127033186d3202700739bc210aedc45e5249be50155286547a5dc9b9d5f38728

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 9.0MB
Sample261024-bxjmxae12t
SHA256 127033186d3202700739bc210aedc45e5249be50155286547a5dc9b9d5f38728
MD5 a8252f08fdc5e5fbad297dfa741301c9
SHA1 44d83dbf473aa7ac7f48afb4720397f7e94a1127
SHA512 4bb3a91330bd7c57fbaaf9a64ba10f71f26a4c671c3b6e1bc18e3767f87eaec1922e9f9c7a4527ebc97ad5888dfc76788be763c950b6e5e1ae37b27b03810b27
SSDEEP 98304:IJ5o2kdAsIuYKrOeIkQNUPm7DkiCp0G2EY9NfbZh81jAa0rUAMIucjcCqk8Lm:SipdA3uhjQB7Dks+Afv8xxKlTKL
TLSH
T16496E061B643C172D9C201F15929EBBA893CAD355B2504C7F3D07F69B9322C22A37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4344	elevation_service.exe
3508	elevation_service.exe
3264	maintenanceservice.exe
4252	OSE.EXE
4840	PerceptionSimulationService.exe
236	perfhost.exe
4108	ReFsDedupSvc.exe
5880	SensorDataService.exe
5200	ssh-agent.exe
4816	AgentService.exe
668	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\48b85e8df1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000668540b15763dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026759a705763dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf88726e5763dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4816	AgentService.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: 33	668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	668	SearchIndexer.exe
Token: SeDebugPrivilege	5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4344	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5552	2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 4708	668	SearchIndexer.exe	101
PID 668 wrote to memory of 4896	668	SearchIndexer.exe	102
PID 668 wrote to memory of 4272	668	SearchIndexer.exe	103
PID 668 wrote to memory of 2564	668	SearchIndexer.exe	104
PID 668 wrote to memory of 4900	668	SearchIndexer.exe	106
PID 668 wrote to memory of 4604	668	SearchIndexer.exe	107
PID 668 wrote to memory of 4976	668	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8252f08fdc5e5fbad297dfa741301c9_akira_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3264

