a91c588498328c75e0382a382f133113126d6f999af9c1b25aaae260df393269

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Size 19.1MB
Sample260629-dmaclacz7j
SHA256 a91c588498328c75e0382a382f133113126d6f999af9c1b25aaae260df393269
MD5 c576e249d074950b4afc6c5c033c0a22
SHA1 37338999a32cb7d611436e45a4f0b9138fc451b6
SHA512 3c68badb499c156d998af5c93adf26b18fb517c6f7204623660e7d4bdab71308b37c7aa2b5807daa46dfae45558bf3589600451ad6339e9d6f11dc8e8ed281b5
SSDEEP 393216:GJblVZFTBU2Ma7ny/Jsv6tWKFdu9C6p/g9:ylVZFD5R/
TLSH
T1EB17C092F7828072F4D241B511BBDB7B4B34A9241B2596C7F3D83E6999306D12B3F34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2068	elevation_service.exe
4936	elevation_service.exe
4832	maintenanceservice.exe
5676	OSE.EXE
5908	PerceptionSimulationService.exe
480	perfhost.exe
1836	ReFsDedupSvc.exe
6084	SensorDataService.exe
1936	ssh-agent.exe
1328	AgentService.exe
3744	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a0a8015781289776.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102906\javaws.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdc1acaf7407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa25cdaf7407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007564346e7407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6b1f66a7407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5eecf6a7407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e8297f6b7407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
2068	elevation_service.exe
2068	elevation_service.exe
2068	elevation_service.exe
2068	elevation_service.exe
2068	elevation_service.exe
2068	elevation_service.exe
2068	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Token: 33	2368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2368	AUDIODG.EXE
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1328	AgentService.exe
Token: 33	3744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3744	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3744	SearchIndexer.exe
Token: SeDebugPrivilege	1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Token: SeDebugPrivilege	1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Token: SeDebugPrivilege	1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Token: SeDebugPrivilege	1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
Token: SeDebugPrivilege	2068	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5140	3744	SearchIndexer.exe	101
PID 3744 wrote to memory of 2328	3744	SearchIndexer.exe	102
PID 3744 wrote to memory of 5920	3744	SearchIndexer.exe	103
PID 3744 wrote to memory of 5884	3744	SearchIndexer.exe	104
PID 3744 wrote to memory of 3672	3744	SearchIndexer.exe	106
PID 3744 wrote to memory of 5968	3744	SearchIndexer.exe	107
PID 3744 wrote to memory of 3392	3744	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c576e249d074950b4afc6c5c033c0a22_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000508 0x000000000000050C
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:480

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2604 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2604 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc784a36e3204922eafaf6e35075a7f93164318176ade77a5d7c8ecf2acf04c4
MD5 75f7657b9fe75cc667cb5f87676284e1
SHA1 5a16e67b3376ba2da2c973d0b883864fd87f75ea
SHA512 bb3ae8a77a1293fce48d846e946e8694c3d1c96b27aeee39b0e3ba56f995bcd1dedf3a81d362714c776f2d0eea3ba021f308dffc48482db685c0805aef71c7b0
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNLNiXicJFFRGNzj3:t3q6mjB+7wRGpj3
TLSH
T19AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 021542b3b51ab8fe27ba1a3f2c805d3801951d2e8d7119d688fd64541fa2f6b6
MD5 6c319b82519ad2e179d7796fc389000f
SHA1 e13a8141a9615e2f12fb888c18985f0e64ccf9d4
SHA512 8f40bfd62abfa29d9fb640b18e8b5c890db829d8a2cb7f249dfe43dafecb94206d7abb6c439c4ffd060d6ae25f97e943aec3a50322a19ff26a0dda0d9a0c1d0b
SSDEEP 24576:BXYfDtczAC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EtcDLNiXicJFFRGNzj3
TLSH
