9548b90d5795a80ddaf1d55a75237fa98d74ddd907a5eca35b6a966515d2af88

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 3.2MB
Sample261102-nf17vasycx
SHA256 9548b90d5795a80ddaf1d55a75237fa98d74ddd907a5eca35b6a966515d2af88
MD5 b28fbddd33d4cdec7b62f898f0eb81ab
SHA1 9bf8d8d2afd4cdea4c9173509886642eebf79ba2
SHA512 f833bb8d6737c722be00f7e931a83fe26ea56abc88de72e644c366a2715e46bb185ee88d52b400c16e30aeb76d6edc9307d2927291a52241d2c05b894caaf8a2
SSDEEP 49152:OCWwF/U+qvdovUBGcabidhfHbDdlh9AMsZ6D5SAY5cTdKVpIZWzLNiXicJFFRGNf:OCWwF/UpeAMR5+KVp37wRGpj3
TLSH
T124F59E31B689CC3ED4226235BC1E7F35597A5BB07B3412E3D78D3A6A16B0BC11936782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3700	elevation_service.exe
4928	elevation_service.exe
5796	maintenanceservice.exe
4644	OSE.EXE
3348	PerceptionSimulationService.exe
2076	perfhost.exe
4696	ReFsDedupSvc.exe
4560	SensorDataService.exe
6076	ssh-agent.exe
4952	AgentService.exe
5552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d50105e1227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6419092bc6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5213a4ebc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084e61d4fbc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007bcc74fbc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6ff834ebc6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c71964fbc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd7e514fbc6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d65b6792bc6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000466d574fbc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd764d4ebc6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}\AppId = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
3700	elevation_service.exe
3700	elevation_service.exe
3700	elevation_service.exe
3700	elevation_service.exe
3700	elevation_service.exe
3700	elevation_service.exe
3700	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4696	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4952	AgentService.exe
Token: 33	5552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5552	SearchIndexer.exe
Token: SeDebugPrivilege	1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	1600	2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	3700	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 5668	5552	SearchIndexer.exe	100
PID 5552 wrote to memory of 3364	5552	SearchIndexer.exe	101
PID 5552 wrote to memory of 2924	5552	SearchIndexer.exe	102
PID 5552 wrote to memory of 6024	5552	SearchIndexer.exe	103
PID 5552 wrote to memory of 3928	5552	SearchIndexer.exe	107
PID 5552 wrote to memory of 4340	5552	SearchIndexer.exe	108
PID 5552 wrote to memory of 3012	5552	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b28fbddd33d4cdec7b62f898f0eb81ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ef561c1d3bdc593aac2b718052314aeb3814dd4a3bc72629cef5e9fbe60cc592
MD5 0ffbbab8a744a2fdacdd74cd7ad1ca8d
SHA1 a1344690310577e8bd9914b333ebb4c1b86d441c
SHA512 910bc9ccb5a29e4a20cd2eabbfa7352701ccd7f8c32f89c18a457fbd002a94f17504e2ba7281cea0e516964f852d115ced969196a2417e4df903ef8bcedb5511
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9LNiXicJFFRGNzj3:13q6HjBW7wRGpj3
TLSH
T156D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 fe345c2f263d2c2126af87f3a1aada75712a040a051184272d3a14626e5a1994
MD5 d99d5567988d0c05df2b5c9f11f65388
SHA1 976305c255cecd6637c954acea06baf88ce36999
SHA512 07ac5b8660861567ac8cabed92316818dd5dc8af2f8b2269b3d0e39dd20a89e6429585aca248b96b7ae8b05c84619bd7b2d16d576d857f02d5c4ffcc76a7be0d
SSDEEP 24576:5XYfDtczAK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8tczLNiXicJFFRGNzj3
TLSH
T10A85012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 4479b803750b06d9f37bfbd9204d8df2c846b9ece466e2fee5a735cadb3882e1
MD5 0547d0985ed62f260a7fb3e7eff990d8
SHA1 45fa54d2c2cfed8ae9dbd0fba8a7c6d801198008
SHA512 7d71244f371b62b315e2ec8a1a5fecba6b057d9c6199df92a9c49aa9de645c36726d7ee982a2adec33a671525fa8a9d86bce3ebe851c8a1549a14bfc60b6bd5f
SSDEEP 24576:50Le5ji0hmxirMF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Pji0AcsLNiXicJFFRGNzj3
TLSH
T184A59E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 42569cd72a1ac8f42091ab63f562b96d20f85c3aee1c0a746e29bcaefdcf69fb
MD5 d2d36ad7152f36ad46203e744bf6f749