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2860 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c0e48570ea6a3ff47fcf31256b5bdf9a0c248a4a582a5b6060b9c9488c610799
MD5 2ee9602236d5c6314c05cb9974e009d6
SHA1 957f1548953e07a9255b0c37156e3a79b114345a
SHA512 d29156fea35289375215fb798d887aae0366f00ceaa3853ebdbccde38bcc75dd17232d861119fe3a610170f02eaefda4995c2b153a6d51ed2aead584cee830c9
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJQ/lFTjN4:03q6HjBNLm
TLSH
T1DFD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ff754494c5bfd703eee7828c58853240c59a4a00acc9a2a488db07ad58880bba
MD5 6462ccbfddc64459c3d67f3e09e51153
SHA1 40636af4c7c55800fe669648ab346d348b3c9e37
SHA512 a6337f302bff0d4078d832d3923fca7c8139fd8a4f7bd57346be57f0e720c4c3a166c1383394d0e1137fc9afb9c7f388528b81f80d41e7d307be062c29b7431c
SSDEEP 12288:e1XLsswWkxy2lRq2czAGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:sXYfDtczAmnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1EC65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 88891356652a056ba1e71ab88b80a872a6d87087415dc3f78dee3b9856eb83e7
MD5 297c8b8b1d4c7b7b9de7a0ebac5d9298
SHA1 d1729f55806f5842e393614d991cd9ec2d85993c
SHA512 953921ea947269384463cc0bf015ab741320aab1f4bab2897d3995fff8ced56623ee4e91808c8e1be86ea77ec3d5c02bf29f01f33639cfef0e792b4c6d12ae98
SSDEEP 24576:p0Le5ji0hmxLrMhnQ/tbw/2Mkjy6Fr7g0oM:pPji0AlYQ/lFTjN4
TLSH
T1BC859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 38fb6a884d845cfa9a5c55208562c301007eb93ef1ea677846528621eb4fb53d
MD5 c5cf15383bb27e27da45c05da20542ad
SHA1 d082de4f3662df8861bac0bdcdf40abd99774ebd
SHA512 a3b680a076a47c56c7cb36a0cdefa32762974aa310f64e9c013fc32ab6569a4015a7c4a50b050229101f29232274c310d494631e955e5b7e4ee2d51dbf7a0485
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0ol:5/ezSC6vUzPvxHjysQ/lFTjN4
TLSH
T1CB755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20b2bbfbeed9c54c401540908e17072895e0b0bc67ccf23686917c7b874f88e5
MD5 f4e7b677d82303d4a5d5d63d219cae98
SHA1 26c77d9bfa521b808117cb1717fcd16a4f610319
SHA512 6205e1bc532ebaf526d5c865a4e2a755a93f94396ebd497d618153576a8cab6b42509e59376aeba238617396586d7482a83d11428c9eba573ca3f8639eec7d7e
SSDEEP 24576:3VbqPb88hv/l+6SnQ/tbw/2Mkjy6Fr7g0og:3VO88hXl+VQ/lFTjN4
TLSH
T1FC559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2bf3c7b41687c25f0df38971af076e3b55a714321f707f0deb7b975f8ddef31a
MD5 be47551053cdbd58e3d301c618cbcb6a
SHA1 481d719e37abcc7ace248632c29843f1bda300cd
SHA512 6dbe3116908b7ca033cd60acd3245cb0b7b2c2dacd53d0e6631c6ff7f61c91b583c469a0e1a719daba76effd45c5e057aa1bb5b933453b4d5cc5745c62b60103
SSDEEP 12288:/zdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:/z9nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1015523696A24F897FF2B06B15CC384826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 519765b29b9952f5fabea62668d0a7da29052392fcdd6f49a5a0636367850a8b
MD5 f180496ae879c6e08ad883db5bd8eca0
SHA1 2bd64812840558b5cc4f765bb6dfa1fddb59437e
SHA512 02e5fdf66be4a86357a8dbd09418de55d9d34d1d373d1bd3d3cf1f827b670c4f7f0ea7ca8242c425e36ad3dcb69967d949cfe03d3a119231769d582413e69076
SSDEEP 12288:jeBNUbTVO86UKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:jJIUKnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T12E75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 62d3ca7abaf9c8b8ac0b4f05b7a74db3e0690b03ab4a931bbd08ec234ed8e9e9
MD5 5a3935916a0334d6588c64584eae703b
SHA1 19d32df449fa963b2df6e42c4c75454c17c6a9e6
SHA512 01ce03b485d02be036a011e1745e108e86c9ba2c4158d3ab8aadb9528ce2ae40769cf0c5e1b0ef64a61630305c49725939e568c7210f8f4357739315de712ab3
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH:kQvGAdlCEL8c/yRNw5C8Lm
TLSH
T1F0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 17e4d50be116f55a7b19f2eda1fefa0a833a50d8e49bfecdfb09e0850a34a82a
MD5 f1581d51948a013a9b22407de950ed8e
SHA1 3028c20f44d7e28c28d289453d88fbbb198dcda5
SHA512 a38b02b61d7ecf7bcea54aec0cd84b6cf88bd7f2896df62917ff20591db5e7d9f12d4d97338f37dda97130dd0b014d0b37eaa79d00e5fc03d5908055c8f21736
SSDEEP 12288:IAwSfxL/2Dc39DLLmt0LDQewsAjoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgk:tQewsAjonQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10B75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9ebf361b9e1cf2113a67e64cf374349f107b875820abe8345f4868e385bef408
MD5 50a8dc7fd2006352eb28be8da4216f19
SHA1 3c2fa2e09b03c320fb78ba3d5bf6a3c0d802b6f8
SHA512 6658b31fc3ddee8f4ca306b9b8d52da197b0a08ead2fd670a67cbbc900f0c1c6bef79503ef7d374f95f1f7db8a28404a23be69d61fe5519719266ed1e932f8e4
