a24d5d4f36
MD5 a632e8eab387062a243b1afb43591b80
SHA1 20712e5881bdd7593241ae95ef3044401ca239e2
SHA512 94518743e2a40cafa21a1aa02d8f9cb4d4dab9e07d80d26de49192b849eb6ec478eaddc4b3f73921e69c2d604e607a7b521ef04df7812279e87e85960cf30225
SSDEEP 12288:6yPz5L8f5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6+:nzyf5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1FDF4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 094dec9a7dcae4114ddcc0c59a67d3daf492d9a0ea65967b4a8b4afa343d792d
MD5 0a39c7bcc4b9bd731396204690d33f8c
SHA1 16692b71b19971184d16db6086257af574557649
SHA512 e323d365f56e4de7007d16f7291f3ceaab276abfb01d4473888d060e0c7892edc8743af0c00dcdf0e34c5e17a9d482918ba8b548f35b63afa27344ea40e9cffa
SSDEEP 12288:Uc5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:Uc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17AC423C457A121EBE30E0AF3E2F686D4D90CE5EFD408623B9E715147CB3598F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2174f715a7f632cb3d3031a2a56249f679ee66012ac1a43b010433bfb2314497
MD5 a261c4d365574399f6241f174c0ee3b4
SHA1 44878882aff8d6b57bc3e41355db0097473e61c1
SHA512 bf0ba4093136ab3fd5c9fb7fe6e6d9306f7ed632dd31dd3a8df6468c8d5d05fb1d7e8c1b4977cbf621bd05cb0c9dbe51b3c6506cc1fa9e9beae6e5dc2449d982
SSDEEP 12288:2c5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6n:2c5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15AC423C457A121EBE30E0AF3E2F686E4D90CE5EFD408623B9E715147CB3598F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b2b9a54c7a5404489645084af12142932520052743460f8d0e2835092c9db2c2
MD5 bf37162d71db5a7c34c61d57cbc8335e
SHA1 1ee28b0f4d86a0f88ed697f7faa7ee6a96dfd52c
SHA512 5f35a28ba7d15e02cd28db4041505a49223ea81035715d9b066b52dd899364d655581dbfe46e044f0d91cc74383a51d05e381f95d82522c0c7a35ac0ca25369f
SSDEEP 12288:vyPz5L8f5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6t:Czyf5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1FAF4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cec437517d9ed93dcdb2846af559b84c1b9baf1634ca79b53329854a17911552
MD5 b4dda243b62ab22faaae4522f0cfa2c6
SHA1 e95718934be209e5239ad05038ca120626139fc3
SHA512 2cb9a6cf0c4445dac999660ac75eb28c70556777df87cb1335d562f7a27298484f0ba9be2a7424eb2d740594ca511538689bf6023eed6cb5b07e8c431c9992c0
SSDEEP 24576:OTHaLl3z0zDN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:OT6Llju5SW6H8DS52tdDpbRZy
TLSH
T117050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 72f7149aa34addc027e16c7601f13a0c4239f0dfa0670c39a24f72b8e5f73711
MD5 aab9a54aa6947632929ee58484c5db39
SHA1 8c3b9b6ec1fa36c68723b8760b6060d94035eefd
SHA512 17f349faadff07a0a34ad880a36a14bc1ceac6533aac3c74c1a7d6056b6be68c12193de0b46c4f73c97907886bea83ebebf504eb4d4beafcaeae1d443dba06ee
SSDEEP 24576:P37d9CHKy7GZh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:f7d9CHKya35SW6H8DS52tdDpbRZy
TLSH
T11325CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6998b8c8e5b5abae7403b469e1aa0675a88eb13a8cda785f37e9147d2a0ea0f0
MD5 064d42dc07545fa177ea6728488cece1
SHA1 d7fed773460c187d3df55d6011fcd612c7c04ae4
SHA512 43bec30ab3b8b58b6814084c7a9eac35b0d3890bbd787c09b38be7af9a32ff05969347b7bbf021681b9f291bc61425c10739faceacd5886a20f98f932055b491
SSDEEP 12288:s95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:s95SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T159C423C457A121EBE30E0AF3E1F686E4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0981b220e4a74a760c891f3413b4847b657bfce3827e1830d0d95aa8f1e44a7c
MD5 c19ca827673b9b1b62983b8101f46a64
SHA1 33aa2246f7e11239366c3d71d9cf70a8e58c8ed7
SHA512 2baa0537e0099b236a2a135bd05d09b2d6ab979489ffa6b8a5aed63ed97cbcdc01b79861ddfbd7bb1d1ff976106e9ffff459bf452fcc1e4b13c716e97eb123c9
SSDEEP 12288:z/5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:z/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1EFC423C457A121FBE20E0AF3E1F686D4DA0CA6EFD408623B5F715147CB3998F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ba751962780ba14a96531af64079dbcb573dfc7be86c298200e3ce56eba3ade9
MD5 b12298aa4b4041e78cc5a041e41736de
SHA1 953f4e26e68ba63ffe3be01531eb6dc89d8939e7