SHA1 f5b9ceb27b1ce238f322e5d412113f6184d451f5
SHA512 6b1566ba918c1a458bee43d8de9ce861208ecf5b83985663376d9c28e6ca45ade273d764d261d4aeda46656785769ee1f5a74a415d5ca6264b944ac8d5df9f62
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:b/ezSC6vUzPvxHjygLNiXicJFFRGNzj3
TLSH
T154756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2968b358a43e8a4f8b184f9349de252c154b82b71a0d65d13325abc3d618fc5b
MD5 5b128b312983091e21510f96536057f7
SHA1 5abfe1a470b78717ba86e8b8c24157a2729f835a
SHA512 0ac0b0bb21b9b00a8021f0d7e26504628813e279a132060807549cee355505e774d37cf204b087467f47d8d267423de5fe4c071bfc546389429e5e34dbbb9816
SSDEEP 24576:rVbqPb88hv/l+6G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rVO88hXl+pLNiXicJFFRGNzj3
TLSH
T1CE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 362234ae32ae6174b13002a3988e61fd4a911f776007a52263bb2464edbc467e
MD5 4666789a8850465b2d197963cb1d5ccf
SHA1 613968ed181bee18b6739fca64440ef7e33b0add
SHA512 116ef485cacbd4f5ebc30e570c4588e76745a3407d437325b7e89e03c5c4dd0693e8ddcd6828ceb47993a14faaca55de132c0f4e747deec10c76c990c77d2a11
SSDEEP 24576:tRh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1787523D3468854B1FBFD003A867A5828B5845E2C8A655DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 093c44bdc5b8575b00c0c33c089230f7d3648547c4a49c4717aeffbaf9aaead9
MD5 4c8f7f3219c54ced9eb97bb1f9b201b9
SHA1 21e4e31efbbde03c53c99d380b08b61e089d527a
SHA512 af6bafb29fdb0f66ca34737e3e221780ce4798447c2c65d6dcbada6ee8fb82dfbfcfd665d9f8a067002fbc2154f9701bce4d478cde3ea2963ebf83064ec59f33
SSDEEP 24576:TJIUu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIUuLNiXicJFFRGNzj3
TLSH
T11E95CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65fe847bed8b48a4e6835e9abd95da1707017def53d62efa2aed61608381e2ee
MD5 d9946b9b8dd91415742f05dc6838db21
SHA1 a72ed89d9690ab2bb89fbeb0dd69e082011f80de
SHA512 9df61bb1b7d3052f1a0366a3579fe905a89e78e8df8a7fba397dfce6b47746f77bce4e03bd6433343a62e87ec128830acb099a6e1103b94e90f16496db269ad9
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:CQvGAdlCEL8c/yRNw5CT7wRGpj3
TLSH
T169266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 fc33224181a68c932fd8e0d95238d3bcd57b7f9639abb78ed23f81bde6e81baf
MD5 5182599d8dc914f0401f4993a9b5277c
SHA1 45afed4ed60f3e65411c6b8d2e7f3539a8783a34
SHA512 30cd7b7bcdca5ddc41d5ae45e26384caf076eb71529b6454fdb5043571a1c9b6bc0c3ecea2a585fa66df671e0ad5f6750b76183a7d67ba84f388c26cedaeaf6b
SSDEEP 24576:GdewsAjc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uljcLNiXicJFFRGNzj3
TLSH
T1A995E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3e5bad4dcaab556a47d63b19c6598ba8f895628916d09418339772eda1f165aa
MD5 5caa821ee58d703be886d76acf993542
SHA1 8e26dbc45bb89ab5b5310573f871dbdb1d94ffcd
SHA512 8229e1d1950a86f985a4ab74d78f613a68812d0bdb08dbff11c95928607091363c38ecc0e05535340cda0f14329dee26e9220fe429bba904215cbbde247b16f1
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAF9:bUEtQevvqc2W1cpV2EI32k9
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fdd933be1f8f6344eeb0d012c54455aad100534c945fb0f97d5a2c9e5e9fd0d2
MD5 4ccfb0f0c3267d7b9ef9ef0560b20570
SHA1 6eda630a4005c1b0fa3113745e1f101a0249cb92
SHA512 1c191e3abc733bae7d2237e034ba0df4851fbc8a22242c5144e3b1bcb7e41c261d590c54974c624435612d1d24c1925e76d3ccfa9d930c5ebc8960c242d9ad33
SSDEEP 49152:bCbRquA/m2yL5zifFiV+XenmE3/z8LNiXicJFFRGNzj3:EoqHVjnmX7wRGpj3
TLSH
T1EAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 844ac662db2c7d048f2513ed0fc197b51abf33daaffc83eae32482d30471162c
MD5 09206ed815e6c04f51b4b323a4599872
SHA1 fe3154df5507c4960a1d14832bc1e1f278dabc30
SHA512 e294a53fca42e02f04cb79962bca9ec37c7095aa747dc74b27f1ce361c2c0ddfa9c53023612ed039ebb7cc95d64ca5db2e8097dd4acbc840acdd456fcf2d65a4
SSDEEP 24576:rAhGLJIFoiwtA5l7S533/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rAMyFoiq5HLNiXicJFFRGNzj3
TLSH
T143359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 bf97a8324e38b5eebd9a0712d378318fa0e299159cd24658238fd2337b95411d
MD5 443fbd9aa8f3f4b5ce354b4f6d2696fd
SHA1 a467160116d90c423d40b3e05161326152449f2b
SHA512 1628b7fb5d0619d0836dae6ad7fec679085c8830d8040db098a2fb964df7535dd5f3ab8209b6935c77cf55d9a7d5d2c109f695f274a051993e9651cf43e37331
SSDEEP 24576:gwuoOWA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gwDOLLNiXicJFFRGNzj3
TLSH
