Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe
- Size 18.8MB
- Sample261023-ygafmade38
- SHA256 e310839219ea0053905188a6091c3395a1a77d0f8f6e43af802f97b0a0ac38fc
- MD5 d098ce8f4271c06a123aca392c44b6f8
- SHA1 3a9b38610cb892861754b94ffd3c8f1647aff20a
- SHA512 b4f133442ce29484a0f067fba90c58d114dc38e9e1b0020952f7a6e80d733c52c09d0ffa738b58311538687b6dd70a989934129a3aefad765a70f9f2b64453b2
- SSDEEP 393216:PwbubKOQowzsI1tY1+HpfqXbzZXgzEn6mAIqOYSP:5bKOQowzsI1tY1+HpfmbzZwIfAIqOYSP
- TLSH T1C9179D13B6D301A1E9A3567044FF63275637AA12873089CBF24C3A546F732D17A3B7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource behavioral2/files/0x000300000001a30e-420.dat behavioral2/files/0x000300000001a30d-421.dat behavioral2/files/0x000300000001a306-422.dat behavioral2/files/0x000300000001a305-423.dat - Executes dropped EXE 10 IoCs
pid Process 1376 elevation_service.exe 1416 maintenanceservice.exe 5672 OSE.EXE 5188 PerceptionSimulationService.exe 4232 perfhost.exe 4940 ReFsDedupSvc.exe 4668 SensorDataService.exe 4184 ssh-agent.exe 1676 AgentService.exe 3156 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e5c1fc793a35217a.bin elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe -
resource yara_rule behavioral2/files/0x000100000000934f-374.dat upx behavioral2/files/0x00010000000093de-375.dat upx behavioral2/files/0x0001000000009952-376.dat upx behavioral2/files/0x0001000000009b92-382.dat upx behavioral2/files/0x000100000000a319-391.dat upx behavioral2/files/0x000100000000627a-394.dat upx behavioral2/files/0x000100000000bd44-393.dat upx behavioral2/files/0x0001000000006223-392.dat upx behavioral2/files/0x000100000000a304-390.dat upx behavioral2/files/0x000100000000a2c1-389.dat upx behavioral2/files/0x0001000000009396-388.dat upx behavioral2/files/0x000100000000a1d4-387.dat upx behavioral2/files/0x000100000000a0ce-386.dat upx behavioral2/files/0x000100000000ba34-385.dat upx behavioral2/files/0x0001000000006215-383.dat upx behavioral2/files/0x0001000000009cfe-380.dat upx behavioral2/files/0x0001000000009cd6-379.dat upx behavioral2/files/0x000100000001b93c-378.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad0938212763dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d36c74d2763dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007b783f212763dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096bb7e4d2763dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fadb92172763dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 1376 elevation_service.exe 1376 elevation_service.exe 1376 elevation_service.exe 1376 elevation_service.exe 1376 elevation_service.exe 1376 elevation_service.exe 1376 elevation_service.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeBackupPrivilege 4940 ReFsDedupSvc.exe Token: SeRestorePrivilege 4940 ReFsDedupSvc.exe Token: SeBackupPrivilege 4940 ReFsDedupSvc.exe Token: SeRestorePrivilege 4940 ReFsDedupSvc.exe Token: SeBackupPrivilege 4940 ReFsDedupSvc.exe Token: SeRestorePrivilege 4940 ReFsDedupSvc.exe Token: SeBackupPrivilege 4940 ReFsDedupSvc.exe Token: SeRestorePrivilege 4940 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 1676 AgentService.exe Token: SeBackupPrivilege 4940 ReFsDedupSvc.exe Token: SeRestorePrivilege 4940 ReFsDedupSvc.exe Token: 33 3156 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3156 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3156 SearchIndexer.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 1376 elevation_service.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe Token: SeDebugPrivilege 4816 2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3156 wrote to memory of 5432 3156 SearchIndexer.exe 99 PID 3156 wrote to memory of 3344 3156 SearchIndexer.exe 100 PID 3156 wrote to memory of 5356 3156 SearchIndexer.exe 102 PID 3156 wrote to memory of 4716 3156 SearchIndexer.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_d098ce8f4271c06a123aca392c44b6f8_darkgate_elex_glassworm_luca-stealer_mimic_njrat_remcos_revil.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1416