SHA512 416dceb9a6a1e78809f7c2863bb41b40f641c9f13a0bdce5061edcdc3594425a75f8ea2c06b2bdb18f1cc78992865214903435fad2beeac58c84520dda7ba19a
SSDEEP 12288:3W5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:3W5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T187C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B9E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 407af7a553c68e7e9c4932e1768111049677ab569dfde0e0f97b545a40553d07
MD5 b64d524dbe4ca3902a1fdc5374c9e28b
SHA1 dfa532f54617f35b3a6465ea42397350561cc2cc
SHA512 4438a3a553787c4294eb865dbc3eacd6002a47dec23dfab30e364d9a58f54d2b237e2a636c8774e408625faabdf1273577afa4c769365696cb7f747ed279d0c0
SSDEEP 12288:ac5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:ac5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T199C423C457A121EBE30E0AF3E1F686D4DA0CE5EF9408623B9E715147CB3598F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 56b505ed1da1ed0e7c372f06f4d75aeb80933b0fe497f4f1d091e305c0bca892
MD5 e1b3c44eb5e6220ff7fc5b98ec0b3c0f
SHA1 cc2bc6001a578290003bce8f5ecbba3b60e5d37b
SHA512 595b7a1067d2ec60abf472127b094e3c93d1a3b7066cd79320a6cf0274b4e28e46784f28c906886db08be6ac1c9b2625f3d616cbf84da2bddfadb5de8366f291
SSDEEP 12288:M95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:M95SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15EC423C457A121EBE30E0AF3E1F686E4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 5ed1a0a53ef0b2dd1adff2f22d7cd6cbe4c24c1ada541c7f61542540b913955f
MD5 c8870babd3c35ebd816fb4c44a930246
SHA1 f0460eaf1e6e50947ec9ab5ca55dc97197a66dcf
SHA512 90aa5215ab011e436e0ce3a9640a276946d8826d89eaf48e097e9ccccd451c62bdf829a38fcc814d03f581f7693c9c6a3c091d2283962ebc2cecdc5b11d484c1
SSDEEP 12288:Pk5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow65:Pk5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16AC423C457A121EBE30E0AF3E2F686E4D90CE6EFD408623B5E715147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 02648a7b1a3f4a93b165dbded1058520b473b430b36d802688525d9580bfa68a
MD5 9f30c7561578e5dc1ee7165bdd6261e4
SHA1 220ce6fc4777d7ec423b2adf0629bb26e7b5e2e6
SHA512 3034c27250fea8dfddac149760b794f42cfdb00fc3ac40b2e521a178a3872e54d55c9e0522e144a89feefa8863eef727a8bfcbe37655bdf03da3bcd3968683a8
SSDEEP 12288:ki5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6F:ki5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T100C423C457A121EBE30E0AF3E1F686E4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 cadb0f2613073b3384a3a21509b2613ac98714193ae78df95676aa52756943d4
MD5 070f22b0377ef6fb8b4e64b58316736a
SHA1 90b9763d3912b5988dc32b5f3c55f71d02bda04a
SHA512 056c1b285523e68535bd64bacd558e965b1c20143561f46933695ca7b9d427f5b95f6395014a29a6c17654ba3a4ea6729467ef0526dececc69bd6985c3b1c973
SSDEEP 24576:afwvok9RX6wkyAIY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:mMnYIY5SW6H8DS52tdDpbRZy
TLSH
T10A35D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1f87f614ee3898b559f952e8bbd921b620e7a49222f8f4fa288b87232a10e630
MD5 6fbe01712c65802893abcca690aafdd0
SHA1 3fdfa7fb5357d608ec1554a643723eb748c3bfa3
SHA512 a776a53028cfd0c30c5588ebf2d5bb5d0d1510ad769c7d7b4d755874e355fb4d3c30f0557e63a622dbc1c65982270790e2440b7d1247743bae34c17e1e4f0604
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0p5SW6H8DS52tK:/ySzPh5SSDntdDpbRZy
TLSH
T170066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 070f49e6ff15de15c160c95a3edaea7c23a283cdba7f36bbe3c4d8c84d7ebfa4
MD5 c29ff5dfd5fc915b5b0ab80135a3db8f
SHA1 901099f61108d734a16510d8765ede65eb8788e6
SHA512 454a23bb5b06573767efee20c663313f6703030a364c421d401f827dda1cd23258f10ece76cb709ac58960510d4e07eadcc5cf3819065c7ca58a4bbcab4ee910
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:T47JUQj1irIhCnDHUPfF/55SW6H8DS5X
TLSH
T1F665AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7f52b253251f97a29a842ded863855359dcffa876149a7a6746d7e40a7d0a4f7
MD5 4eb4c20b414edc69f34c4479f799677c
SHA1 faff133a609b7f0ea11d91364b8f8cd2f335f621
SHA512 3128698be9fcaa501e0f9dd54094bc90a7834d8374420e3ff43cbd402addec1fbe1f10d3c1f6122997574c1e523322e0b6a5c24710d590e189c245217dd4c04c