T12A75012963D408F9ED7B813CC8B28411EA727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 596f852c3226c6e998130c63ee33162f082c8f5866cb33eccea4030526a988ea
MD5 4a3efdeaaf71880d9f4ed5b5d6e6ca46
SHA1 ffe9487a5ef486abf1befb330867ec51829336ff
SHA512 fe32caec81c670e44c42176dd9e7084f1c5ae831b044bc79a1261aaddb4798b35e45e275e8ac05eb6181b42aac6d4c79d6115058607d229e06f0bd5b4be2f7ac
SSDEEP 24576:20Le5ji0hmxhrMl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Pji0Az0LNiXicJFFRGNzj3
TLSH
T1D285AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cec2ffc58f3fdcda4351fc7a9dd5f68bbc8d47ecf1c4e928aaa0cc1b0425a91a
MD5 a331c84bbfeafacf12aa96092079615b
SHA1 4c496230e1a70f99dc534f36a652da0a687ace5a
SHA512 e1d92acd6393136665485ddaa00a6664427bb6573015db79b45f9467f9cc208ef6aeabdd69ad541444c7c0bd95b5bfc93934e80a170f088e6099c0ccd336a3f2
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWj6q8wyuT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8/ezSC6vUzPv+HjyoLNiXicJFFRGNzj3
TLSH
T16B756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8112fcbb1221bd328db3197307d5bb20620207623d45cfa53e0dc2f56c8a4fa
MD5 384fc4f0ef752ab5109acc85026ad005
SHA1 e9a76b0237fe3ae5ad1adf02a01a1b39a7be10de
SHA512 fd5384eb8933eb957824f22778d9d4e0ccb559df01d966eb9a11b2959cff6b435eca12d28e846b4416f55cd98953fbe184a4a4c037bcdc23273d446ba49a57d8
SSDEEP 24576:2VbqPb88hv/l+BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2VO88hXl+ULNiXicJFFRGNzj3
TLSH
T19E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 787372ea2ad21b92cc5a74d70763a0f37afb4a16150af1372e7476a1b828b5c4
MD5 b5cf6db26beebf6145f94294c6e7f6a2
SHA1 39a9c0d5cbd42e26715a63f52c3a675780fccbb3
SHA512 97e7c34e9bd097330d0b78b0e3037c7359a8e019f4b6a329496c5a1542a71bbba9f641d28cb2870e5303fabf3a75d28c766372413f1abed197875b858ed7b71a
SSDEEP 24576:OGh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1CC5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8c725519f67de60096eb7b6c0268cb2fefcff3168187009c6ee7cd98df4090ef
MD5 883ca2cc34afe6b73d4356092ddff22a
SHA1 46b37220d295f153fd895818c17c2c05ccf7ed1b
SHA512 deb51aa1e5aca16a018243626039b16d38716107e546d4ca463af3402e9002a23e03bd32fff8e6327fb8d58ac912e5daab94e589ae511399a0e61622f74a2015
SSDEEP 24576:EJIUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJIUmLNiXicJFFRGNzj3
TLSH
T19D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f6e5b2393cb2ea7699534d1a0f522c4721272d66e84dab2accd91c7674b552d
MD5 3cc3e75eb1d31651d1e3d14151e204dc
SHA1 cf679b892835ebda6970a0f5508bb8c917d501ed
SHA512 709b3b8787967267cb317a0e4f60b2cbe269e4805a5b51890c9f5b61a9e9167f978233da4685ac832bb4626ceb41ca48ca4c849718733e1474af2a77f81e38d3
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:RQvGAdlCEL8c/WRNw5Cj7wRGpj3
TLSH
T149266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cd1599755f441ac7b49eb0a0e460998ba458856d34940612209911ed144286ab
MD5 45114f59ed9b22885e43f3c8faf627c8
SHA1 8e3a072080c94763e5e78dafd7b55b9800cec091
SHA512 375cce41e2c5c7b46d5b4eccc862e219d0d52ffaa06755815505149146979ed096db007f60e0824176c4428d29f20bd394d3a07cad7d0221c70909357cd3d831
SSDEEP 24576:dfewsAjE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hljELNiXicJFFRGNzj3
TLSH
T1FF75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce15fa21adaecc30535acaaeef057b299498818df86af81e5b12b409926825dc
MD5 91f8d5a863663f90cdc574ef6f38dea8
SHA1 cf2e569050fd6d1adff36a8f0fc7f7e856fe6b68
SHA512 53a3db597d94d76743327e54a2a221de9d98dd093e4de6a6eda1bb9bc4f10624022e6770e2d41413a9b87f97e17983a9e403e92f748417110b1f9ac5d2772c96
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoF9:rUEtQevvqc2W1cpV20I32c9
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d560b7af3cea7903e708132689882bafb4bf087c9b6f00a8c382750a204d2a58
MD5 97e2213fe328d385e541825d9e1afffe
SHA1 7399d7efba57a7230cf16e993da890896235540d
SHA512 3216d6bc1d40ad0a5b03d858001b88e2640ba1c93b7518eae5ea2b17d7a3061ce1c2d7ea82834bc793aa6eb1e739ddec614d23bc0eff01046215648937e18830
SSDEEP 49152:eCbRquA/m2yL5zLfFiV+XenmE3/zkLNiXicJFFRGNzj3:Toq2VjnmX7wRGpj3
TLSH
T16DD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 860d663e8b003ca98cda174bcaa4483ec1e2847dbd3ea7c1532d5cb0bcfbfb0f