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5672
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5188
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4232
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4668
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4184
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5432
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3344
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5356
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4716
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
- Size 1.5MB
- SHA256 983b1a50bb3768f96bf8547112bd259a92e7490213cd5b0e788886d4dc54786c
- MD5 88d5ed0a98f6b5b205b9171d981041d9
- SHA1 5d6275584a6fb44ced3c9596232398f834052c71
- SHA512 51902ae5852dec536570d8f3a6dbd9a964fdad0181c28e0ee8a183e50501d62dea811b1586f9dce172fa43ba02b8c324ec1acfd7f273a471344e89f73cc80fda
- SSDEEP 12288:b5AEeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:bO+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T13D751220F1C588B2D67602714F6E5B66905CFE740F2294D3F3C86F6E9D709D28BB26A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- Size 1.7MB
- SHA256 a79deb4e0c52746a97a7246ee001afbcbde387b302d3502dd8e2c9415f1df510
- MD5 d0e82d3ed7f60346a0e01977fe8f5427
- SHA1 21170fdd0b69a3fce4b5894573bf7472962d51bd
- SHA512 a5c51f683fb608ac875e1228ed2016f0731cf6b3f313d52e7fac6068e5c04dfb064921db31741bce2a28eb25671bfb44bbec7fa8beccce426384951dcddc9732
- SSDEEP 12288:yZKK9HMYcy2eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:+Z+E+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T10D85F11A73D84CE5D467C239CA524642E3B17C850B65D7CBA790436AEF73AE0AE3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 1.5MB
- SHA256 83517ee1de7ff026d91c536feb35af76f16495cae8263a8dbe4e2d386f60a339
- MD5 205b380199069e6c4d106ddf026d8c23
- SHA1 10d3bcf694896631ff5605872536c9ff996a01c4
- SHA512 6da9abf0c0ae52c7962aa73df8ea54f405499f9a6fb85dcd6d48711027f7136fe54fa63d2a68713d4029575bfda915acd2761e08cfa565b6d9f0af0a301b20b8
- SSDEEP 12288:LFQ0eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:xQV+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1B9652343B749CA87C82206710B7A0F70A1FDDE606F466683E785379B8CF49D549B236E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 1.5MB
- SHA256 f7e146234fa4be48d47f12b353f836f04ba4e9b9f6c494cbd0c246a7d68a582f
- MD5 970b2100252d9e7977f5f22df088b273
- SHA1 3aa50c20e23bb3c44d228466fb6b1b5916b7ca4c
- SHA512 f5b63d27db158f3b2dc163a83c85f64ebe1dde96c7fe27e2978bcb05a2d0c3c14316b92d688bd19d8aec4bd1e9ecc26013fac1abf8b89485cb5c3a98870ac7c0
- SSDEEP 12288:N7Ql8HoMeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:GhN+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T1E4751257B39830ECD5774634CA620A10E772FC7A1B619B8F9794239A4F73AD48E35B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 1.7MB
- SHA256 17f2985e62c52cf4677733c09c5c76b9c614ab9d52983b3937410e91440f44f9
- MD5 e3699894c6d2699876fe4e20fa96bfb5
- SHA1 8404d82daf97c49139df00b3a34f62b964d79555
- SHA512 9ac170c321812c6ddf92ab5738c70cf3ec34ebc9ac9dc0d74fabc2a5a086df9738fc2877e78213a360bb98eea81ac043ab450719e2eeb89a323300e4c2dadb05
- SSDEEP 49152:0SgouvAeFfenxyQHXS7uQ0NIH+tgauhwbR3P8wT8:0S1uxaxbS7uTgaPJ
- TLSH T1BD855A0267F94129F1F37B71EEB993645A77BCA1AE39C50E5280125E0DB0A90DE71B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
- Size 1.8MB
- SHA256 e6add3b8013d4132a93501c6f792cab05332f48d85d6a26dbe73150b715a65bb
- MD5 1207e3674f31191d03b432d47782caaa
- SHA1 ad4b274da7bfc7ac07f00bb4b980467ed770a913
- SHA512 cdf7bff559350274dea602eb764d070e25bdfb7b08bfcbfb14abb8938b447ca088e5a2ad5fad7a5213f61a65ccf675dd9a91da60bee600b9ceb6b4b944a0dbb4
- SSDEEP 24576:M/TAbD+OmeR+4ZAgayjhwbmY3MaReFeDvSP3b:UTAGOmeR+tgauhwbR3P8wT8
- TLSH T1E895D0107790C036F1B319768B7F9724556DBDA15F6881CFE3C82A6E4DB0AE0AA3171B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
- Size 1.9MB
- SHA256 f88d99cbefe05948a26937ea6d58cccd192224610c737481d7a1799dc09498bc