SSDEEP 12288:fNsfM5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6r:8M5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15DE4F149D39412EAC02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 dbb6db15bafb3b5f8b8d0358d72bde83452d4fe63f4eed9fd4defda985867f25
MD5 61e701a02fe4c6e4153f58136730159b
SHA1 9548c1ff27df5f370252102b19ab634acbffb57a
SHA512 95c9f8aeac8a39a5bd16555c7feffd01a422ac80dbe2bf65a213bd345397ca8502e052128a6a1804fb49e101dd45cc2a7f5ae6d12013d5422acdf4ec401182f5
SSDEEP 12288:BeGmfcPD9MPDnzScYhLB5stBma1DJRMwkMj:Be322FYBvstBrDJRMwk0
TLSH
T1DA352800B666CB5FC66940326E37C1CCAB707D51EE05AB0773C9873F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e82e8a7bd2cfc2ec6ac5388546a59c72cbd37b991835cd71ac9e837d313a4bf3
MD5 08d838433ab618c9b2e368a65d3a7724
SHA1 fcc5570d574650733cfe17e4ae58f99ad88b4fde
SHA512 fb701ed66eaab55d59cef9dd98f119bfaa59e2ebc25af0b53884015cc5a9d8d0a0b4a704e56112d71abb4663a8103311fa34b21d3ae02cc8ca2d15c4b18d9764
SSDEEP 12288:n8FXoM1uqLcVsgb4vNzlrP0eR6rsfx3XFqKiZMaTySQ+FA/azp+u+xtmLSu:nAVe2rzASu
TLSH
T1E765FA81A437A6CFD1B76032072A5B4CABB4EC16B7055F23B3C9153ED81AB51A0F97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bdf64d709291fd344598588b4dc3a925d27a8e3ca5d4de8e81d0a0480de820d8
MD5 1be063228447ecb0d5955498795fe011
SHA1 8df567148595656acbe61113178b41efbe1a504c
SHA512 4642136e84ee325d18afce489f9647197c018e52393959bfa2d9eb199b267983e52fd2c86808ac09b9fdc6f8de94981d5656ef1918f54baaf7e64e2c5139beae
SSDEEP 12288:nF7U5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6k:9U5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BED4238043942597F22E06F3A1FAC2B4E60CF5BE8B0491FB9D216287D735DCB8D7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 97bab9340f9858479cb8d42828af419298cfa752e2f5078bf112cc824a1367d4
MD5 d4bb37fbc7c480ebe506f42a33587cca
SHA1 120aa9df0ac134ca4b698dbe07ac889d563725f4
SHA512 9d31302fc2b5372919b939bbe54c75426903bd5360f508994cec64bfa34045bd963f3e7ea596b4362dc88e4410f679c111bd334d3f7fcfba4d6f7ba06f6b53cb
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYu5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:xgb4mBIBhGFD5SW6H8DS52tdDpbRZy
TLSH
T17D65AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b4e1ceaa448826bbe6ee8608687acfec674657c11e42b2161b92c6e3d3403710
MD5 c43125b6ae6991bdadf12d1d456c0eaa
SHA1 d4fdf18f9637297becb3d4e8fde374e15e7e4810
SHA512 93830b55ab9c940b6c5962c56b8544ec4dc02b1bf04064c7d53abe2e62215de15529dbcf527bbf4c0b2ff98936b4f8b7d7794af061181a26930f7a7cc419d9fd
SSDEEP 24576:WG88u8FpJqH1bzria7/mz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:97ZFPqVea7/25SW6H8DS52tdDpbRZy
TLSH
T11A35F16577E101F1D47BD138899646A3F6B1B4250324EBEF0BA88B521F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 68fcaadd1a5ab0fb898865e6e106124e5557d5d8bda86fc963c023d6a5354c11
MD5 050f2bac9302bc91ac3c2baa904bb155
SHA1 8ec4af36fe888e9c3aaef706f0671f3e3554ae90
SHA512 4ba5df3aea47489e8f6b3fb4f6f3a647e2f5805c952e415b5a1510cf835fbdc602773dcbe13f42834b825ce9d6a38f05a8af57b08cbb45d68c320009700045c3
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjn5SW6H8DS52tdDpbK:ZG05lO43bA5SSDntdDpbRZy
TLSH
T177D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 34ccb54b98d4067df46f5d8590484a1600bb0d95ae7457893f4bc8fa283b86a2
MD5 9c5378e97cc12d5fab3f6d5513747051
SHA1 dde506129720e854faa4a95a21eada326f0c11e9
SHA512 63a115d074103e3a579422276b1b604d69cc1fe2be06c815c634f721f346026d953190002bc623fb76b251e20bb1f9bf97f0e6322dbf4dbe142023504f967e1f
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnp5SSiVw6uAX8DS52tpz9ZRzbPmS1:/a5POZ3+Jt2pasx2+m/5SW6H8DS52td
TLSH
T1EA65AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8d7226b75fb4ab4ecc53735cc515ae78f7d7fb055cc51e073dc60be77c1a2c2a
MD5 913e4e8cde9bec2d55641b8c2aba2e16
SHA1 166d84f6e88304a0e44b2852dd50668e719e0b27
SHA512 f8dba58056789a5d13cac73293583fb16c76ed289aa25f7cd7d4ddc885df8b8e23a7ba8355c8837d69acfbfc402326cb96045ed1f4e627d423aa85219bda8a0e
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fkr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:tNc/zEOVHFW5SW6H8DS52tdDpbRZy
TLSH
T13A857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 95444596c647ab47286bc5fb87a4c6aa1191020a474f89c0d23b3e74c0ea99f7