MD5 56f4e63c22fc62d5169595a7861a3000
SHA1 4dc87221dc4c3833fe10dda750c07f45dbf70f43
SHA512 0a3bbe43ca8f64bc52d22e767315c50ab09196680bd4a0128df5aa5c59368ed1c3843f6644513ddfab6bec43eed16ae5e329ff513b9095cdccd8e359bea3b384
SSDEEP 24576:BAhGL6IFoiwtA5l7S533/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BAM5Foiq5nLNiXicJFFRGNzj3
TLSH
T118359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 074858ebd69d67e9dac9618e203da579464322b36c53826e7b2f392610caaa62
MD5 6a79a9cd0f4e98a50eaed25a8617440b
SHA1 46fcbaf3c6e2440c4f6d564a8135e2c8f61110a6
SHA512 4a3fc77e2dce56f194840091da86a3dedc304ce402efe95a498c1fd6aae04c2e7f95192f2466d90789e7cccda96ac3e4fe62397bf661a2516b06a252074034ac
SSDEEP 24576:ZwuROWI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOrLNiXicJFFRGNzj3
TLSH
T1E265F18632980CF9EAB641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1bf20448308eed93588fa78ac1366b8771e8296fe48cbf9f0006038c696fbfb8
MD5 a57960975cf0f0444fb712fa86d5f111
SHA1 9e8f6f473c5f82753a17da27c012f266140d6c98
SHA512 ad16824cb4017bdcc4873e238d4ca6787520c90f6c35ea3ef49ba2ed8546d9c170a994ad158d7561fb81a2eb0e8ba3061948322ac39d1cc75c30a08150e41d82
SSDEEP 24576:IZud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T16B55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2bf00b06a89f22cc180ea799acb6e1e8018d836d970f4dfc55ce16bcf51f7fbd
MD5 4e9ee3827e70923f4ce75cc8604f3308
SHA1 68842f6ae0a18a9583f5b2ca890115bc9e93d8c5
SHA512 0fa40b0eb5f96b39705ed58f7ebc1f2e6396fb42da11c4a0aa5919edc926777d1ab39a93c50e307c7a4303a86cba6115cf423f4a05e4ac0dde6f90158dff4bbf
SSDEEP 98304:oQRQyi36YOcPDLvw2gAf+PN367wRGpj3:/QyiKanX+PN+F9
TLSH
T181667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6ce1145d949b3a0f6481dd088ca51dc915c9b468a42b908591ae411abb568fbf
MD5 098f8696f79faeab8ea8692295d5541c
SHA1 f0a96a7954567a58e295a0c48385b096a5b7bc51
SHA512 5f236508c7870e9670433b126738fcfb1d319de583614a883f330f609000e4328f5be064bddd862f0707126dd6af2a15a8ed32419956ffb81abae5b89325f33b
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN367wRGpj3:fQyiKanX+PN+F9
TLSH
T182667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c7ad76c5257caef5c3ef004faafabd02dc6b3a1768c2cfe25c0560aab5d17ee4
MD5 4e2c6543930277a550a2df00f2640fa1
SHA1 89da8d117ba34c2285c773ab8b642e767269af08
SHA512 6fd1a0f0f0db1c4a778ed4c653496b837a54d3cdacaf5f265784ffbe4ffab20340e641ba46a910243c53a65e362a4d0718206fec70fbbb7c36939632f4ce35b6
SSDEEP 49152:c68Qg55nhkeWu7PNU3/0LNiXicJFFRGNzj3:WthTRc/07wRGpj3
TLSH
T170B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 07e59c0be316569665498d2caea4c5e0c2c6a6ca096de39e51cf17e414a9806a
MD5 f2cb43204339d54bd8f66a074e97c64e
SHA1 b415dafbf2ece411ca73c1e44889a857d58943e4
SHA512 4c73b8f9180a6cead58ff55e11a83ba559303d1df70a02a59643a47a5412ceb9876593eec01c20a3b4479258f54df6cdb3c842ff622952abc4a7622922fa9f84
SSDEEP 98304:hy5112gYy5azzVvU69nLKnhZh7wRGpj3:8LIHRWhDF9
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 316e3ec154c5872e0b42afff3022bd6da3b27e664e9fb73d9b147673d206ca30
MD5 48155dde8f2255b7101e64c73891d37d
SHA1 d89ab620db5879248c2fb5e4d6572edcb6e045fa
SHA512 95accb46dbe91eafbcfd61874f16ff9fa617040084e295231d0446cfcf486cbf2934192118246e583902e209b4e0f98c7203b498cd74dd1ecc18870a59ce6610
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glyLNiXicJFFRGNzj3:iu6JmIxd2dy7wRGpj3
TLSH
T13CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 33946cf27fa829edf17e575e4ee058fa5eaca3ca4e9bcabbf02eba2febcd3681
MD5 6a620084f35a3365227521c1f2cb40b3
SHA1 83109044f79f9da8f8688b435e146f622d50ff36
SHA512 17c654a47ea79b55ab50ee0d7a8b0f936c8b2f6f0e8d6a35c140510ce7240e6aad820b48a176252fbbb1a55e3bef6a30ed758b2b26576616e599d1ae6e3c16b5
SSDEEP 49152:k1hpsNoJpF1A67U44CwH7R4xGLNiXicJFFRGNzj3:kmifPqRX7wRGpj3
TLSH
T13AB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 10e10d3ffbe834c1cd6134f3c7b4807bd67ce255ce4c6920a78e7aca63d7c0e2
MD5 d2a2a5e3b9e2e81ae55622574665c636
SHA1 0ecb3d19542b52f405ae24f37627d768eac124d8
SHA512 acea1c9d1c5941348ea53845915bd96cdac3c9e71b9a03ba80c8b8c18965f1b3d2c42b0f76f654a658154440725d2edf758cafd20e98661b55f0cf71cc43dd11
SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqdLNiXicJFFRGNzj3:85dKqi61d7wRGpj3
TLSH
T1B1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e757eec7d95d3289babfea2cbd7704e44e7674632c14cb3cc31df8e4e655571c
MD5 aba955cd6b76c302fc1085d3314f53ef
SHA1 d5df0cca7bdededcae79f03ca7b9a45716f68288
SHA512 521b328c6a9ef348194964b1b14a0b108470bd4915ab7241bf03ad7760b557883aa2bb9c9d68c5f8c802cb85b0a1e8d12f24d1a3077fb066f17979d7dce0fd81
SSDEEP 49152:MhtSn8EApI0figjgiDn0AP5wCLNiXicJFFRGNzj3:tX2iWphL7wRGpj3
TLSH
T11295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 321280ed3c06c94dab7c183c8dfb50b154047bd7fa4a27eb7fa2b4fcae03c0e3
MD5 4ce91a194df5fde31be9e258d1870166
SHA1 3562b0b91835f10f9b72c1def5dce4583e769b0c
SHA512 137269b713302935d28fc958ce12f1f756994659e23692cbf36d5ac2cc55128951be09a0af3864e3426231510d8cb0b6bbf9c8470d8df6dd858208248c4dfce4
SSDEEP 12288:jViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f0f3f82b3139cb086a8ebf88b663c3bc478e8c83e15aa47a35dc195879bf796d
MD5 ce96afdfeca01ec9e8302562e32715fd
SHA1 ea21e5a07e34c3c717b5c08d266d66a669781403
SHA512 066aedc1e821e1c87d310a53a87318763cbe1716951f6cf94aca33bf6502e70e14f984634f44eb79adc38356aa70ae8550d687ec0a60f3593c167f13676a2694
SSDEEP 12288:dmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B25523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 69cec048da675f58cb4db0ba9fc328c23417933ecb3ce80bc5f905c0699d5b84
MD5 56a2f0a1d0e247933a38488a2fd739a3
SHA1 a732814312ebf5f3b1825d92a7cb9be9467261dc
SHA512 8938461d695dcf046ebe2148597f5170f86f3845c210b0ad525e15fda6e60ecb0db3533354053f1e7818e860c816d51b633f558dbe79ef2fa23e06468df18776
SSDEEP 12288:WUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:W+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3ccb9616c159044178aca2153dd4c03a679102fb270d34968da4892e019ac0e8
MD5 2e07b996eddeefb19d43483dcf29ae5e
SHA1 6ec9772fe09c25e098d69f3dbb0464d4d3b5393c
SHA512 ab3e1d45856d5cecc63f5981a92f62b272af72e45d5c0848f7b7cb86daae1d43a63a6356ca6ad11ffdaef508efc4b86783d9c6377bbfd9ca73aa06b377f738c3
SSDEEP 12288:lVjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T150552393168900F1E9F98039CA764424F6A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6c4814101db91168b9fbdf4dc1eb8aeff8d87ed2f5eb47180e767107762c8130
MD5 b3427db739a63fad97fb8c3c12e80440
SHA1 747b5afe6450c8adcb7c58457beb5b49d25b689b
SHA512 4d3317ca7c6f9a3916a8936b89e7a36148c9d0479d0bc5e37e7bf7d48791747bef8bbb9e0b6aa4b379ef677ee71466d70796dd6925031d7a22868d97a126588d
SSDEEP 12288:3riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7268b0b102409aae0d455cff297a4587dae31d218795a5e089e315d6ecd1b3f9
MD5 954e55d4ae507fc3d6d3bd97287128e6
SHA1 c62e20ff5f378b108072a0afffb5a4119df73766
SHA512 4bca9bc904cf66be86dd4bde60d82d3af91b558e5fa1a9f8af39be1970c2ee0631f498db84e01eaebce62ade78af72f5142c7c2f4b765e18deb8fa7734809a6d
SSDEEP 12288:+aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 72cfc12b51af59e0e789fb06a2922317b0e956d6544abe011c6aefb247c4ca29
MD5 936f5be6aede49f1bb13df0e19cc1763
SHA1 ee6a7b9f1d1f6e9eaaca76e9f77fcfba3e4fa6be
SHA512 401f9dbddf106310d2d7474e6874e4bec95b06762c5e9aa79b72836e397485f8d9da2d41f90ae75a33b22c61ca3240d17c836874b09295c8287067a5178e4c30
SSDEEP 12288:IOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3548955B1FABC0039C6354428F5882E2DDB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1211306e675443ab2be8946b527f0084b2cb99cd13bee07a6990b961508fd66a
MD5 19c45d1d2eb38eeb39c7a8b3a4855569
SHA1 7cf6097b7610470faaa28a581652bae0e85f1440
SHA512 81ece788ba3cdd82b95d9d5c1db52f850cd9b54f77cac8a933bec562cd7d252eb066e2b3abac6cc45804615add05b12d2233bc78ae9bc30bae95bd090d3e667b
SSDEEP 24576:VZM3zFVSOw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VZM3zfMLNiXicJFFRGNzj3
TLSH
T139750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c82bb11b0032c811059e26f63756c8710cecb1512e2db4c90ec0899f1e26940e
MD5 b4a5bf11ecfecf013929f4c43c5bed89
SHA1 3fac63276a156192dc628425ec241e023f6f1499