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDL:zUEtQevvqc2W1cpV2EI32
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ebea0a783f14fc1cbd94e184192c0323d99b5ba1e0c9f50cbe224ecc534baf9
MD5 61803638a0384af498c2c74fc28d6098
SHA1 f60ffe068b2c27cae6261d3dd41de0ebc74d3fd5
SHA512 17342acde5c278861e942551d45740eb15c29e7d381d75b8856744af65114bbdb50076c38ec35c0f6877faa26a19531fd09e1660b3ba2499e826c1530d5d369f
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zIQ/lFTjN4:WoqtVjnmALm
TLSH
T11BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 071cb26bcbb8b92421aa2125697bceb9bc7716513f8864320868434039b017fd
MD5 d9fec41049f090306cc9f1e323d98be5
SHA1 f117939c0eb75d46aa15943264016e651399e03d
SHA512 cab70060b54abbd646e0ec0dfb962b4bcfd61f32b1e9f45bfd29d16db34f2554aa2ecefbf081f0ebe3c72cc75c8c38ad0a4f33f4fa4a2d9bec8ff9e001fc5c72
SSDEEP 24576:iAhGLJIFoiwtA5l7S53rnQ/tbw/2Mkjy6Fr7g0om:iAMyFoiq5bQ/lFTjN4
TLSH
T1E635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7683396a186ff8b9f34b5b54d84c5596c8e1ce184f3af946b06c481bb5ebeb25
MD5 38a046d95d498970226c956de86b0cc1
SHA1 2ba631d8824247b656da319d05e0a578681ea3a8
SHA512 f4b5d270e1582f9c636f5920783cd936c730b9dbb7ed5ca7981b2e8b3ff82f1f50eb318ec39aa7b883bd5075d62dd9f5eebffd1ff2b698bed1c0491c2e59cf54
SSDEEP 12288:smw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMU:JwuHOWMnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T12365F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f449cc5f11b183a8634369289bffc4be2bb1f5c5299244c8f7f9a52cdb4eb5cc
MD5 40f7355985d741be5e778b7b2db24c80
SHA1 417803cd517d168ce72aba556bdd3fcf04689085
SHA512 c7a95bd4c26e082f79468d6987865ec8f2ca56bd95b96c8823db49be75c767d2f86510cfa5e2152d1776da294a0e391b6c758c6511e530a7e863f5cff52ed1a8
SSDEEP 12288:SXZ1Iy4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:qZuZnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A755126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e52c21023d815c09d8cc19441e1bd7e6b141ce7a17c84012e4c5cbc54a43d61a
MD5 17e35f9b93c8929ab6afd042665dadb8
SHA1 9e97529e1522911b7fc50f1ac1507222bb547461
SHA512 36d102251d3c8b30a1f16f30049b9e6e6ff5d8bc69221674fdfdf6f8de65dcf4a3603e3b49e9822cd845a67ea28b9fe2b4f982e4be97c7869e12b8dd9e9ae910
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:cQRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T1FF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0dcd26e5efb88afe9f60ecd773a80d9e5d0abc9b7833a4b29a0173ca20ef573e
MD5 776e8f6fd5902dcbdfe4ea7ef510e771
SHA1 f69cabd1ab089bf40ef43f20236570ccb3a0c9c2
SHA512 8e69fc3f16a482057805ce982be1a5af705b340aef2f1a8df71d169af4981cc605eb5aa429a45f6d9cdb799c61f7af31337b8214efc283a07b2734844f8ec6f4
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:lQRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T1AB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4bfaffec53ac7160474ca98c988382f4afa6f323fdd35444962380b74db6fda
MD5 efba43aba84e1005e9e1390f9280c3d0
SHA1 33fad55c0ba88b0ed96107ee4b6225fd77e06a9c
SHA512 3b52c21f1778ef65dacfcf42b633a7d0adbbbfbb25e289831f774d61f1f62010c7bdc2c0c7f07f74422bf217db65c44ef448ea955a241e879db6f03215da1e2c
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0JnQ/tbw/2Mkjy6j:h68Qg55nhheWu7PNU3/YQ/lFTjN4
TLSH
T1AAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0e3c864fa0b2eea54de958a8ba78e8149eabfd929fe92b5a4f44a6ab75754371
MD5 5ab42f0a924dfdbe0fe07278396e8cdb
SHA1 9ccf10ff9415e68f9677f5f0a63a60437e8807bf
SHA512 77dc5ae8f718f934a45d11b9dfe52ac7c853f8fad3026ec8b972a8024555e1140826f76b0a9d18427ac0103e33d3c54e5b81730043e7a02694375e91b6880c2a
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:gy5112gYy5azzVvL69nLKnhZyLm
TLSH
T132167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7f5d671d4b71ac1a13b145cfeace6944cd376f54c9d81f1e7b9791856c72b4ec
MD5 a2f8bc7aaa9bdf11b629d14c5009c951
SHA1 56b6d9f52b5188bc7bcd534fdce50eb0c78686b8
SHA512 85ddedbad8f68dc2ae7250c56649e8f32e08f032786c14b751777233c6ef6b58c9e26ace64818f88ba4539b99a80da3934b22c206a06af0cb64702fe50799368
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWQ/lFTjN4:cu6JmVxd2dhLm
TLSH
T172D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c060de5f9093a8634cff74f51e186396a253ad331d0fe6ec687f74135215691f
MD5 b6abbdb55359f67fec0b6093ef41f9ba
SHA1 7d4c9cf64c13871ed2f78244bc788614d13860d4
SHA512 a1ec90cbdcb092781668e7238273e5aaf8517834352b6caf9d76e836a55f37212ba229b78c9d907662686a1eb4a2e94c7544821d9907884206ba45119e5bc843
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4xqQ/lFTjN4:UmifPbRALm
TLSH