T1CD85F08632980CF9E9BB413986578035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 d931db5b7adf16520f3800ba4f6e0f782cd943c5cd1959816231f49111c194c4
MD5 92a129ac27e4666357e48473ec8493f9
SHA1 705b1f5f95ecbf91556731af2581a7a49f7e88d6
SHA512 ccff5650b8472e0e554dccbf5448b6e28d31fe710757cced6b482b04c142c35be669d8a416396322b5dcfb965ccdd7a3551c061383e920492cf88176707c4cd9
SSDEEP 24576:BZut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uLNiXicJFFRGNzj3
TLSH
T12675129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d23d55b4ed077fb202a6f1c21c1920ad04ecfdbdf603bc810ddbfe7314eeab4c
MD5 efe95439cfc0fde1e6efbf57f995e33d
SHA1 590d50313cfe5beaa6f5209cc6d1711eac0a32ed
SHA512 5948bff41fc3a09b829eb7070103858a040a9cac66a6870131d16bba18c6091f4bb2b4bcf6e004eb0fa8a0c00ddf480c8aff08547d6d463951e37181b1d7b363
SSDEEP 98304:zQRQyi36YOcPQLvw2gAf+PN3y7wRGpj3:iQyiKayX+PNmF9
TLSH
T1E2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 51a6e04863650c10a104acd9e7757d0697118813f9e7c21271869333df945a4f
MD5 0832593babe8f4311cf3f5e5fda94002
SHA1 b410d316f867b270c4b5ed5a967b1f98ed3a186f
SHA512 0239689fce4ba4d47695672d2d8bc4ae09494e607ac2fafb3ee85c0eb5de4133a1b33ddf5cf26a5b447e51fb51f1e02c5041410c5cba814e55f31c771e3a0539
SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3y7wRGpj3:ZQyiKayX+PNmF9
TLSH
T15B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2c3a0203f55b590dabb608b50d6695a1b99a7575e4bf1e0ff83f626ffe6ef18a
MD5 cb8b29ff6fe56759215ce057caca91d2
SHA1 688e5a83c15a7c0823a2c4221e7a638a1d3bdace
SHA512 a01de91d7b26c7d3a32acad63ef145d2546432ffd195daa6ccd94c3b1870033a007c40f00c2efaf5b4de358c7c7b87fc4c12bcfb5591e0dcd7bc113cc54e88d8
SSDEEP 49152:H68Qg55nhheWu7PNU3/sLNiXicJFFRGNzj3:xthWRc/s7wRGpj3
TLSH
T175B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 55b85bf08773ebfc19d521556ae8509916421ae93f925619a7754d422b133fc2
MD5 c7f78520aa113f948078193267d908ec
SHA1 23b1fb05f030b5ad97b0eb2b9eb09f5ba53041de
SHA512 90938d9e3017112082c47140fe9a0c394efa7c083308e1b0635e550efee48c55642312cb0e9f71ac26eadf982cf4e49991fb39ff714604e29e0d91f894cab050
SSDEEP 98304:5y5112gYy5azzVvL69nLKnhZh7wRGpj3:ULIHmWhTF9
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 339360fc0ed886e4d5832b80cdfc77a5e2101978a04db8bddde73e156b3b2f67
MD5 7ba9309cae13884444c23e4b6eb6dfaf
SHA1 aec035fef325348b860eb936bf21b8fdfc09db2f
SHA512 8f14e3bb5a092942f306fc42623268c3da0a4f40e69b79d93874328c1185daa6b405c357ca4125ef92f10b16375e2ada60e30574ed1767d27058ff8ffb4549b4
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaLNiXicJFFRGNzj3:6u6JmVxd2da7wRGpj3
TLSH
T1ADD59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e7b5df0da72a5a8545d2eeffa3afab4e7bbf84acdaa33572a2372a85a425643
MD5 aaf209675973ef4cb58368fa4f748da4
SHA1 355ebf614326ef4505008b8f6f6ff21a0d07de1f
SHA512 e4896eea7bc3149ef4046ace7af2c230f654b485417918e8ccbc971d4f8c20180e1204a450ed858cee9f65f9f2e7e928cce120688a3caf3877fc38da5ec897f2
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xOLNiXicJFFRGNzj3:NmifPbRX7wRGpj3
TLSH
T15DB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f868dd416c08854268774e6554da7388d0ca07bb709fc8d70a13dd5a4e01b76
MD5 eaa8d8e55a69bf7758bf504e26afe733
SHA1 2f6718ad7631ab702ad2492ea336dc9ab37acb39
SHA512 af6e63c1a337f1a5fe2e2fcdb0727873912f8b12fa6f5e5783a77e6c5e1496e1fc4487299dff8f2c450cc98449b8075bf540f724a675b6cb6e015481a4957094
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqtLNiXicJFFRGNzj3:+5dKTi61t7wRGpj3
TLSH
T130C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3a7b0d66ce5c1b91571c041d7684e8986a825ff76485db420bac4cbb4432180
MD5 73005eeaa06665156f3df20a1d426a8b
SHA1 0b195a425c56122e3ccd72e288f8cd27ef6ad0a2
SHA512 e52a27d2304ca4b115d70d2b3095639a9955b9b102151a8118bfe29dbb5734d8a799f39af420711a6b6f753d7226766b653b667c9c2bdd04b80de25c694fd0e4
SSDEEP 49152:shtSn8EApI0figngiDn0AP5wKLNiXicJFFRGNzj3:NX2iyphr7wRGpj3
TLSH
T13495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d5a941114f28673c08313fd24e5462797687cf4bb0952d23209f69556859fd35
MD5 ea9b5a72ed2efe83faab1ce2cf839f89
SHA1 87f522cb8360a48a679777871f8889cd89812bbe
SHA512 fd01b28f32c6b905a393f7028dd051a70a7f5735dd73235c85702448e5a0127898914feea549457f4606fb82ddbb76bededc957e61db08bee35fea0eab2f928f
SSDEEP 12288:NliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Np/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1877523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 11f6df9566c05ed5032a172812bebf55a43c148b66e053d892cfbe0bdf1e7111