SHA512 57fb1dfb03b42986426f6d6bf9ea91c6fbb162ee66cc5483651e84fdbff333135f49c2020d0a3dfc5e977c3eefc4da934309e9996df6953a504c4d1d179d1851
SSDEEP 12288:IBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:It/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 32d725e2fda953c2ff9b4159b19f48c40183b691e532906133c5bc21037d718d
MD5 1946adb8a23323e0af92132d9b4ac5c1
SHA1 a980157ef5cabc388480dd23c762f6b95dfc052a
SHA512 8e4acfaa9d45c3b47d4d64fbe3903adbc0ce108108c25e0888abf26e34fc882355c20a9ad4cd0b3f2b227e81169cc6cb567be1b35330489e6b120144a6a8daa4
SSDEEP 12288:itiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ix/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7c5bdf5f91bd5e6d31672015781de338f119a7d40f6e122e016b88f654060ca8
MD5 1e768e3eef62320a36ec50529171f799
SHA1 e7f40c014cdeb6e3030fcd765cd74bd8fd74805d
SHA512 ae05a7d864517a7bf192ed2353a596d52f0a019ec95bb63098a646214bcb91516d15230d055262a0cfe18ae48e97bef42fa1f259945d7e41b37904c53eb9ded3
SSDEEP 24576:SzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLLNiXicJFFRGNzj3
TLSH
T122650247729530F9E17A8138C9620901F7B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f2ecae2f853f3fdac0a5c59379abb86b6221bab13cdf499668c234c6a635d0b4
MD5 a22658509b7b9a5500083360e1836bce
SHA1 4016f7b8cceeebbe89e0ce258e9dccf80473cebd
SHA512 887d4f2ed6cdef406f9d653cb31d610f9283c75165399a5380c6bedb3a04d33d63bdeb2ca0fe57b199f8520671689b88393bac71facb82176bb02afdba8193a7
SSDEEP 12288:HBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ht/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3548955B1FAFC0039C6754428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 620a06e9d059599e94d9e25c453f17360e94334c701d1ca26b26ed96127b1c43
MD5 bda1ae4da87c3a23853d8113223779ab
SHA1 3e93a2df91399710cbc845f03527bef98d6b0f3e
SHA512 9b40208e0bacb86895f63828fd0fbdc26bd9c3fd2b5f83ad4905dce26ee5eccdcda4e129c2b187d43bd113bc68d233cadf986f609d973cdd425e47e647f1792c
SSDEEP 12288:1BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 415007c452d20d78546861cd948a15a3e18ef5b8a8853fe6d10d11a8fb1a618f
MD5 e7e480ad22755267729a78f571a5fd59
SHA1 50d003d6857f36aa2746da77a63949a2dbd5d3e2
SHA512 384790dd43bd9e373079ea2b129787ca7e5b63113d7bb3484bbd4868f2ca15d03a3ad4dd0f54272b670a1c60a50dd615b1a70f618a7cc9682eef68497181d027
SSDEEP 24576:pzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLLNiXicJFFRGNzj3
TLSH
T1FC650247729530F9E17A8138C9620911F7B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ef123e2a9822e92262ae2c50ea99d6906396b52ff42a6f5ae192b66181f3be8d
MD5 e2ee4a6aa9bbe301b359097846a8d8e0
SHA1 097f93aaca24a96faaa7f444d99d731189341d7e
SHA512 0f98088691ac95ee678c5ebadafdda3d8556e589f5e3849f17cfc3f21fb2dfd47b5e61ae055c405def58dc154a4b2256fd679d0de35c6377dbaef46c257e5468
SSDEEP 24576:+T8aLl3z0zDu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+T7LljTLNiXicJFFRGNzj3
TLSH
T10E7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 625cdbe1ca272378fdb90c51d7d23dd9426f88570b483bb9c0a6ac4b63105c29
MD5 1f1946caf6733f6bfd8c976c23e35d98
SHA1 b1dc5d0eff14d6148c0b4bf00eec6328e3e7c179
SHA512 db4ef47ba82bec5dc13e6d580eb4107fc43296928b2781529f29ac71193a0383a421ccfd25403cfda1750a86c9709705894fdd86f01c085e780a61778185a63e
SSDEEP 24576:63rd9CHKy7GZa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:crd9CHKyaMLNiXicJFFRGNzj3
TLSH
T1C585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 01608b4f52de65da8af22923a4d985bec9411afa483bba700a4333dff2bf55ec
MD5 c79a1404ff9e1fc44eb8c7b124753d16
SHA1 48391871fd48c1bfe17582289c4da929a1b16df9
SHA512 bafe26236edbdcfed80739456e75b87a829611404d601f1f8c5963ec9fa80a326c943a10f769a3baf6092555e50d44eb12c800d175ced0a225e6eb62d027bf8a
SSDEEP 12288:M0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Me/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9264cbb280191570be9e16baa58531d3899ed0648bcb9b10834b1d6988609e90
MD5 da4b1775b5c7d0f5d2c3851cbac6bc5f
SHA1 589bfddf0c7b4338c0b1b5c597e4f70869634800
SHA512 59a96763dcd1b82c108e88e3a6645ab2940bfffe9fe4fe313993d280a3268e4efb1dd61235abbb021e99126d54fa75a2d50fb73a40a108559be77664e862fd27