T14BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e41bee1e75856813582d92df33b64de3b599db6d3d119dc57557f6a4ea5250b5
MD5 c3e9a63d1389b7c7c6bab3f937d7a1f2
SHA1 928cc3148ff3e80d7acf917803494c23bf18cd93
SHA512 7beec54cf9d8fbade7807cad94050cbb8f2a3bd666d4e012cbe2b276072ae5a610a2e711af7aeb8b9dcb844c70cb6547ee1b1af377a5f5fe457ce037238927fc
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqZQ/lFTjN4:x5dKTi61OLm
TLSH
T1F8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f2cb29a22c6daee75df976b59f12061834d3d79055ede6a69adbee6e037cdc2
MD5 5b8d6d9994a5268f8dac05cf5c48c695
SHA1 5efbbeb6ccb84151ccf570d2992b6cb16de40280
SHA512 972774a86be9a443d2f2f472309cdda5017bd0a36e452c145c07e5b9eae56069e4149958afede35cfb5d40d857364071ce0f2f4b9f78c9bc372c5cf56b28ccf2
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wmQ/lFTjN4:nX2iyph0Lm
TLSH
T11295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e3f731bd89581b09c9b61c41bd61d474ff44b1da2c7f07e8369a2fd3b421cfa1
MD5 eed205c933e36d3c2c3075ba4d02de0a
SHA1 89c1df2f65b026cd183b9590a88a3bb1af946704
SHA512 a4c4d3d7ec056aa57c124e22358773fb642ad93131544594f1c8ff9288b4e00dec879f8d234dfe1af06427898efeabe6592d233277136037c685fe0534862432
SSDEEP 12288:B1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:BVnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1395523697964F98BFA1706F14C828182AB3F0EC6BFD1938F77482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2048e0a727e13f5510e6169493a7797fcbe262373e6c4cc7fa824776cb7b0c1b
MD5 98d37bf9f412331231db430bfa48908b
SHA1 b8545b4b00ab191225eece855cb21db26eb517c1
SHA512 71fca94a40c1d72657cdb12de5b412baded5b8cdf28c435e497790eb8b62bf3d383ce0e91854b2ea955f5661928b53fd9fa8ee98e55fa54634cfe8cf063d1fb9
SSDEEP 12288:w0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:wUnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17F5523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9e5eab692df492abf41725cc46d1fd48688eb6ed2603f789417c6ab368727498
MD5 d9152fd85c3747a4cc02739194785e28
SHA1 142c03c0ae55772eafe3b2cf9f2842993a108996
SHA512 8a17c74b57f4836c8bcc36b72b145ccf240e9d1a6ca828337541ed03a2017e23e806d1d7a1dae2ee31c2f61cb33bb3a84ad45cefb51fd19531c768c7e0f92860
SSDEEP 12288:HCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:HCnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T15C5523697965F98BFA1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9f2910209d9cec0398cb6e5d854955293267c0dc1ef01e2380c3dcaaf4e9899a
MD5 c8f8b98a557a0c11862dafd0d80695fa
SHA1 f10cb41dafebef907482721bc5802dbe827783e8
SHA512 47364caf57d12e6407106b903d2cf840ccf3619517c47c7acf0c6427c257ac4f1d4e473582fe4496e68851fbd0d634748015fa2cbd151e4c634d954291651578
SSDEEP 12288:yVbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:MnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18C5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 04e758352da23db4b33c6875dd03d8b011408708d1a298012e596ed979a6894f
MD5 28d34c7a3a8d9156a946658627468733
SHA1 933eb1bd1dc57073cef56f3335d4fd51dd9008a3
SHA512 231e4ae3e52213e1f2dcb831360a9b69fb7e5b626e9b65ba220b2be71ecb595e8f46588d7ca0fcfe3fb9870cf2dfe8178e0efe72425141000d341f29cf7e6c1e
SSDEEP 12288:gjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:gTnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1015523697925F98BFA1706F14C838182AB3B0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2a59cfcb1b1f06ac9bae2984bb75f9781eb9bce077a0b0aed1145cde3fc6a71f
MD5 3fb5944ce8baf4d9a67ed90c2692bbc2
SHA1 a441e739156f766002f14c51d456c15d6737b75a
SHA512 c40a8dba049209fd41e838b4dbc95e312b6ec55f680be51821839b5fd1bd9b5b48dabb9cc95f0965e869aaffe73f31c7324464fbca7befaf9d07386a3fdaa4ad
SSDEEP 12288:IgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:IAnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11E5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 25a8aac0df7cc875d0b4710e7d7612b3daca94c38358a9b43fca009cd24c9e7b
MD5 a3c202bb6d6530f388c5f60aaf5cb2f2
SHA1 0d7f31263620831d52f6e871aafe54810f1df4ab
SHA512 8b512279b9087620c30b17cddc95aaa3bec85d398365af9e3b4096a0eb67003d06ef5eb73be6229f8319ef6979134e96a70124e6cd7c63cfd40aac3a9e765f8f
SSDEEP 12288:W8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:W8nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1275523697924F98BFB2706F14C8281869B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3d616bdeb28de84aeacba7e40e02a61d4f387bd923afc03f587d102fb14f56d9
MD5 c9136a837a3639244a6a12ca1bf72866
SHA1 39ede7b02aa2db57673fd16c4604a26a1540638a
SHA512 20c562b3751ae400df0601b1e3ff632fcea787785a58d28729d6e8960b23a318cd8a148a685f51d11e516e4a36dcaa69396b30ec33eee993b06c85ff227d8251