- MD5 5847837e29c779bae4f2cc125adeee70
- SHA1 c06d857b6c33b59d8f9f4a3a38252c43abad2cb1
- SHA512 fd216c4b9b4f1d5404757e32a54cf1580d22c6d8ccd9737efd942712c39a3bd4922a88f1bb0839d291e327e726c573dbcb0cd45ccb0433c560c0a1b62b794fa2
- SSDEEP 24576:zJ7RKDjjg/PzNWyrD+4ZAgayjhwbmY3MaReFeDvSP3b:JUjiPDrD+tgauhwbR3P8wT8
- TLSH T10B95F12075A4C072C17312314E6AD790677EFAB00E6249D7B7D4BFBD6E309C1EB246A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
- Size 1.7MB
- SHA256 151636dd305d16d8ad39f8afb8c451955a4072d58ed07094081c5496cfc04350
- MD5 24fb756a36901f68cb7130196ea7f2b3
- SHA1 3d18323f0b5edde3436655246021fb379d855db3
- SHA512 a2ef5b8927793abad393b9b430037b42770992573362d37bc064576b400251c9c2aae0152e7e8f257aa7ce2476331a9d01e807acc02c7460a3b12790d8f749f3
- SSDEEP 24576:uZM3zFVSOq+4ZAgayjhwbmY3MaReFeDvSP3b:uZM3zf2+tgauhwbR3P8wT8
- TLSH T1C7850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
- Size 1.7MB
- SHA256 4021ecd66e6133379b76fbfd67065d520a24ce3c58f9b082e994986e56ae6c9a
- MD5 bfe861a43468418854af9f7b4e280adc
- SHA1 ee2dc4b8f3136baf8abafe915b6b785ff70a03ab
- SHA512 46207548f1620e040e0941c5fdd59fe83afd7f2ca38adf516d79f625712b659f8015cbc196d5a547b81d587de19176f334fdae4d76ce99c2d4d92d0ebd848bdc
- SSDEEP 24576:GT8aLl3z0zDs+4ZAgayjhwbmY3MaReFeDvSP3b:GT7Llj5+tgauhwbR3P8wT8
- TLSH T188850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
- Size 1.9MB
- SHA256 4b089ef40635f610e8e47db611117956f7220accb5ce8cb80403258af7ebd374
- MD5 fded420d3c99e258afb0338697d6e32e
- SHA1 f8ba728cb4c9f584cc3f0007cb191df7b9e3c253
- SHA512 963ec146806878b9d99a399a08d4b165654e557c3728d69a052e5f931d3153898418dfde1ab9d1ed6b023ade28e721528ce0b1375f061fe879c97525ba2b663a
- SSDEEP 24576:23rd9CHKy7GZI+4ZAgayjhwbmY3MaReFeDvSP3b:Yrd9CHKya2+tgauhwbR3P8wT8
- TLSH T1F395CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 6.2MB
- SHA256 0c3ec8d1400e50031f89b703e0567c05fcc44b8be8bb3d871d1dcb902d389673
- MD5 551607dcbde0425726c630dcf9f189a1
- SHA1 2cfadf05b803c2800c53b3c5d6bf121a7539eafb
- SHA512 2bdfb76714b924f1918eac4b1e3e7064871b1abbc6deb1e1b7c6c4247f51714ca1bfa19bd76d1f3e76ce42a17c3a78fb6b5213dd2d698f7fc1054d1f935ca251
- SSDEEP 196608:Kog1P9fIlOu/6IgF+I3m2MXP6HG8Qzoax:KognqOo6IgF+qbM/6HG8Q3
- TLSH T194668C23A4E08034E5F732756D2CA7395A327BA29F3145CB86946C946FB43D3293936F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 6.2MB
- SHA256 43358a00b7971a44ac62209ca7fc8a1f4e154520e5395134899362fe5e0b0a13
- MD5 1b15bf888225a69075a22624f5513d6c
- SHA1 d4d2eeefbd748bb4d6832d661632ab9153fb351c
- SHA512 dd388cc017fa1485611aba40a1033c757936ca010b2c54790bf73979d8a4c7bfc46629f4b21c32bfcbbb536cf6478761b9eefa7da16dd41367846d501b7336a4
- SSDEEP 196608:oog1P9fIlOu/6IgF+I3m2MXP6HG8Qzoax:oognqOo6IgF+qbM/6HG8Q3
- TLSH T11A668C23A4E08034E5F732756D2CA7395A327BA29F3145CB86946C946FB43D3293936F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d25d80d05e922e6193854b8d9469279a4f40bdabb583c263126289cf71b91b10
- MD5 09db45d4f4bc28a40853e7a4d450ec91
- SHA1 953f84b1043c98f0d4e7e49c4f17f75bafa47c60
- SHA512 4aabd78b99de09ef733ba4aa0aa7cfd55878ffe270e5ce91ce5e4424a53a0a5ff4a195d8b233a58a9d25e25757623d1910ff33521d1fd7e217c39ebd56196642
- SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnf+tgauhwbR3P8wT8:u3q6mjBDgaPJ
- TLSH T136D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.4MB
- SHA256 8c01f1ddb27d68e1a1570aa7e9d1277ab9cdf06d91690bd2f773562f90370f61
- MD5 7c5f0ac3b32405c738aeec1311478b10
- SHA1 b0064102bbdf89e1b680742799baceb1356ec627
- SHA512 4d0848be678f0de7e17f0d20db4ae9759216b67ae76b78248e8d5221d29a2ecb8d019c5b3519647bddf5a3d49e2157ad9c4a945d9b171f15aafc6ffbf591585e
- SSDEEP 49152:jwcR+tgauhwbR3P8wT8osOH8VuOJdJqC4If:jQgaPJ+OH88OJdJLf
- TLSH T157C52274639449F9DD6B423CCEB28011FA73BC9547A4E78B03E8AA950E336D84D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 d0eb42b4899071b06b0b2596009c6fbb763615c750814a8aec27732340ab743a
- MD5 249dc2797f3cad03e0f6633adef73476
- SHA1 9386508b0d9515f70dec852b20315e31b0fdd384
- SHA512 6a928a96e237bc08f12927621307eedc2ea6722cadc812ca7ff2a3affae368acbf33366b09915fc6e495d0a00eacbe031a2c6e16516c285ed5fe250d924503ab