MD5 39c5df89cbc3039e37774b50afafd65f
SHA1 87f10d63f0990d0c7eca45fb523ba75a37cacc50
SHA512 ba099f37ec33d3f781bc69420d1ad5fed226052e450f711d921f5cc7c7e18ad0a4cbaa7d1279414ab2f6f104e9406296fe91dd414c61328f2c80facefcf14df5
SSDEEP 12288:MuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1257523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 289efc0cb62c2c4f885486b6f4a64cb191f0909f5e6c53bf1dd90b1422e0a15b
MD5 4fc797e57a74f82509b786cb6bd612f7
SHA1 cc070f99df709ea0bdf6e09077ac35171c29514f
SHA512 e52238226d4bb241ce75c1198f15e5a02fb0659418126a552b128a03b415831cc2a43c0f2c072522a26cb5bb3a49f30d306657915de239aefc0fccfd131d6f38
SSDEEP 12288:LsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1147523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 67c6ddfe09208e91e850c60aeedef8e7e95fdd93a1cac2e09763a66cf19e91d0
MD5 473b34fbb48f7dd84e519af594963283
SHA1 91755393ec15a80d6cb80953be0bf946c6f4f0e5
SHA512 86b071fb652448ebb2736b19419d24a8e65d6175573f57e9deb27a1cadf78941141c8ff4a979d751834e97705749a4546a21bc7e02dc3ac824d8f6208b3c4c91
SSDEEP 12288:DVjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB752393168901F1E9FD8039C6764428F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8f3151dddd0c595f7423c109b41f0f669c9debb39899bec1c7051510a014e417
MD5 44e2a3983600f271b1be38cd5161f554
SHA1 6a2c6c6c1161a1333b6883a8fe398db421dfc0c6
SHA512 73e4935c2257b307040802eb1948bcced6abd7a5af0391225d9ff545459705d39c33762efac4b0d1bc7243e052f3a07fcdf6c27a358a6c35249acab6d01f724f
SSDEEP 12288:x7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB7523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 0791ca31c65f6793378300f405d8da192b603a03c8f5dceeb57f665596a16d8e
MD5 b813d2db1a97b57f670927f5bfa705ce
SHA1 993431dc9201e6eecdede4556c331d22a4e1e73f
SHA512 f0d2434267e35d6c6abe8a08eb22928360c2b2675bc10e7bdacb2ea30b395aef38568c4032a42bc225d01432396d601a73e87513b5527097131f2edcb7b2fe03
SSDEEP 12288:OCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1487523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 4f99c8d910711a02e0ab1b742232b419fb20363826998ba076df22645faa071b
MD5 c9444e68a9a2b42f7f568a4484e0f297
SHA1 ce9fc1118eed3d7f3e22951b62ef0bf76e827b7a
SHA512 87ac25dbf1ffadb9ac5aef0c3d6e97096af714bc55b7d83ea176fc19d9898801fbd06d849220394745a3d43cabb550dd9c20b41d850fbd26c80d81ab8db9b69b
SSDEEP 12288:SmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC7523D3558955B1FABC003986354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 cd0e1e6ba181534e63b21c4077a8f1d50a6adb7aa852113a1967a8a8b930365c
MD5 0f42eb5752aaa045328a8cb1c5233848
SHA1 293c1141dbd141b022aa3201431d1aee3077e5b6
SHA512 b243be21b18ce5621df9d7619d997b375555d726db6cc373c1b2df316b5d756d10c4b85434e48848b899c8c656aaa8f341b1835e5b6caa4bfe0931d73c24e40c
SSDEEP 24576:vZMSzFVSO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vZMSzf0LNiXicJFFRGNzj3
TLSH
T100950295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 10ec1bc4fa08f2096ddbbfb84caede7f59928e034ade5ae18ba6f2d3b30d3992
MD5 fb0805032df6d469330be780ed77aea1
SHA1 8063a1c916e19e069b3a7ff1b5209139a6350b77
SHA512 addef0208977b560b7713032c795660ec1457ddb6e1c79401aca413cea4a78b864e0a9edec6655860bdef8d64ff439b426e5463b8669353623a9ebbbe9a5d1dd
SSDEEP 12288:5RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12D7523D3558955B1FAFC003986764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 966bddff78f4eed909ad9d15410d395c91940ce93a8af90ddb1f3840324dcc9d
MD5 9a6c60f346a9be4326707b571c9de642
SHA1 13fef867e10998657e88a59e818fbdcd0e9cc232
SHA512 aa9fde3c21abae39bacb1335c1a6de3f7cb1dda2d56d10ad7213869bb4039843dbfd8050dea50c897df63b9c26e4caf1bb29ba3f3594c65d35a2209599c8c4bf
SSDEEP 12288:TNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA7523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 27e3a75d0f7f96607f4e5591d28b66a4bea66cd3b1af1ee8002ae04e160744f0
MD5 3ea8a982377ca154d3c3b8caf3c3a69a
SHA1 69de03da6fb651b281c1f390ef495f55504d1f0c
SHA512 e2d24e055e5d26fb003cb65f13fea2f383090b076ccdf534b992eab23f7c1d589018190fab70fbed06c4be174f41696f3a01b12a4f64e485b51bbad2178e90d5
SSDEEP 24576:pzyM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:prLNiXicJFFRGNzj3
TLSH