SSDEEP 12288:ZiZwbDzzFEoS2cPvyUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:cZM3zFVSO0nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T16D7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8eee5b3ff66f80291ff279484864bd9aeccb7a3d5629a4e5fbab676087cc0cb6
MD5 f66e357473590051ac2d30bf9b22f35b
SHA1 88f6446b90124937612e6da1511d7475d7b78434
SHA512 86c1a6a408a746e736ecf3a2d57853308d7c8c7cab98f178b9a1e7447fc3b117d9baf6c9124a8cc5d9849f8047f01e82a1c5f6086a33b398fd66b42206d3d416
SSDEEP 12288:RZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:RpnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1735523697964F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b11db3e8db73e5b091e41491f8eed3687065df20a0ae380bf11dfa619b2dc83f
MD5 fd9ce0533b2b9fa83195ca093f8d1538
SHA1 93856ccfe2b00bae555a5e6efe4b586a5a358174
SHA512 25e51741eff6e9b9e0e180f3f043ee83bceb668abec679374a587e4de1e72963b693a4b1dee2162bc6a997c9f5be173b4cfd2599b907f57094062f592ecbd2e2
SSDEEP 12288:ttGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:tNnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1375523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 61967cbddd211ba161deb1155c7cfd9476849e8572382c4836da0199e0d74ed5
MD5 64709f6961a91b932634f9ae2fce367d
SHA1 4449dd43ef5f0f34b449a811396853ddfb67f932
SHA512 ac057cf473806bed9b2a983d50d94bf01bf50f7be15cda8d404303302ccd40be7dfb754a12946da077a41cb80147dc4b24ee967f843db6238df3e77ef34c2f0c
SSDEEP 12288:LyPz5L84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:mzy4nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T18965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 86f83b28c0952012b164c0fd596620c2541db8505612c9cd1a520095362b00d8
MD5 202409970989d8489893f38e841b88c2
SHA1 9033243316a12fcbdd3d90ccf4f7f6eaa18dcc17
SHA512 e92345e3f84fbd8a7190133de2e45640bc96c66d86b519fc67f26285ab57c9ccc921ebe4e8936f94263db428796a89cdfff9b8c439bf67c0cd1b2cec7cc34eb1
SSDEEP 12288:jZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:jpnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1A25523697924F98BFA1706F14C8381869B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 39043cce7d1f68f2d3bab3218c88cf9357b85bec801927b24f0b910fa66543da
MD5 cfa6ff3e2e5e5c9c702b5ba92cb9fafd
SHA1 08ccc7cc39af75652e4249f39197a2fac33b2436
SHA512 ad438c21c80828ea23fc91f1322b828f7139dc06a64df1fd8d0e5ab2f732a256ba7266a3ff0c9e58c26964c62e444bb8a23cc88474806a7195d98d8b50917b51
SSDEEP 12288:+ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:+pnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1215523697964F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d2dc6ec53566a1acd3c8a3b8a0bc6ab80ee6b57b4ffacdcbada63265ab7f4f35
MD5 00af7331c5c4e84d1f9598e45a4f8571
SHA1 66d687acec157acbefd5e94826c223cb84e90989
SHA512 bb2f4fd074e6b9a5b9e276218a7ce87cb529baee1f327b8be4728ba97a7a09f3eab4e2eec11289c4d3aaf00b05d73e43cdfbeaa3ade9f9df5e94e0784bd0d36e
SSDEEP 12288:QyPz5L84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:hzy4nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T10465021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 923c3b23acbee1ccfe0c7a357a6795f6f58f558de7b62b689eb90d71fa3658cb
MD5 366a09680af73266adacfc0c5296f94c
SHA1 97785873f13bb6faf39cc07a05e91cd0532ba882
SHA512 494c985f83ca09c218b4d2ea38d51fd8e267c49bf9461b7f1e67836dee497cbb8d99cd4df22d360ec51789692d94ad2d593a7c33759128e85be7493028bcaf46
SSDEEP 24576:xT0aLl3z0zDynQ/tbw/2Mkjy6Fr7g0ol:xTDLljHQ/lFTjN4
TLSH
T1587501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 cdf429852df11a5ed4ba6a5657c4efabe5f8ecc3e420ab7b35cb65912de700cf
MD5 528bc5ea62faee9ac57450a4cc679aa7
SHA1 b8261e82e713836a0b25d4d0ba1d199f0eba1896
SHA512 639b0e8a2319930430c276eb840b4bd54fa686668166a71acb90ea0577f6e70074e8782d5f43422aaba210ad05b9cef64714fc51dd58989e9985cd27d3e84e19
SSDEEP 24576:Q31d9CHKy7GZ+nQ/tbw/2Mkjy6Fr7g0oc:a1d9CHKyaQQ/lFTjN4
TLSH
T1B185CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 51853e0dd2e33f6e6dc36f8eebbbead37866f3c1dad8b3e45e2b2ee2c1973072
MD5 9bed16430a785d2f792c8e3acf8c4c38
SHA1 0c01aa52634e535b12587f171b0a6b82f0e314a0
SHA512 03a72f68be407aab19473dcf5d0b7b0211643a405af637c371c4f569a1a422d52de85e5bed33496a0875b9d7a1d762441a21245215a80370fe45436fc59ebea9
SSDEEP 12288:niGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ninQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1515523697965F98BFA1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 98198e0c4c45df251c9203b0b9ae49f544840efb0ac3f527d807ec8d8601c9c6
MD5 af74537c8dea8d6c27a9643f87bc1377