- SSDEEP 24576:OXYfDtczAs+4ZAgayjhwbmY3MaReFeDvSP3b:NtcR+tgauhwbR3P8wT8
- TLSH T1AC85F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 2.4MB
- SHA256 7ecdd720b8eb0461ceacb4ff6bc58791526a8d9c9e99e65d86559316c642352b
- MD5 081017d06a20a135e2bf94d28c431cdf
- SHA1 d975a4ba736fa3d7f0f4e4984db64ca04f2a3f9c
- SHA512 af0791b71b21ab31d9a7e9dd25435fb795f28447f66665807f39f747e9c322965beffa3b4ef3db874422b39268ae6b5200b873150e0e241c20d9d26c711be491
- SSDEEP 49152:NtcR+tgauhwbR3P8wT8osOH8VuOJdJqC4If:NrgaPJ+OH88OJdJLf
- TLSH T165C52274639449F9DD6B423CCEB28011FA73BC9547A4E78B03E8AA950E336D84D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 0161fbaa72978921e6f6bc4911d2968cc0ae6f3cc1525adbdbe37740d4f2b32e
- MD5 31330c62eb43ed6c2a055773d09f267d
- SHA1 7dda15c65fa6a6b0c0d5c9809a938ff2c67af1f0
- SHA512 355d330b9976f4bd36915ac00a44f31240f24c3d7e746fe6a929fd370f49d51f4638e6991645e2f622caa45c887f159449e3788d19770dca86eb97f1508434a0
- SSDEEP 24576:GwuROWO+4ZAgayjhwbmY3MaReFeDvSP3b:GwSOp+tgauhwbR3P8wT8
- TLSH T12685F14673A80CF9E9674238C6578532F7F2BC422A21DB1F57A0C75B5F73261AD29720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 3de3bdea1e72bccfc76f983a849f97b6b6de44d714b530094ea92bf934158cd9
- MD5 3e37889fbe62f892e70640baec469d80
- SHA1 38b96fe6e40294f54650e84b82105d39b699f0b6
- SHA512 ebb5047572d8520e82be43d60f8d91bf8f1432216ddb8a4b2ac2172b19fd410d08bb3b2fa01862da52502d1a8943094afbd84aa9171cc6da562e2c96edb33856
- SSDEEP 49152:fA+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl8sOH8VuOJdJqC4If:Eu6JmTxd2dlOH88OJdJLf
- TLSH T1B1E5AD13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 e8a9221d5ba12ac55992b881ee6d4baf7cc5c64c224247827d1823d1cc45ec54
- MD5 be7e2706a7bab6c91903c841e5f29e40
- SHA1 33f99a2998105780f6bf02a428b533e865d0ac52
- SHA512 0168def1b7ee245dd2a51c21c9e4c475bdcda35a1bbc8e95ad2f0eee5408d52a4bf4be2d366bc69d5a5759aec932525ce28f372c1a029586071fddd3f9c083ba
- SSDEEP 24576:3fwvzk9RX6wkyAIb+4ZAgayjhwbmY3MaReFeDvSP3b:yMnYIb+tgauhwbR3P8wT8
- TLSH T11E95DF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.6MB
- SHA256 a01c3aeb313e478fdc36e7c54384759edda0ef76b0320a10e54cbe91c4be0874
- MD5 67fdfc37d4e5c72b3b1177f1b89126f1
- SHA1 478ad72d8d961a49d4ead8520c2c5b3f67d957e5
- SHA512 a09ff3a70f0a78a68e8f29be28220bfcb4a127a1818b448ff2e40f0c003e2e8d264b0575db3f5d93fa6078eb0b74a153609d95b0c9edcc88bbcb56db2c5ebfa8
- SSDEEP 49152:sMnYIb+tgauhwbR3P8wT8zsOH8VuOJdJqC4If:HcgaPJ7OH88OJdJLf
- TLSH T1B1D5F129EBCC44E5E177823C89B74606F6B1B8591B71C6CF129A53AD0E33ED49D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 ffd4c5135f6add4db6e82b3e1acbfdfc35cc39b0042e5705e991cd5b57096a09
- MD5 cf8b07a3a08f3f7f4cdcf5436ce77686
- SHA1 2d4505fa9e471ddf746c6dba7d73851a49f93c59
- SHA512 3a7e9aec66145f0f189f539776a98beecfacf38b756497cc3eec85ebdecff6ca526f6a19708740e74c24be9e12ba64002f0056198d91fe2671b9661ef5972d60
- SSDEEP 49152:0YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M+tgauhwbR3P+:rySzPXgaPJ
- TLSH T163066C96A16801D9C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 4.3MB
- SHA256 86e0abc25c1f4455b87ccc520c255def48cda090e5dc57c8e716ceaa7b79cdc8
- MD5 b18cf8a4b4738b49b22009cf6f732528
- SHA1 58b71d0d401a9932815ad43c06a5c68b203a7b0a
- SHA512 92ed62a7ef163f80e71cfb09674bcca3cf127437442e78dcd8a6523b6d71946460d4362787fc96334c34d56965f4ae9a71e1b8e3368156d8607378b970f5c09f
- SSDEEP 49152:RYS2Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M+tgauhwbR3P5:4ySzPXgaPJIwOH88OJdJLf
- TLSH T1FD269D96A16841D9C1BDC1B98F1BCC17FAB134490335ABEB02E556835F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 904bf110e0c260f47232d9f5ad8f0d560e43910b207443526a05abd08088081a
- MD5 5872315d117bf5a4279197e97f7499ed
- SHA1 da21fefcc3f8bcbc4e40e7f888f5ad5af2076a11
- SHA512 5e4b034eef71cfe99fa58795e90b2cdfdf3d389f873eb8c1fb2936089cfdd72141cafdbb26e53405b1ac6320d219de61ebf1b00aa391fed8b59e4dfb0f74a13c
- SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY2+4ZAgayjhwbmY3MaReFeDvSP3b:l47JUQjqirIhCnDHUPfF/c+tgauhwbRG