T1AD850147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b66b22a75c16a2f68b666c5abeac6fb5a2acff93cc2097279c0091026408c797
MD5 1b4d197b6ab3880679c3e996d1a78ab5
SHA1 7c99d41256de3eb38176fa32ee5ad710b39351d8
SHA512 fc9db0253aacbd338330d7dc951890f26b7542dc06f2f7ec951e7335ec6cc1f98fb6440ad44632c54d8b1dca5e8e10fa03f1bb22bbddf9d639ddf740241000f3
SSDEEP 12288:dRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A7523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 62818118b6c8a44f8b4e9a3263ab47623c05682060fd155bbc511d154e0eee9d
MD5 d1ac476f37531a8ecf594b048d57ed4d
SHA1 f1e96de232a264b043bb5a7a1757d96dde5ee981
SHA512 e6a1bbc3ff8b589be5f183e85a033376c3c8fe57855b2af2ee1531bd7574804f3e6fdbe181aeb7cd1936d66f067a0d5f8509264be0c703c53e85f5a042e29bd3
SSDEEP 12288:XRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA7523D3558955B1FAFC003986754428F5882E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 2b731186508d046c8bf8d7d28a3940d5303b5295a674ef2237955ebdfcd5084c
MD5 900ab4650358d926d0ac61007efaf899
SHA1 28b3c3832c68bbf9fc42e2bbb90830fb7b651b3e
SHA512 846d4b3dfbda788b10161db2b92831529a208ae6c6a32a6ca99529bf7f44f579fe0b6bbf45bf2c8da8a0733fa6ec892f8373abcdc80ecfbbd71b0e4f6e6e7ad3
SSDEEP 24576:XzyM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XrLNiXicJFFRGNzj3
TLSH
T1A3850147629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 32b587cb195df85d41a21a2e005b73034f7cc204c95107bb83dc15d826d05236
MD5 3c83ecf15871e6527ad5501f9fba6768
SHA1 7bb7bfa95ccf96741ad7b24dee4b561a34f35bdb
SHA512 6673abf811366456da651dde3777960162e75489953fd57d0b3348d14721f6f9f957352d18b84f9a61810806364413a51d15d360fc6a9048809a3b042a5324f0
SSDEEP 24576:kTHaLl3z0zDm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kT6LljjLNiXicJFFRGNzj3
TLSH
T1699502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 20dce281b5887aa238640f9868afc84f9b3a55bc798def9ce2c56a0f99433a71
MD5 6819ca5a7bfaa6a0108e0c809c1566ca
SHA1 c0f8421254e534214778bd992bb23c875d6b7f65
SHA512 171f8c2abdcebce2788ab9b9ce362426490035ff0530d15f82b9a9e10e7a076c228a38ba965f627c836f484451686924cc398f5beee886fee88225a52db6da27
SSDEEP 24576:v37d9CHKy7GZS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/7d9CHKya0LNiXicJFFRGNzj3
TLSH
T1E7A5CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 f5c0dc9a7ac8b2062e0c1b18982fff1bab2773a11726c2fe30621f2804803a5c
MD5 0c39dfb29abcc3883ae1db47cf22fb4d
SHA1 46ae27660529bf6f8e842ed189f934bbe5efc7b1
SHA512 94d61765b71907dbe8dffd6d69dec08a80836cb4807919311b68cd5e6b94b166bc43a0f5f061a9d3678578bb00e213f74f1b55952db6e40bd5f596c318c2ece7
SSDEEP 12288:lMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1217523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 9b2163aade0a9d3d26db34aefb818e9c46368fd6c9d5ed79e8ea153d7ff9649f
MD5 760667b5ca1da9457fcf42eaef1d9d5c
SHA1 5466c8afb7e0983bf5d14f5f88e58d5a59f81837
SHA512 164a56278de4cf1e491563931ac8c906ad9d3bf7861c1fba8198b1487e5ee71a2bf65c097a1da2eacf7c4bf52bb3e2d8d03ecddb54883e2d64c56362c760352a
SSDEEP 12288:4qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A7523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 5bf870b1d8ae0520a8a13b4f1aced9a64b510759de85f81e905e2194acd142d0
MD5 efe5adbd40d47a5a8f59bab8902a0298
SHA1 3db234d5b0c76edec58acd39cb7958639cf5d83f
SHA512 68bfe654dc0cef4e1e60f6408979e3cb8e4fb6b28eea996f297d25bc11d52bb1954a12710afaf29895a8ffb1d2d15019497df8b08fb5acaecb806dd679a3f609
SSDEEP 12288:qviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC7523D3548955B1FAFC003986754428F5882E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 73d3cfc112cf3a2bfadb9c72e6377d8a271818fca0fd43e5228efde859865023
MD5 5b03e3fe0ef224c8be299d86ac42c5f4
SHA1 45a42184325033f4ee979359486c7c3806a87d89
SHA512 e3a1b22fc0c17df2d4d0a5a2d324ee6de1178d7e1f2f2f5ac6ac584282de36b0d7d433e7acf0c019bd8b78690bc38a07748bb1bbeda0f50db625ae5a7344702a
SSDEEP 12288:WRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF7523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEF8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 1ab86f63ea0d0a1b94c30da8a6e781c92300b50cb12354632ae0b730dc04ac7b
MD5 c1140ca8fbababd44eec1ed67e07aece
SHA1 7d14c4a61a0d9c9f2b56d1764b5dbcc9dd58e908
SHA512 05d07167244baa61b31e63905edd74d7bc1fd4e733854f2ee72e3b8f320fa9d0bd58179b7710f3c038974271f15401eef7618d665795d70832a286ec5f05fb1d