SSDEEP 12288:4SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:40/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c7895990923cf70bfd581e64732b883051084540a91ce23d5da15435e794a835
MD5 f4c5ce2e64d34b65d0095563a8fdc8e7
SHA1 0e33969b2c6ca03278f472b89e48319d2994d25f
SHA512 a15c56b56519789e57001b981c83412edb7a30fe9cdab99e4f4e10daee9ae0881c059a5647550bd3c34f939973a00836148c1557149d3c18dd626a7afbf452ce
SSDEEP 12288:lviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7ad96eccc2ca157166ca6f771ee207448960b1ae1e12064e27f30d506398b537
MD5 fbab7bd02fbd5c26481d01011c6f2e08
SHA1 87b1c31ca9311fccde98583ad24715531505c63b
SHA512 fb2a97885bec4ecbbffbb50801cd75655e49f6c16ba5746ae1e1ab4bdc5f2fa70bfe9d0f060c99c375972c23b13ba342ea5d570d01a2efcaab9d9cde94f30f93
SSDEEP 12288:aBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:at/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5cdf59758d2437598c33395f698f41bb0a9aae5da63a673f474ef008f89ce41d
MD5 5828794f8e32fecf70112624c0b4b962
SHA1 ab85adb5c5f27422bd31f1e45094fc603d84c0a5
SHA512 2d4018cd03d3b68fac89893bc0b58c4c2975dc1b99c13179f6a0975de49ed020e4750a198af94c8e8173166ccf082aa8541c48d60975c9bfa933757337d254ad
SSDEEP 12288:Z0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ze/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a38c54175597d232de23a1caefb971604bd93a7e932b2360d4f6387071c95727
MD5 ae170f5216e66d3414e2df6fb85c1db4
SHA1 679e5ed34d95e95b026e3cde66d4a126cf865a15
SHA512 d73d39d54f8f267b15d8112f970f58edbce85f379b78bbf5f6aa8ce42ba3cd17a80e341ead76ca055ca71445ec4cc5bfcc2ee65ed40f35bb6b450059ec9c8427
SSDEEP 12288:4JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3548955B1FABC0039C6754428F5881E2DEB5659E3E3483E1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d8ab78e87c4620d750212bb3497314f8e6121548d4f6e358343980046828020f
MD5 74c782d94288e0f20843f92b4b1858a6
SHA1 20136988f1155422309c806683c6cdd9e489c2d0
SHA512 098a512baa4bed1d59b0b6c4eee82469d6164a6858aff8820d030df53a66b5dcbbb3648c632a22802c1b199174dae8120057cfc83c0cb01a16736d58ed970197
SSDEEP 12288:/riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:///TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 27ec07f0092024e7d1b55117591e4c84e72293df3f454fadabce3bb854898968
MD5 c1ff0d888cbacb05adcd4823f4ed79fe
SHA1 c5d4a54ea86c185bc9a0ce6bbce1ae8e2b78ef6a
SHA512 63f58e3604025065f8e961649621265262c14b56f4313d33b09d4f329d1b7eab4eba47ae965ec7d44bf381bcb697b790dbc0de2ac1f4209ff52f425e5f933fd6
SSDEEP 24576:Bfwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gMnYIBLNiXicJFFRGNzj3
TLSH
T19F85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d5b75b5ff93202df156b0f2201f47865d5c8b924b9d84d31fa9122f3b648f23b
MD5 74f24d808ce3a4dcfed491fb7eadcb54
SHA1 2d88beaacf596ed7cac4eaba6af9b6b86e55ec9d
SHA512 1b74ba57cce103de176c8d18764713daa94fe771a5ff5ccd47f51b4546f671e2c845b5eae2a0531ac9ca87645aa3caa1a3419e99ae99b308f74e7d6e28dc4d25
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iLNiXicJFFRGN:KySzPa7wRGpj3
TLSH
T1C1066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 856bfd036855ef850eb82136999829d856fe2953c66b895403f38de83edaa243
MD5 443997068a1bf9e1c7517d96ea31f698
SHA1 6ac33a5cfd5e9875d2547c859a66e2d83e2dc693
SHA512 142b44f2afc2adba6658713852f641948b7be792ae807a7146f3fe42e88b4486d38e62d23e8195284aee19f8cb5e80c4accdfdbe396a45b69e2870f5725ba0c1
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x47JUQjqirIhCnDHUPfF/yLNiXicJFFS
TLSH
T1A165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2b01dc47433a8b1f612ef5831b2ad500cfb01dd0ec26bd209ee9af0dd15e228d
MD5 ea25275ac76da57a49590bb3aec7b22e
SHA1 99be2bad994cc20c7f9e4f79416a85278d0fa37f
SHA512 667ccb0815898a960201be54a4dcee253e64d34932ed8b51370c2881b1aacc4b2d66d4df5e8456fbd2f19b1277ab35a24e770f28febe32adacea92dda08b6230
SSDEEP 12288:ppsfRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 72106072a5b3357fb5e67b4b81be75b0c7203eea3f65b51bc430c8be0c89d66e
MD5 8b98f4c0daa2d2979234825f1b321d2b
SHA1 606db1e0b4d3c841370d923343b805cbd4988f9f
SHA512 54bdd26e3e78494384624488f489c9bca2cb137e3f2aa442cba9ed7cc0546f46b2297170e743ea5f8168904d7c6bfa522f4ba81b19b891115ccc4850ab854462