- TLSH T1F865AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.2MB
- SHA256 4803ba1408ac11bead341bf4ad9ce8925580c8a34a8c4fce470ec488119b6038
- MD5 38b2bca23c33de2ca644e46a5850a195
- SHA1 611bca504fa6239419027116f3481076ddba6bc6
- SHA512 fc1325057963d576a611e301b44ed95c9108eb5e8fe07f15f8e70134e6c2b1fec7f61a7fb96e3b2bd1d7d41a96f0894fe34041e1e7374d6973242eb4aeeccffa
- SSDEEP 49152:M57JUQjAirIhCnDHUPfF/c+tgauhwbR3P8wT8BsOH8VuOJdJqC4If:2JiglD0PhgaPJBOH88OJdJLf
- TLSH T13DB5D01DA3DC01D5E1BA82788615465AEA71782E1F32CACF22B0937D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 f1253e32a898f144dc87062593823b0e466a0c39dfcf69d3092b6759604d204e
- MD5 77593bdcf9809f3f481e07d86037e18d
- SHA1 542bb38e9d847c7139f8f897975a0de7c3bd316f
- SHA512 858f9f94b02decb8825e7172decc683357f843ed338a459f107c199811b9087e3cbdb44e8458c7ceed906e58775525863e9ca620a30904dae9f02e40ff7e665e
- SSDEEP 12288:2cfOzBqt11vYAc2O+t0bo20TtEsgga2RM71yJVxuw:21zYh+bEEsO2RM7IJVxu
- TLSH T1765528107626CB4FC66940325E32D6CCAB707D41EE05AF0373C98B3FD576A59BAE2291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 de1cba749daa76b56d946a58216b6617094fbb3dfedef7b164d2c41154196055
- MD5 f2585140588099c69e91f64789bdc50e
- SHA1 d5f692d3aad25f11a8a4d59a20fc88663d0465f4
- SHA512 8ce98495565073daf4604b327736f7eaa977cbafb0dde800abf050c203acf0882dc1c74d13848928e72f846033d2ebb251412ecf8a206fd3e52d5cfacb4c8475
- SSDEEP 3:OlH/lbl5VE1ZgOzQDsE5RVeQ3mCllltq3mCllltGlslslslslslsl6B3e/ll:KrE1eTwE5zmCtSmCtEEEEEEEAet
- TLSH T11E8192888B434A28E386307200785F845330C29AA81183DB020A30739C002844D43A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 394KB
- SHA256 531e42d309b811c9c29e4be5c4335720a1cd8ca9f0801731ecab00535b4c1f61
- MD5 2b687c646d1ea44a0d626978fb158a11
- SHA1 69a87cc24c1229d67338116bc2cfb91e03c8f849
- SHA512 1a2967c6b7b269ff077feba389f54fbfd203544948de5bd78bc0d736b3060530d447c3070defad39f3b1df2f127ec706f6b84971d70733579f5223fa0e3e7469
- SSDEEP 1536:Rw5+zoiodbZzo1GvPCmKK6EW25phOKab9khhPryIpwyNyvu/Ztz0:H0T0BmIk7IIA
- TLSH T10D84A611B764A66FC4A980735430A5DBDB79BC129F116F023BCD18B0DCB215AB9B3F98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConvertToWait.docm
- Size 778KB
- SHA256 ab409976153b4bcc5f6f29798a47e0584ddff3b690ce5eaafda7fc2ea21097f9
- MD5 e83dbf2d7e06548e57a095c0584b95de
- SHA1 5f7adb6ed53cc62c75503e4018f082755bd8e610
- SHA512 9c26521462e3806b05e431408e0962d5b2dbfdfe963b502cc7d26941a51fd57483aafc1b67baa1459dede325097d8b3c2c35b6166e3b77883c01ef8fc35e7780
- SSDEEP 12288:e+uzd3as+AvBpiEERhQr9dcD/QQ5kgFqm7LGV2tsUSkjQa2S2Pw7+lQykDLzUs:e91ohQr9GTQckglU8sUSuQnSCZuPXzUs
- TLSH T14F05234409CB01D6F6EE0730DD61A2E3AAE52B9A8751CB3A613203556F4B77DC34E9EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\MountOpen.docm
- Size 771KB
- SHA256 8ca53496bfca3a8d9ce9740836889b15d5cf8b6f96c40f151f58bf360a91f413
- MD5 4f062d69d7fc8ad54c80e9ee312dca70
- SHA1 717c4e075481f29e1e42663533ed7f0d42ab1a3c
- SHA512 d4b6d2df6563f319592d9fc37d5a108a8ea9097fc31bfff0ec053f6d0adda03a1dd8ac53ea643c197a084327586374fd4b0490e2af780992834891a6196a486b
- SSDEEP 24576:LpNAIl6YvTKusAORY0oT9Mxd474mCaV0r1:LpNzl64ORbohcd47HCaq
- TLSH T145F433604B320CA1D56318B55E4B4AEA3FCFC64C097365F71D363861B8A8E1FB1E6C99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\OutRepair.docm
- Size 772KB
- SHA256 ff2e01453558dabe35336c84e20ed6c4ddf8d12b0b0c1ee904181c7b30114a1b
- MD5 97db5c1fda55fb7c7084fee61c8d0881
- SHA1 d2f476f60ec1ac337a259ff1cdd00146cc900716
- SHA512 109a5579c51c257b20a8efb20736574cf2a5a2a5e3d9f40fccb9c4d9017c42e7abe363de11a8446f2840bb0975be3b64752599bb9ed3b1fd2a1b255a9e4191c3
- SSDEEP 12288:3VsBRHYDR2yiNz0fhmqODg+TpiArDyxQHf4XF6j+h0YZu1qmTegO1N1J3:3VsBR4NfIxTppW0o29T05J3
- TLSH T112F4238FB4C66754ED614D3EACB760E4BCC606136226D5828DC3B4409CEF1AA3867DF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\StartResume.docm
- Size 778KB
- SHA256 b703889ff7524734005ed9407a98a82874dcf93b072f485539b1b9f1d2406aaa
- MD5 8b150ca38b882710562934d0fc963a07
- SHA1 05914367e22b66f8f16589a4aabfb406e96c8faa