SSDEEP 12288:HMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1317523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 21086646677abbb427060e04f327c214968b6e729b4dc8318c808a44b6deaf91
MD5 98f5d901465a8746efba6fc350c7816d
SHA1 9989cbfecb3f16c3844a5a7ee6fea8336bdab056
SHA512 c4eac1be82be009059e3167f62479f345d846857008e9b5af568e103952a3761cece365c83e21536a3952ad6435fbce98de9fb7e9a9ca0e96f9bc5b4442f0001
SSDEEP 12288:mJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B67523D3548955B1EABC003AC6754428F5881E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 bcaa5bc2aacec1678f353f05b9d98a3524a32b51eece247cb7b9f6c7c5317a1e
MD5 28e41d1e2f8d87f7838cb1b174294bfc
SHA1 d950a6de300b9a8d73a8ebc27fa8fd1213dcaf4d
SHA512 db87dee990bbafadacd10dfe87ba92646a8668d20e8d8ae67c8145339b558371e3d65ef3044479cf84bf1228a90ef1ebc045bcdc32d08cb6c4eff4c8323c9397
SSDEEP 12288:07iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB7523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 018659671fd382b97571fbed600dcbb47482908a360df4d2f39fd56e0a26f7b3
MD5 efba2c6c04d59b750126dbd1643a3e36
SHA1 5d4fcfc6c6d5e92b9b757ab536ef63690fc4f28d
SHA512 1c90bf238d92c9b8599b7bf99415c1e12abe08f87fc1237905f68854d85fca2f24634fdff74222cf2facf0694aae655267278877614100abaafa0b27690d7dac
SSDEEP 24576:2fwvok9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6MnYIBLNiXicJFFRGNzj3
TLSH
T1B1A5DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 70823ccbd6c72c593a5a32ce96a4feacef596c01ec106467a054f944a106dafa
MD5 d8e9ef800b3530631eb1aa217cb99f84
SHA1 183224ce0b12598de842f7a6ecffb0690dad1ecb
SHA512 2ca4bd89f1b17a989489b7e42f92bfc675d5a4d9a20f82d0f3a2d6e0a8c64a7d25026e847244cdd7f810515b85375e43d9efc1ebdd9cb3774310b9837ca3977b
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qLNiXicJFFRGN:dySzPS7wRGpj3
TLSH
T190066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 065aed58831d55272fb9a5ac88cb6d0700727abc1229b208bd6cb09cdbec79be
MD5 63c7ceda954d6e0207e6e2827627b492
SHA1 0d8069fffc8537076d8413ff1d49470e6cf078c7
SHA512 7d461a333d28bcccf46e0832fc1d02d39f12953d1390fe583bc64eb1a25d77b8bb2132bbb3978bde14b2da75d3404aa73eab6438e30e7aafce1e32a1f40aa2e1
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+47JUQj1irIhCnDHUPfF/aLNiXicJFFS
TLSH
T13F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 6a5a9133e99f23e483fb3c76ca383d01edf2032a82bc2851c97f19d60eaefd0c
MD5 2bc3530d6d35dddb2266feece6966b49
SHA1 1a5deef173c0d919e5b854bb90fca95bc9cc3f69
SHA512 e4e9f0a399e2ff0e6681f460eee67a7e15f2d965c7473b00e61a3793f32d5c6f2678e28b9003c3a0ee8183ac9e366bd7a735293646622a1346cf6b6fc3af6108
SSDEEP 12288:yNsfBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15985F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 14de214d35b63e90378452e8151acf2bba20445d65441c0e268a1e6d620b40fc
MD5 9b7f8b509ffff203ad0511d8dd5c6576
SHA1 3ad5b86d91344494526ac5a234402305516a4a48
SHA512 ed2588c4377c3b23884313d16cf700c929b11c8ba7de64893bac9d0078162b53970d561465eb8b6513665c77faebba070b452b0eb65e12e5ea703264cb973731
SSDEEP 24576:KDYbnUPKgRXB61zvaHLfC0MaRM3QlnGUiBjX16i:VnUZ6IHLKDaRM3QldiBjX16i
TLSH
T183451800762ADB8FC5A940325E76D6CCA770BD12EE056F0373C9873F9476659B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 4f864cd6f9b37d25e7d543956a8b21a6451aefc26ff4655d0ccbcd401c715746
MD5 c5635d565a756917b2202b6773f08022
SHA1 1a16c6297b908a314ccf46121c109d2c4c7e03e0
SHA512 84a1683ad70f8746668748298167b0c877b8b4cbaaae23b5dbef33f858347ca24bf6fe6bc340908e338d831c0e1aa61e075f7577a3e10f039a4ad23c2b81d95b
SSDEEP 3:OlH/lRqP96fYS/4EJCjl3y8jK63mCllltGlslslslslslsl6PWY//:K2F614euVKcmCtEEEEEEEuX
TLSH
T10B8112AC4F910B33CFE7F4324C69631C032AC08066C1C3E701041082CCC03480C01F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 e6007f185ed7a9daae086ffe0383d8cb51febf863a52a9f4cd7621fba28979ff
MD5 d269846bbd2f6bf640d0d6a6ac84c1b7
SHA1 81cbf087847b2707b263afe0eba28e832bfa04b4
SHA512 185753c6774d5cd63ff779fd4d8257892341e71312c4f5cce2e89b44693351f22ae0fa1ee9c726222d74325db3721b99a3964972278ca64b6cc847ff932861e6
SSDEEP 12288:FFQ4RcFZLSTdkzeXsBmvg3rjb4vQPgVVk0B/Yen94OwGOTiFIyt:FFQTMXsBmvgbHwg2k0B/YjG6MRt
TLSH
T18B450700A5B7EB4FC86E9037563296CDAB749C03FB452F05734588389867A6FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 80b7f78ce806c70bf3edc9a8a50e154470703d4841f574e806764e5249c59269