SSDEEP 24576:Qt5oUPXPNpkCfalr92KTln1UZKBjb2VB:6oUfHBaCKTl11Bjb0
TLSH
T1FB5508007626D78FC6A940725E36D68CAB707D41FE446F0373C98B3F9476658B6FA282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 1d6d272c2de58eb648dd8a87991302c4c33207b0b59dbcc72c38727b8a25e312
MD5 3d43bcae63babdea9f7a1260d61e9085
SHA1 c60b0fe86cbb38303a86f29f9847a667459f75e1
SHA512 dcf7fcd9b31f613aba8439eb2ab75585047083615d803538dadc2fd170e9d62bd589ec77db9e900b8bc510a2fbfaa2bc8d81749d2cc048ff6911254a8305cc6b
SSDEEP 12288:njKBK7+1r3Ty6of4NHaVtGx0dVgugKq1UCNsCNuCNFWOXTb/bOlZly5ZKT8hEUYC:lsT+BgHIgvNDNpNFWOjbDODlGZKPfhh6
TLSH
T126451A00A5B7E34FC97A90774732958DBBB46C02B7453F0573448D3C9863A6EB6EA392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 859d1ae5e8c64cb7db9334bae123d2ccf10b289cc79e519dc830ea7aab28fd87
MD5 77200a0dd0373213662a3253ab856f89
SHA1 b8cd9766c5448fc23fb44c5c87ba885f2d9c3b6f
SHA512 8566104cea313acfadb57ed51b32f5f2d877cebbedca460973ed964ea60a8fcf835f282b4b4879129eaec3b4dce5bd0f9396f3ddf466bfc732b52c17dcf94594
SSDEEP 12288:NF7ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523A3428D59B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b1fc1536baf6cde012b710ef0fdf4fa5d603162005179f798df94fc5b7c76e10
MD5 cb0a691fc9be25171b5d2cde16d0d3d5
SHA1 9eb37126199acc997f470222afb24c8cd916650d
SHA512 eeb314f6fde76aec69ef7acebb9c99a4ace2bd806e77379499ee070a015305d7a59142adf524fc12669b7c2def0796f011ac969fcdee2c72f34ba4fa21b51a7b
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7gb4mBIBhGFALNiXicJFFRGNzj3
TLSH
T19E65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 39839ac7fc79b2152688670fa3509997e18a1f26be7a1fe2540436a34476b15d
MD5 2bd971412d28da9fa81b914b5d53fffc
SHA1 26c4e3c11653eab9870da89062e170204c872ed1
SHA512 9e4aa0d284a74309e76f2f9533371598c33e05f339de4345ec8f2db51ea481f0964280e516c36e0983f07bec3251727b530213b24536c51e9e809ea8ad23daac
SSDEEP 24576:mG88u8FpJqH1vzria7/mw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t7ZFPqVya7/7LNiXicJFFRGNzj3
TLSH
T1D985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 880e5440b4e013acbb5f5a0b2feb2ae55c486cc6c043f7acd5e32a01e652b64e
MD5 e5f4cc98c420c35f97655fbfef93c019
SHA1 fc57fa43f39b86931f1be8e3fda622686413d602
SHA512 458f2237b6c7ee1081eaf2c110c557b66c0c01920ffcbdc29d74397d56f2ca1cb8c2b82bb0ef5a09d98dbd51fce72c7ca4086e9f2a45194d8f37956bafa8c364
SSDEEP 24576:PPUr+NQM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJQMLNiXicJFFRGNzj3
TLSH
T19A65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3de6ae397ae13611e6fd01fc6ea382cf3ce22f0c3c99bc167e4968cd9814ead6
MD5 e4900bbfdbe93d9b6bd7b1938dd085a8
SHA1 c1ea5a86994b6f3f281d469f35cb80b687667a94
SHA512 a3ae74a6ca6149b0f7218443746ea598865b179a25089c44fa9b72696baf871bb22ca5f9e1a1dc25e0b4c96069962dcfceb567b2fd2a564b397ee6a8acbeecdd
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8LNiXicJFFRGNzj3:CG05lO43bJ7wRGpj3
TLSH
T162D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 73de21bcd292fec48b4a9ceb9a1302e2679fddcc6e8aa274af51ad31bf4d44d6
MD5 0de9a3602b7c80f7e43fc2fb58df8da2
SHA1 b00e9c8d5a71bbfe863148feff9033a0875cf764
SHA512 a8186de83621b770b17865e9b96d28d29010f94f877aa2954a4282b451e8c8a88961c7bebeb2b1dbebb0c681ead8bdcfdbe357e570432e5dec5576433a9212c2
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidni/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ha5POZ3lJt2pasx2+m0LNiXicJFFRGNf
TLSH
T10465BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 366bc21d2b7afe04dda291f9672582cb68adf6768439afc0a731e32710b5b111
MD5 0e97375324d26b06e8d774899ba201b6
SHA1 86ac6696e7b7d3f17b5378de768fc79567352f7a
SHA512 dc7c5ce97b8e6313f04cd17242a08eeed6f10cba896c13f098c46fddbcc71a142c64caaf68a3396077bbe601cbfa78fd1734396b1b47f9279a334dc39854183f
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fko/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Nc/zEOVHFbLNiXicJFFRGNzj3
TLSH
T133858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 23c3b72a424a27abd03408c9ecd9fea982f559114f92faae440b2a6d83cc0553
MD5 42771966cb00f64bc6a0e91a194c3344