- SHA512 30b112a9f286300d9a1b63fd93969dca8f6c25fa02b4911d5fe363a99bbda38f75cb8a10b163b0d784066b7029982d60973e479fe5d376175f343a68b1c1c08a
- SSDEEP 24576:nuY1ohQr9GTQckglU8sUSuQnSCZuPXzUt:uWT8TQcnaUSuCNgXzu
- TLSH T19D05234409CB01D2F2EA0730DC61A1E3AAE927DA8751CB3B663213596F4677DC74E9EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- Size 1.9MB
- SHA256 8ac7904a94652c97c780a548da3a5911ddf3b04e2c536ac2cab17335b3b40b20
- MD5 12f1d350106e87b2ab13fd5005e9e5dc
- SHA1 3384e603d8559b81d14e0ce726d0ca4a329a081f
- SHA512 5ad4f031a37a4e70bee0fb1b68e3786d1180ba6872fd71c908055d5a5b874d1ddf21e3e6afbbb9759c672181d6890a57391aa364cdf64ce9d317e5e63256312e
- SSDEEP 24576:y3n3i63i9+4ZAgayjhwbmY3MaReFeDvSP3b:yX3iMC+tgauhwbR3P8wT8
- TLSH T1EF95BF02B3E89135F6F31B31AFB592615A7ABC729D35D20E23C42A0D4DB0990DA75B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 384c16de8bcd3d89b05ee21078bba950e1e0fdb117bc9251d4b745e242a25a10
- MD5 3646077dff618015b2c9afc6a3ae635b
- SHA1 b011048005a1ed98d00c58dde1b72c0661b6730e
- SHA512 3309f1a0343f10bed82b9bf7df361005dce9b7ea2769b38e61e6ae504497b393ad9a88f2fa9293b7b5c4f49ca32dc1a988bdecc00754d5c916bf1a3a55afa895
- SSDEEP 12288:dM7SeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Wn+4ZAgayjhwbmY3MaReFeDvSP3b
- TLSH T144652391D34C888AC97B07708B6E4930765EBF961F41A1C7F98977C58CB0DE88EB1399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 52b0688c7fd2bb1419b215dc7cae465aad1354f31bdd36969df54a36f820523b
- MD5 158f9ae34dc0ac9dee150892091710b6
- SHA1 c1e4339dca6ab1741ae4d2a7c6671359acd67a90
- SHA512 79ad0bc798c671b6fef9fe6007ba5023a0c06932643c347653c61c10746a88703b29618f24e5be26ee3ec29315432e9758f4400a9621de9df2b2a6b19fa407bd
- SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYh+4ZAgayjhwbmY3MaReFeDvSP3b:agb4mBIBhGF2+tgauhwbR3P8wT8
- TLSH T1FB65AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 ad2a8c95fdb589863c683102ac62aeed529c1095ef5168893dad40abcca7eaab
- MD5 05624b420c01a660f6457141bbce1dae
- SHA1 a7608a352bd593b67297e0a1954a9fb5f1886ba6
- SHA512 c28e3627bb8e5b7f239629ff19ef180e418008b258550980e65c7f0b40b023423e08544f9eb66a8d779730fc79142a294c5d924f175cd0fca0d6486e4193fe7d
- SSDEEP 24576:QG9z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:QG9sOH8VuOJdJqC4If
- TLSH T1C90523B820967264C23F8739597EA0AA7CE5B1A4979D09FF14EDD7B84E059D0A03FF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 f31bdddb778d5417e586ae302a620e35e69b1763f338a0b5c1814f11220bf80f
- MD5 acc3a130865b7920f959b41050b5fa63
- SHA1 f8f4f07095f40636edb02c7b1fdf5b543710818b
- SHA512 3ba61c34ef8940a09cd65c5927f20d7844884fc24883fbba0956721d88bcf8ae2cdfeea7690c1ea328cc12bf80687fb497e2aba45e25752a228f1ea5df61b714
- SSDEEP 24576:bG88u8FpJqH1vzria7/mm+4ZAgayjhwbmY3MaReFeDvSP3b:67ZFPqVya7/5+tgauhwbR3P8wT8
- TLSH T16795F16573E401F1D47BD1388A464663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 d23970656b8d9a7d1ae1526719613eee189459132b5e019dfffe93fbd5bd5c54
- MD5 53c9878b5543b1c7db28656e294f9476
- SHA1 cdae95a6c7597be9569f9101ef122259d8310b93
- SHA512 d991d99fdaadea605f11c1cc8fa4b2b22da6b15eeb6445d078a478b0ce79424201d94478afee592cabf01f58fbbf9fbbafb34ddf00f8b180f6ee39cf07f253d4
- SSDEEP 24576:EPUr+NQa+4ZAgayjhwbmY3MaReFeDvSP3b:EJQa+tgauhwbR3P8wT8
- TLSH T11585F11F62AC18E5E67BA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 4a588ddcfff6a507b4b6d2444e2906549d5f06e70a1524ae63299e5af2b31fe7
- MD5 53a20c71b786c3743fc586f06f6a2e8d
- SHA1 6134ab3b153087a6484ce01b68f552e94f17823a
- SHA512 dfceb1a490f431defd31345307c963a1e8bd3bd4172b7afdcb470dfce363e04fad8ca052bca0217ec0f523c7ab837007c9f82e02dbf28cfad39759f9f6ee5b5b
- SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjK+tgauhwbR3P8wT8:cG05lO43bmgaPJ
- TLSH T1A8D5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 d2769e4dc0bc34b91d45ad18cd495bd57c9ef5d477ef450b5cc4beb709058370
- MD5 7b8d0ffffd60c68f858fe73fc904921a
- SHA1 62a1b1e3397d739d88ac52aa020f3b7c42a527c2
- SHA512 b8f49966c0022b47e802b94c0b396911d26a533fc675f2baccda7b1ce9e3bb5e0293d37fbefb71b84f649d5e0611a924a2c48101c4be073a2fe960a9e02fabb4