MD5 c636edc21461c81889e81c3a2962c6bb
SHA1 fdb4eaa19c0952bcaf0bbfe8ec9f262f72969db2
SHA512 643a74b94be1a47128c1ac9aa257ace9a3d84cffd6590493a7a84b5fa2414661a63c69f166a9c18b9ba534aac398ef669188b36385d72432d728e09b1d84c18b
SSDEEP 12288:+z75iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E7523A3528D59B1FAFD1039857A8434B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab1969bc06db8468e1eadd5619a8ebe38064cd60414e63404a87d18afe3a2998
MD5 1aa4e2a167e8e989fdcb8e64348cdb2e
SHA1 c5b181f865d295ded9396f435b0a1547f731c0fc
SHA512 0125199cacbf6f833bd4a67ee01c5e32df10dfc41b2173ab7de8f631cff3d59f833272605b845ba332c73184e1b46e5c41963e1e543a85c49596587efae45677
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Kgb4mBIBhGFoLNiXicJFFRGNzj3
TLSH
T1EB65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.1MB
SHA256 07d43b8b347f93bcd1e0b84d681e84c5f391e24c73af3cbfc36a9ef5b5121a73
MD5 105f544f8dc8d77ba7995e417646b5e2
SHA1 069e61f97e18797548f6f896d6ff7c67ac895239
SHA512 2c475346095bab22dff1f1cec9525606f0b26b04be21b296a04e8a7604624c3a9d0637dc0ce02f39932f76300c4df3657bab8147f9e136f0e13d4fa4c424abba
SSDEEP 24576:vG88u8FpJqH1bzria7/m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:e7ZFPqVea7/7LNiXicJFFRGNzj3
TLSH
T1DEA5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 15398edf60e8e8f17446aff05ede11afa7bf65840e8d418cb4ac90e7c557df2f
MD5 b4c1a584ee2d213ec0d623f76a7cc474
SHA1 c71073c0aa08945aeae78984f5bf837632091de2
SHA512 b030d028d23d8b7f3b6571c82b2fa2e250fc97e97ec20100e1554c51688f2b6f7ff2b94722c177cfd29b8227a14f8b442fa8f42d430de004c1a893adcd2f360f
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjELNiXicJFFRGNzj3:rG05lO43bZ7wRGpj3
TLSH
T137D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ce782e645f290a0d0b91699242490b34ca719d13d8ca27a27c23cf617b4c808
MD5 14480b4b73dfe84571c3880db0ce9692
SHA1 9ebf0585a70ff954566631516b1a22aa868a10c9
SHA512 9acbb8ea164461774cbeab8bc8842a99824c268fbf1ea66d9bf5433350d300a144312be0a5661d622bd833bf5dd82772e09a8379eb489d1fbdab2e9599ba9bc3
SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnq/TwSfVcYG3K/cJHlnFR+IGNe8jg:ra5POZ3+Jt2pasx2+msLNiXicJFFRGNf
TLSH
T1B265BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e1d8032f64c738e645579112d3f101aaf5755fe322a215cf8d4e5c3f88a3cfde
MD5 7daf87958a30b4cba1b9f0b70b768a66
SHA1 fcd6d5cc8138a7ea435cdb5c076b49eea320a52b
SHA512 35253fc6a1edd9d0a1485c283f7dc661c5326aacfd65916d51b8a97592d35ce5d5a3e085662a34325588619af9b2f4d339fdb25a5d0cbb618e6205520f5d8a15
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7Fkg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dNc/zEOVHFbLNiXicJFFRGNzj3
TLSH
T173858B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ff9a3effcac23c5f90efd32eada2cf3037300d373f5aa4d8551c061051c98968
MD5 fbcf1a0b6c54ec17641e1188221e98a0
SHA1 edadf486b933af47ed20866ee32836a05b944b39
SHA512 6a9e4d58ce95a1f9ab18f044c1c6c151042fe9dce87a680000a3d8749ab67d9d5a588aed08cc4dd3c95bbe4b174729db996084dcda20cf49d4d007a1c5a18e10
SSDEEP 24576:W8kNvNnaFeYhJNtmZBme/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W8MwBtOmeLNiXicJFFRGNzj3
TLSH
T18555AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.8MB
SHA256 9ee7faeceb36dfe663cbaecbaaa31097246921a12a6952d497b6ae5348b5ee81
MD5 8d64756366a585d66ee0bcad89e0292d
SHA1 83d1b6e78a24affc8fe6d2827cb630b9aadb1e34
SHA512 4758c5b961b37d5e91a5aafbef5c9af62bff562fde4dc09d4b71efdb87f45af6c84050a1216c19160bc3cb6b0be643c0b9e295c4de981812c4caa702218db766
SSDEEP 24576:aPUr+NQ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJQ0LNiXicJFFRGNzj3
TLSH
T15985F16F22DC18E5E67AA13D89828619F7717866071292CF02D0517E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 80029a82dc76752b5857b10d9f0d95225e0802233672a46b54b1d2787b919888
MD5 1d78aed8ce9f93a89e3df6ea2aa7bff1
SHA1 3d65699be363a70dace6d0e4fcabd16523878a76
SHA512 6377d34c6e384047ca669ca222dc068ad8720c6994fc5752a031347f0bd1e554bd03089f09b425bd2c388a175dfd0a783ea657c9e44f88547c345e38baf0f0d0
SSDEEP 24576:iD3FHshBIYQgAJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iDVHeBIAAJLNiXicJFFRGNzj3
TLSH
T1F895E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1600-2-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/1600-8-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/1600-0-0x0000000000400000-0x0000000000774000-memory.dmp