SHA1 52bb7d836465e553a086907735187289fd992fd7
SHA512 613de9124ef2878d0caa93f44c647977a6ab16e1e3bec74336ebfa71283dcf2fbf2d2fc4bb05a1fdc653e1070da029bc6df0a02ef4384b56d42d38e247753cb8
SSDEEP 24576:rzkNvNnaFeYhJNtmZBm2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rzMwBtOm2LNiXicJFFRGNzj3
TLSH
T1CA55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7f945ac8a9448746edb19e693abff296cc1b7ae56adf3b1730e070d6d5dbd77d
MD5 d8724f8d4936bf60baac2743e66dc438
SHA1 4c894c8db1be5db7bb83a69c46d48147dc58e7bc
SHA512 5a41522109fdcaa7c5c6fa4e822a22a4d878b0fb327b0ed9fb982919e9d23263c0ce6d79bf2f0ac74b9407205f8865c275202d11993c4a03b0bcaab6dc7d1acf
SSDEEP 24576:1D3FHshBIYQgAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1DVHeBIAAZLNiXicJFFRGNzj3
TLSH
T1ED75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-74-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/480-80-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/480-293-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/480-75-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/1048-0-0x0000000001E10000-0x0000000001E76000-memory.dmp

Download

memory/1048-94-0x0000000000400000-0x0000000001742000-memory.dmp

Download

memory/1048-7-0x0000000000400000-0x0000000001742000-memory.dmp

Download

memory/1048-8-0x0000000001E10000-0x0000000001E76000-memory.dmp

Download

memory/1328-123-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1328-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1328-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1328-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1328-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1836-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1836-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1836-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1836-84-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1836-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1836-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1936-110-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1936-117-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1936-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1936-111-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2068-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2068-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2068-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2068-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3744-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3744-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3744-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3744-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4832-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-37-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-49-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4832-36-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4936-228-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4936-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4936-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4936-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5676-259-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5676-52-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5676-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5676-58-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/5908-63-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5908-70-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5908-278-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5908-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6084-98-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6084-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6084-104-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6084-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6084-311-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/6084-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download