- SSDEEP 24576:lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnM+4ZAgayjhwbmY3MaReFeDvSP3b:la5POZ3lJt2pasx2+my+tgauhwbR3P8z
- TLSH T18565AF5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 aad884346cbf367cab2a7b9cb15f1a1edd802d01c85fe4ec7a9a7356dbaf36aa
- MD5 36f5f866d3088781cb84869957a36caf
- SHA1 07cd565a0e319cf570e3f0e94b9867a6fb571aff
- SHA512 ce1a324dc3d0f24b9ad8420aad83af58fca2b63d5c7527ca982fc7fa8574b952779c609e59aa153e10047d7d1a9d8b9cd8eb62e1de0256547a376109c268a8d5
- SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fku+4ZAgayjhwbmY3MaReFeDvSP3b:WNc/zEOVHFZ+tgauhwbR3P8wT8
- TLSH T1A8858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 6ec63d459ce25ff0649f42ce87e5b4c7d89acbf93360869c80410ab0ad31d1aa
- MD5 6874c58a667052aba481b271ad3ce62c
- SHA1 7f1508a0ae052d87b2cd4f394dd427d6b935f194
- SHA512 410b642dfcf8db3c2af2fa146dd35d5eba7db8a47938f87380a8c40dacce930eeb3debcad4ed2263a4808221148cf6a8c6ccd6ade3ed7256282f28593349b26b
- SSDEEP 24576:lD3FHshBIYQgAj+4ZAgayjhwbmY3MaReFeDvSP3b:lDVHeBIAAj+tgauhwbR3P8wT8
- TLSH T19095E17DE69C04E4D57BC2BCCA634A02E77138A9032266CB12D491BA5F77EE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 c2a755f63d1fbb2e785602078e0785d7f409f5cf61181b23d47992ce9e03f4f4
- MD5 bd14cb7aad2036b223c6f24ca0d2a482
- SHA1 98cfd062c55edd6161435c27cb975bdef7890867
- SHA512 e424d260f30df121a9fe0b873abf711faa6cc7999e21e5bc5a81a91294de4a00ab7befc35ca969fc47654d2deb9a5401de5f0c65992778038142bc5f933e3890
- SSDEEP 24576:i1DI6z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:i1DI6sOH8VuOJdJqC4If
- TLSH T1D525126C236A21B5D16BC13D86930015E6B2F1B5C7660ADF16E8C6BD4E93EC8B83DF41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 306a460385c5ccb78138cb0b6388140826e66d06add6375c0138d4173db01019
- MD5 baf13bb9232c802ac62970897b750fda
- SHA1 8fae143ad851edabf9adb16223719f1706896547
- SHA512 d185385890e421b2518953612f3738b01153c62c7e6e5339f8cacf7917b8d465411732c40fa3c5507f295f079a13e2b3dbdebd269d418c3a25986344b5acb314
- SSDEEP 24576:3tyK0z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:3tj0sOH8VuOJdJqC4If
- TLSH T17A1523601344B194F67E07389B7781A4AE79FC609B6607DF24E5EB5D2E32BC0E836712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 9099ed9619665e918518e547385c545a2b55f913930a9e010bd34f9bbaa70314
- MD5 f8f665e02c3b9b83ffe9c78bab863873
- SHA1 c7b02476481b5f5d5a238f193ad74cd553177560
- SHA512 f8d7c88c0eb6821302ba501618d79349797c498a3992b5a6c3dee0ea447c1bbfa16603ec8db0321d2125773121c754fa90f82063502691c955254b36f847931a
- SSDEEP 24576:tqz4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:tqsOH8VuOJdJqC4If
- TLSH T1BC0523F41506B324E22E4B75167E91A97889F2F9ABEF0DE734EE9BD80C055C1903BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 a985a386249048a14f7e0f1144be1cf3323558f554d5d350d23b2596ee985275
- MD5 5abf9545cd609c0f4d915c6112547288
- SHA1 74e36b998e516815d27a6a31c0dcc904b69c993e
- SHA512 4dd3895103fd87ea6c41a3447a2807cd9b06c9133db7654323b617bd14069e9e1a500f91a094be9f9fdf872dff6a0f883cbd3639660c737bfec4ac4bff9ed80c
- SSDEEP 24576:nqgt+oTfaidZWz4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:qg5TrZWsOH8VuOJdJqC4If
- TLSH T16365AE2D63EA05CAE2B2D235D9725493D633B4315772C6DF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 2.1MB
- SHA256 0ac3152e955907e7d2a04d4b9128290f4d3f4cb80a64aa11c0b2c99d76c8982d
- MD5 dc43f11b4daf791c9f24416e98573a1c
- SHA1 aa5b17d8001db20ae47d6561bedcf2a91bfaf9ad
- SHA512 684f3ab18ecb54c0d170f794e8e7f9c057cbfdad775966d582a3bde9653664b76697054ec24f2f17e7c169f439a54e25bf6c29f714d7f23a3315d5652df7ddc4
- SSDEEP 49152:Agb4mBIBhGF2+tgauhwbR3P8wT89sOH8VuOJdJqC4If:At8gaPJNOH88OJdJLf
- TLSH T1CCA5D01E22EC02F5E0FAD3B88DAA4417D6B278161732D2DF1151426D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 c696b3167742362fc9a74988ad0cfa1c8402c227a12535f5432f5a42355ad054
- MD5 ce931f52a46696c34fb8174306b2b54a
- SHA1 65aadf558acaee6b08b9938a2ed2d0760ebfc940
- SHA512 da1804f5d0d35759e4bc083979bfbe6eee28c0e47180aa7f16257dcf0a1bd7c9f457bc3a273ef1e8f592ff56482941fa844ce90ec4e819ef4c0ba25da159eb20