Download

memory/1600-75-0x0000000000400000-0x0000000000774000-memory.dmp

Download

memory/2076-77-0x0000000000B00000-0x0000000000B66000-memory.dmp

Download

memory/2076-294-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/2076-82-0x0000000000B00000-0x0000000000B66000-memory.dmp

Download

memory/2076-76-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3348-65-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3348-277-0x0000000140000000-0x00000001402BC000-memory.dmp

Download

memory/3348-71-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3348-63-0x0000000140000000-0x00000001402BC000-memory.dmp

Download

memory/3700-14-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3700-22-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3700-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3700-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4560-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-99-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4560-311-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4560-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-105-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4644-52-0x0000000140000000-0x00000001402C0000-memory.dmp

Download

memory/4644-226-0x0000000140000000-0x00000001402C0000-memory.dmp

Download

memory/4644-53-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4644-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4696-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-87-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4696-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4696-325-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4928-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4928-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4928-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4952-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4952-124-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4952-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4952-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4952-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5552-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5552-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5552-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5552-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5796-43-0x0000000140000000-0x00000001402C6000-memory.dmp

Download

memory/5796-37-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5796-44-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5796-50-0x0000000140000000-0x00000001402C6000-memory.dmp

Download

memory/5796-48-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6076-122-0x0000000140000000-0x000000014032F000-memory.dmp

Download

memory/6076-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6076-111-0x0000000000890000-0x00000000008F0000-memory.dmp

Download