SHA1 29acd9b25df3cb37ed3d7ff2454c128b542a6325
SHA512 593dc315117a56046be7f290a7e5e21e32a3af2c6936788bb999725303db1be0dff59c9c736104a7d37d6426b8333bdc028749d5b076a2e2a6e7fa7b163c9ae7
SSDEEP 12288:BYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:BYnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1195523787964F99BFA1B06F14C838182AB3B0EC6BFD1938F7B481129967D39406D6384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fc1421121316a8c9a1af42e9998a94714bf2a9f2d33290efde61fe5e65483892
MD5 6de510e4762bba46ced5755930040e76
SHA1 ca6896bb16ea621ec92a52efb8a0707bbb122544
SHA512 83df7b0a41eafba3d477d64709f0ad357d24ceef6bfcd09a2ff45cc046a2208482d55c3af1b8ac0358f272a7b1e58b81c734f6c68c1f9167bd311704b41b1320
SSDEEP 12288:IvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:IPnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1415523697924F88BFA1706F54C8381869B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 39ebf167b2726e7004cb3a9181c78e883bc59711b5de65ef345200b877b4a008
MD5 b5ffe2d25027c4a4a8ba5de41806b3fd
SHA1 b83e6f1b967d46ec714e46e1625028734502798c
SHA512 be587f8eedb6e7cf9454e21e5bcaacf136102cb5e464013ca5722daff8db296e0f1b4501afa5e0babdee14473bfc7b4d764407ab280bd001c98e755e6306a13a
SSDEEP 12288:0ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:0pnQ/tbw/2Mkjy6Fr7g0of
TLSH
T17D5523697924F98BFA1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c2af09a2a0d7c89356062f3059fbbeccee1aff79544011c7801a11a36f2f87fa
MD5 cda1364d274fc630ef93920c0f1af945
SHA1 aff60d48a0f7b052db2a238a1708c2c5dea98739
SHA512 902c42994d1ff0f0ebb3c0c046552f31585a6b32372a83e53b3e499bfb460507ba38e24a1f3e072486ab033aeb3262695cb14bef5cf14724b30ece60ef02c6ff
SSDEEP 12288:UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:UinQ/tbw/2Mkjy6Fr7g0oj
TLSH
T10B5523697925F98BFA1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 893dc6709fa3123d9c05f51e90c51d59be1f325c2f47a0099841a64aee31b0d8
MD5 8727c355b802b2eebc9962f212fde0ce
SHA1 96e138e678a89ff1f0529afabb3939bbae601d73
SHA512 8392a34dab445e6550e9e561184802426492425086f7d192398385e8cfe1ea99cc2b893c230d0f21364ed1ab71b807ffa9c0f5a477b9df0dd8ddb82837c3153e
SSDEEP 12288:EBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:ERnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1465523697964F98BFA1706F14C8381829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a265b90bbbe5022aa126f70b51637752bb708f75c3b8e2c393ba59b71dfa2893
MD5 7c2c3e69737b773caeed64acad24c113
SHA1 002df4afb004ba27251a7f1d7b383d5afc46e3ac
SHA512 6e2d1e7da44d92f0b5c93ae4bbcbe55a7524a8cfeb069a323899b77b06544e6c6a3eb1475cfb56b3c171c0bcdfe3df3824159a6dfd0f30778cf14988547c7a1f
SSDEEP 24576:Afwv/k9RX6wkyAIdnQ/tbw/2Mkjy6Fr7g0ot:fMnYIdQ/lFTjN4
TLSH
T14285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a3d8218c234bfc29404f43b79da0dde8224e52a1b6f0baa5d871331fa969d8bf
MD5 a1887c108bba28db49772ccc667e0225
SHA1 5207f2ce730c28ff374970cce668b02b6412c188
SHA512 1c634897c6d8a9c5ff26c90187610e33234c1df17076c8da790fba6742a8c124ce1ad90b9139702b26755bd54a0a294e0f9fc1d82a5da7140fd3facaadfd01a9
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GQ/lFTjN4:lySzPZLm
TLSH
T1B6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a0842ae14ebe49583dc0a5dcaf716b485ec45d86717bd37ae578e9dbb6b5a995
MD5 ece01a42706a04ea0b4ebe25115a07ae
SHA1 7c65925dd43685c48643952709ecc4ccaf9844bb
SHA512 7451e641a9cbd4a78f5f14e3170b7a2c45eba79af2eef15e0f25ad42b0a2e86787b1ec22ccf67abae7112d14cd678244de7e7c8ae377f7181c78f445f047b802
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYEnQ/tbw/2Mkjy6Fr7g0oj:z47JUQj1irIhCnDHUPfF/WQ/lFTjN4
TLSH
T1FC65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 571bd60991a18e4b8ed2b293a82c2f62d5a038f687d52a96f86c156f4423805a
MD5 d617ce12654e22699ba2e460d72f4fe4
SHA1 299d93b9780f9bcdeb82e0773d181eb7b7ed6658
SHA512 ed723f3430dbb203934b021e309e3eefe53929d55d0db42ec3123d33c1106418a8cb5f1ec57acf53d4275b49c18d18ae8e18e323dbe334c3a5c1906f3ce235f7
SSDEEP 12288:nssfJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:rZnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T19F65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fdfeaf3881c1e6acf96fed8e1c689b1151659281c7a3a0894601ae49615fa2ce
MD5 e3c990bcf85dc5cc4d7af15e78071472
SHA1 61e771766826764c9dda1396f277180f53ad89ee
SHA512 f3204c1ac06ade1f95c9a28a31a21c6482a29e46543d1d743339433df5a0f597033084fdbe5ea39a60b33389dcba57019ed53f12ede70802b06d85dd68c3a900
SSDEEP 12288:/ZowuJvMU3f1ZHYQpFGk9LAos958QgeaRM6398oRy0rc:/ZorJkUPzFbA5z8QgeaRM6t8cy0rc
TLSH