- SSDEEP 24576:UTkNvNnaFeYhJNtmZBm/z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:UTMwBtOm/sOH8VuOJdJqC4If
- TLSH T18675C06EBAB846E4D1FEC6B4CD238116FA727461173253CB5290C13E0E279D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 2.6MB
- SHA256 d77026322358d87e8ae3d30953f0b44d5b1b0dda089569fc258d7864c9547a6a
- MD5 4c43d1c8f607d9134231d572a0f6c535
- SHA1 39288ee83a11be8bc464270ea08388ed2c4621dd
- SHA512 3ac1b670d747f9fd120dec96198209c82efee499e1ef73c79a60fb3a2d5c88b29eab084cb81d6ba552791e3f87428e3cf6c0ad77ce9cb40bb428b465ec75b66e
- SSDEEP 49152:iDVHeBIAAj+tgauhwbR3P8wT8IsOH8VuOJdJqC4If:/gaPJOOH88OJdJLf
- TLSH T135C5127DE65C04E4D57BC2BCCB638602E7B178E903225ACB11D492B91F67EE46D3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\TieringEngineService.exe
- Size 1.1MB
- SHA256 48841efb27c2dbc9cd6a1a55616481136f63b40522934e5dfa199c064df9907f
- MD5 e99124cb3f45820b4edb5936aab0912e
- SHA1 ac5bec7778295dcd9a0d37094cef60808cd315f4
- SHA512 87858a33e3f918e158630f3245966e89ca1e88b524a4a4764f440ea32cc491f7b1db700d8f2101fa3e3c4d1fa74b919247ba1d0601a974ec89f9026fe0450572
- SSDEEP 24576:QJnJPbzB4S8z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:QJnJv6S8sOH8VuOJdJqC4If
- TLSH T1AC35F17DD29820E8E4B7C2B4815A1659FF71387D2F2669C729B8D5343F02ED0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 792KB
- SHA256 cb58aa936dbab778a021c1bb253b7ccf8479f095917ec89be20e9a9321bee6c4
- MD5 306067d50f693ab71a0449641aca0b90
- SHA1 436c30a6f62d799eae9c04066054639e1077871f
- SHA512 753f8f83da94c3c3d76d161a3de0b47a1378af302a53d7c9e1dd6701ad736565d1c5ff1d13b5a7334a469fb2bd521d3ca0bdd8942bc0aa2a055b787a86b468f7
- SSDEEP 24576:Fiz4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:FisOH8VuOJdJqC4If
- TLSH T1A30523F0150AF315E26F4B751A7EA0A93D89D699E7DF0EE334AE9BC81C055C5903B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 936KB
- SHA256 7069dd4a642bc6531db92fd6d032b6b2478b42310397a7744971df8abf5cbb9a
- MD5 8184cdaf774aaae1d31b37992c7711bf
- SHA1 6639c7bdb11233a5578fa1f1b7b8b5d113ff0388
- SHA512 18ac057633be4b40527b60d02ca3702e489a1740298d217f199848d4586afab2243d7994f1512eafdfaf4569fd5f6fb98243c3770c1ca8972e27782b543ecd65
- SSDEEP 24576:W6UqjpLz4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:W6UusOH8VuOJdJqC4If
- TLSH T1781522AD128471A4E13E4334997A817955A5F8B617BA09EF31DCDBBD4E32AC0D03FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\vssvc.exe
- Size 2.1MB
- SHA256 325cb0fb53f0bced3f278dcc218b043429d5357f18b2b83c4e324d38232a720d
- MD5 21f835901de41615165603270393fdae
- SHA1 63c7a39f2e384fb937fa51a1fb4f9c49a33d0a6d
- SHA512 a46d426bafa06211dfc54ba21991715503eba0ec7ee21e28d02971e2c61c8bc3d42f8ecb1a3517004f0bbbdbfde3028565cb2da3d178de978a0acd522ea611ec
- SSDEEP 49152:pCLHGeeV5ijCmlDWDkysOH8VuOJdJqC4If:wVOH88OJdJLf
- TLSH T1C3A57C05A7EB5184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32FD0D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 3518c1ee8857389761c6a9efeb3e2b9feced3e23230d65a2e1c095367c05b81a
- MD5 0a6a492bd82a377d95bbfeaea240e221
- SHA1 b4ad3ebdda761e693ce92c7f15f460c1427d111b
- SHA512 c1a2307a0b1a91cb63e819862110160dbe29eb04b1db6970f4adc8c003f4b784e23b98bd1d00729ebcde0a66d6c1ee7c1085e57c67fb1c2d769168857ab3c551
- SSDEEP 24576:brcmR9z4wExMXH8j7b3ZpgQJxJdb1xJq6h4IWXPEP:XcmR9sOH8VuOJdJqC4If
- TLSH T13625126EB26E10A5E2BBC23C89864159FAB3B070635217DF01E5C7BD0E179D9BC39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\wbengine.exe
- Size 2.2MB
- SHA256 bf263f88f4f9678a43638e4dd1cc4344ab417901e90033cb3d368d0616d03d3b
- MD5 4175a44b06e94011f3a2cb1b4f84a84e
- SHA1 e6a81d389b1bc91f6f4c2b32c576f209f3ea53d7
- SHA512 54b606763be6ccd96207c8bb4e2bdb3721610c2eff8a6a1cb65a64550f3b33f5b92fc2459677d1d64fc34448a37112c8993bc5fc75a9a9053a1513509383af26
- SSDEEP 49152:uDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3AsOH8VuOJdJqC4If:v3Upow8sB2OH88OJdJLf
- TLSH T184B59D3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C5B8BF1BDF19A39F15
- MD5 SHA1 SHA512 SSDEEP TLSH