MD5 804f7ae6ba3836db623bd9bb4ee81383
SHA1 c18c776ba9c925403bcb70dd0f01fcdfd523c90e
SHA512 36a8e483836d79773d9a4e2fa4f44c3f4af3784ff7031c9303d112c714f0dc0e3d7483633c45a2d220495f9fa3c34e0e00cb9a5d12de46d257fe6386562ec635
SSDEEP 24576:h8kNvNnaFeYhJNtmZBmV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:h8MwBtOmV5SW6H8DS52tdDpbRZy
TLSH
T10655AF6EB6B806E4D1FEC6B5CD238512EA727461073293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 caa33aae529bb80bfef532497d5889a2cfe8f9dbe0a5b4c319d54bbcda1b3e48
MD5 0cf1a61ddea1289b60369461a9b6795c
SHA1 edc94c51953314ad3716f45b1bf0756b0addc9b9
SHA512 9879b229689eea2aa0dcf8d11abbf01e467c0bba86e14c26b1c3e1e2a54e6e98e3b2ba959cb350af0021c5ddf4024d22c21e80ea19c71996767eed40d3d4c340
SSDEEP 24576:wPUr+NQ35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:wJQ35SW6H8DS52tdDpbRZy
TLSH
T12505F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 715fe9a3ed35198b869582ea1e2ee4dcb0f7c73f26a11bd84b0b7dc77694f6e2
MD5 2c33a96cc598ae20543c688566ca9702
SHA1 f810fefa03cb5e417dc19bec9d809ebf49046933
SHA512 90bf56b07fe3bc85b1004ad2b4fd3b01569f85713674ac80a751abd2a1a38d56b3b6ee309d1b6edb904a696633b2ae55169fc02deb4254160fb383200b8f63c2
SSDEEP 24576:8D3FHshBIYQgAQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:8DVHeBIAAQ5SW6H8DS52tdDpbRZy
TLSH
T16C25E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1196-77-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1196-311-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2220-140-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2220-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2220-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2220-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2220-130-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2360-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2360-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2360-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3456-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3456-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3456-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3456-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3852-123-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3852-329-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3852-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3852-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3852-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3852-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3936-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3936-314-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3936-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4064-59-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-65-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4064-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4064-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4356-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4356-87-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4356-82-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4356-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4584-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4584-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4584-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4584-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4600-40-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/4600-0-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/4600-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4600-8-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4880-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4880-52-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4880-45-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4880-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5764-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5764-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5764-124-0x0000000140000000-0x000000014013E000-memory.dmp

Download