T1834529007626DB8BC6A940321E36D6CCA770BD06FE459F1772C9873FC576658BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 79772bcea5bc0d15fd38de8187d25e204aab5fd5371e16a386c58a4a45f65067
MD5 e086dbda04c2ae1865b946f75a5084da
SHA1 d1be829a0d3f59771430e35e5041e30af07ba496
SHA512 067eca248e3ef71b9eee3b127e957d34121cadd8683dd88400909c488793424332ce9f102cc143b9e7be5e45ce4aeec479e65a8dc7ac48b62d15f2713beb4c23
SSDEEP 3:OlH/laBX497G/l4hgV7//lBl3yjJ/llS3mCllltGlslslslslslsl61+LRX:KIBg7C4hgV7ROjlEmCtEEEEEEEZ
TLSH
T17D8192904B002671D9B369740225AB048361E0022EE697DB268014639C406CCCC21B28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e7d16da161e1f535eb82386ceb7bacd01eccb8a7c9880fc863c49fa5a1b35e1b
MD5 5533f2e09a2c063e36be9dd8275dcacf
SHA1 8fcfc56d55593c626525de81e084d1bc4cdd68d1
SHA512 8b39eddb9cf4c016f9681201d440679e8665017477ad6a14291730b6b62eba98809fe8956aadee86e7add9ba3e4e9c0672844348b7a617332170a5f6fd5c5c56
SSDEEP 12288:o1T++QxWBMw4Z+vs5eKpYTJ0uY4uo7EsK9LqGLR+55ObNsGVQi24:o1T2w4ZlpYTXjBQt7Y55sekQi24
TLSH
T1A2651A415577EB4FC8BE803703329A8DAB749C0AB7892F056389C939C87795DB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\Temp\c924a23c-17a3-453c-82f4-55b49f59c4cc\sciter.dll
Size 6.6MB
SHA256 4ab5ec0a963da4fd1f88d0b9d2871fdc5890b277cfcb122889e46c0ce5831869
MD5 f472455593df1dc109cc29aea76a10fc
SHA1 9ba216f825b6e190d992da4c8893645b04b24cb7
SHA512 80078369c0b6ec6efd3013acc1f53a310ee70f0d5a8d2efd4fa27abc28d55172b7401c78b11ebf46f5b9d13eec4ee57d6833f66cd8d791e106ab3f7cbceada12
SSDEEP 98304:orEyG1dejlANJUNrmf6tATeQaazZaTSG2TeXeMDQp33/TzBrqNn:hERYJU0kATeQaazZaT72TeOM47zBrqN
TLSH
T15466AE327691C47DC02E0270794DF7AEC2FAEEB00AB1429B6BE43E5D6E345D06729572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d980e4babfc434ec8af7e95ddff87670a05a3d552bd3be5fd21849f5673f8848
MD5 9d7bf1e8e73fd3ec0dc6fbdc4ce18524
SHA1 8c1b661d9737b7ddb9b683162a3ccfae58775644
SHA512 eb23f62a3517b1ba8b764e5096cec82815e7c732a3aee36283f5b5f72f24947be7a27bb95d6ca9798ae1b3b5690510e0e3a43132c2082075881314c199843b99
SSDEEP 12288:o67xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:DBnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T18C5523696668F94BFA3B06B048938111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1784f0cb605f3f717758746480d2714321cfb3d37a3c213c0c9e50e52dd96172
MD5 0b2814cf2bcc1d11bd3fb29c9b22b8bf
SHA1 a20010a73913cca72b65f76542e2ff18924671d1
SHA512 c69e324967bb8585a83f3bb011d9915e858658d947bd651bda4a5411ca6b8106b58565422a69f9e62e52179b92ca4df6acd29a9fb2da5bbb724f032eac35bf73
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYHnQ/tbw/2Mkjy6Fr7g0oq:Ygb4mBIBhGFEQ/lFTjN4
TLSH
T13B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f985165517d8ec9e50346c3697bfe8e989fb7dc7a8e3fc245518ea80b3f89e22
MD5 6153792216bb1f2ba562d0fd1a20ab80
SHA1 bee0674494dbb0df9dea9f663cbf45d34e288b70
SHA512 8226efa806e1b1d8a25991d3ea765a846106300e8346beb2fa13261398fc7ed532a9c8569fbe8cc701ea6f27bb010dff41b197f04ba9794c03a82d938d07b627
SSDEEP 24576:eG88u8FpJqH1Qzria7/m0nQ/tbw/2Mkjy6Fr7g0oL:17ZFPqVva7/vQ/lFTjN4
TLSH
T18385F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4593615e9ae93d113f86c676cf00add656c044c5e5b1e5bc347bc5b4076660bb
MD5 c8a10f70e14e80991c52a4a97107c572
SHA1 828dbd0f705769a5970da41bc1a68b6a4e5b5a74
SHA512 312a42ab94ab325eb971a7ec9a2d8a763fd844dd6a7215b771e4313b2a05eb6a489c2bb59c008f04d6a7391ed0af159a7cecdabf4503d952c07ea5e1778984c6
SSDEEP 12288:DHvUrBFrEjwaQwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:DPUr+NQQnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10D65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 50cea4f12a81abc9a5c5ca3d5db76ec2e18672a3bac57ecb9aaa9348f90de16e
MD5 e909c4ad06f1f0412a74e5a4e299e78d
SHA1 17468c234d84ea414918f027be3695f061634d19
SHA512 2230ed92a4569feb81ccadaca5d11ea15e8da431212787db6fb10b5f3aa282d189e8faff6e463f15db5a18119700672e3d1a43fe27b7bdb09e9b82344508ff49
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAQ/lFTjN4:LG05lO43bKLm
TLSH
T1FAD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d370ab2534f1c261d7df6a75bdbf0e382dec598812ee7f4f73ecc04d8e8ebc29
MD5 ea7c40c94ed92001aa59c534e404bf73
SHA1 7e4ef12b2d2b68ef48d7e175640a0aa80d658670
SHA512 8137806818c6196e8d5ed3f14623ff8e26e60b5c5407a8c4e0cf5d8f50f94cff84a22d9ba40d0d4d9be4a5ff03e7e9bcfdf7f4f33316535dda0f537198e55696
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnGnQ/tbw/2Mkjy6Fr7g0oC:da5POZ3+Jt2pasx2+mYQ/lFTjN4
TLSH
T1B665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 34bfa3896ac09172b879af28c8d79c57893c18e0b36de9b6d61e8d1a1687aa3f
MD5 13f1238d77b148ed5165f2d079028d95
SHA1 b238b417cd01cbef69f366420ee30ff6f77c7952
SHA512 9ea46bf5f6c71ccad87e2661db52900c15c17cbe03dded0bcf5f2525da01ba442dffb87f6792c60305bb40e41146c715a2345e145984a707fcb6dd4932fb84f8
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FksnQ/tbw/2Mkjy6Fr7g0oJ:JNc/zEOVHFPQ/lFTjN4
TLSH
T13D858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6fc2bc7ca29e0f920823defdb5a0681b85953919a94f4cd2a168c66a6b5d581f
MD5 d6531313d44bda013299e4b6bc6be8d6
SHA1 d3b9b200c92a9c91fe7675e155cb55105a694e3b
SHA512 2f1dd073767f53a4794684e96a6129a725ba9acb73a61716f73e4514ea2c3f9d809d1067b9f88e31d52f06f4ac2853fa370c88798cd56893030210edec18c738
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmanQ/tbw/2Mkjy6Fr7g0o5:Q8MwBtOmaQ/lFTjN4
TLSH
T17755AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 950cfa81869be5942e2f29f5a368bf03b6b15d8a8a79b5548c0639720e45f51f
MD5 1767d4206ff41f5875eb34d454687a00
SHA1 6e7a9d5508d90557c9d9d7858eb91a751a731cdc
SHA512 99649126ea449396482f69bcc89030500f4bcc02efdbca3256784459d8625af5dd84ebd796112161287592846c68feb5a05585346b25ba431b2add4db48d41a4
SSDEEP 24576:zD3FHshBIYQgA1nQ/tbw/2Mkjy6Fr7g0oe:zDVHeBIAA1Q/lFTjN4
TLSH
T1E875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-85-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/236-297-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/236-79-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/236-86-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/668-324-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/668-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/668-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/668-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2564-336-0x0000024AC6280000-0x0000024AC64C8000-memory.dmp

Download

memory/2564-335-0x0000024AC5EF0000-0x0000024AC617B000-memory.dmp

Download

memory/3264-64-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3264-42-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3264-41-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3264-53-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3264-48-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3508-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3508-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3508-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3508-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3508-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4108-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4108-338-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4108-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4108-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4252-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4252-62-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4252-183-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4252-56-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4344-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4344-13-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4344-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4344-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4816-143-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4816-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4816-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4816-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4816-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4840-75-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4840-67-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4840-69-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4840-256-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4976-421-0x000001B17C0A0000-0x000001B17C2CD000-memory.dmp

Download

memory/5200-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5200-116-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5200-323-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5200-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5552-84-0x0000000000400000-0x0000000000D00000-memory.dmp

Download

memory/5552-0-0x0000000002BF0000-0x0000000002C56000-memory.dmp

Download

memory/5552-6-0x0000000002BF0000-0x0000000002C56000-memory.dmp

Download

memory/5552-5-0x0000000000400000-0x0000000000D00000-memory.dmp

Download

memory/5880-321-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5880-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5880-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5880-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download