5f3e7ae0381c08813be7332d6d0a6c811c82a1b84dce91a4d8c7272ef427caf9

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 32.1MB
Sample260629-fpwpqaey6j
SHA256 5f3e7ae0381c08813be7332d6d0a6c811c82a1b84dce91a4d8c7272ef427caf9
MD5 909456727608d4aec63228f219462b2d
SHA1 2dcda2a92d45331539e66b18e21e87d9ada9e51a
SHA512 215aff96c9233a77530643086ec8b8c34a10ae992128727bb953ec223b4dd11b0dbe0e5e57afaad3a29d5cfb5fd85bb6155d99927f2029b4d229ea2dc69c32a2
SSDEEP 786432:HFoHuxyW2TTAYWgT0K7SXydU0gaZ/ilxEBEW:K36YW20d
TLSH
T12477D093B3858072F4E241BA556ADF774B28A9250B1195C3F3DC3E295A308D27F3B786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5964	elevation_service.exe
1560	elevation_service.exe
2464	maintenanceservice.exe
4892	OSE.EXE
1128	PerceptionSimulationService.exe
3028	perfhost.exe
2440	ReFsDedupSvc.exe
3520	SensorDataService.exe
256	ssh-agent.exe
5876	AgentService.exe
3132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d884eab2585f03fd.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103843\java.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103843\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000700c30b48407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000664259f28407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083d989f28407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083bc83f28407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000233b25f28407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000017221b48407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057accfb38407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe
5964	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: 33	5312	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5312	AUDIODG.EXE
Token: SeBackupPrivilege	2440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2440	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2440	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2440	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5876	AgentService.exe
Token: 33	3132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3132	SearchIndexer.exe
Token: SeDebugPrivilege	4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	5964	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
4868	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 5728	3132	SearchIndexer.exe	101
PID 3132 wrote to memory of 3316	3132	SearchIndexer.exe	102
PID 3132 wrote to memory of 2816	3132	SearchIndexer.exe	103
PID 3132 wrote to memory of 2364	3132	SearchIndexer.exe	104
PID 3132 wrote to memory of 5796	3132	SearchIndexer.exe	106
PID 3132 wrote to memory of 3336	3132	SearchIndexer.exe	107
PID 3132 wrote to memory of 3684	3132	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2872 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2908 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2908 2916 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2872 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 13e13d254a7ff73e50833ce2dd415063f03f51f97fbdf471748ff4b223045ad1
MD5 0c39e8ab1f3d0f858db957d685254be8
SHA1 e13409db3770d94279ae599245c27914b26ddd18
SHA512 59db2a40a970ab46c482fb82663cb0d91a6a1609bbc75c6384a88b6097661941760ece80e6c5112b9cebb92a981b27ae7fa6a2d9b794289e82f7e43021cf00e7
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn4LNiXicJFFRGNzj3:63q6mjB/7wRGpj3
TLSH
T1E7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 066b373b5181143ae61186791bb4fb9306f67021dd9eaf814fa33c6ad45e2a3a
MD5 72874ff22c18f1f1e8ef5ef39809ec3e
SHA1 a0c408e7d437f00e9b5862f1f42058a877a3c290
SHA512 b21ad0aaf59ef6abe8dc3b2aa3890c360508557068d2957fdf3fc2e9657c5c1e02d137bfa5b0ad5bd64fbd61234c447be65862f84a33c1d35a469a7883236788
SSDEEP 24576:6XYfDtczAL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:htcuLNiXicJFFRGNzj3
TLSH
T13575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4f8e13f323f2684557d1b2a5dd5b0315387452ca8381422322c1072d7a4bfaf9
MD5 e60864ba04b9df461d33d04c73e2bd2e
SHA1 0971785dee67325a9f2cfe70d7ac017c7346895f
SHA512 9f6085048ca42ee0a7eb10a624ede4d39bfc9d1380035555f57497e433e88286c388a890485ce867649bfc06cb21b7c51e2c9b4e473db8b796fe57f1c828a3d8
SSDEEP 24576:q0Le5ji0hmxhrMA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qPji0AzlLNiXicJFFRGNzj3
TLSH
T153859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b86676ce86cc6eb45302ede9a0371c1152a31ae323b0cb07c5a8526d0aed7503
MD5 a84e667d0b31401946faf72c9f632ea3
SHA1 d90c7215585c9455db4a0b7419b07fd7a40ba1d8
SHA512 531c946c09b1ad3e2f1f40046ad6e3027e135cd64cd50c8bda70ead1b31891a531311eae2ee8408586ec6abfc32ae33f99e47ed99e5a02090bc7e59c26cacc9f
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWj6q8wyue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u/ezSC6vUzPv+HjyBLNiXicJFFRGNzj3
TLSH
T19A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e5191ea96bca5e7da7a4f635ea46976f8f409d2878b05ddeb249745f11fe7381
MD5 c22853ed61e14aa8a847196ec59243ab
SHA1 c3821ba45de4c467f10e5b26943c146b407bf38e
SHA512 91ac48360ce7bc8be219a0256e0d53d4d993cdda7dba54993591fb2b7a90649c60529b3df6873337ebc6fc5c12c3e78f6a72cfb557d2f807ddd1b36d672eeef8
SSDEEP 24576:FVbqPb88hv/l+Bv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+FLNiXicJFFRGNzj3
TLSH
T1AE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bf9bc7acf3b032888e3bea6892f1ffd2d952888ebc6d9279a15335145dc26cf9
MD5 415c445794b321aaf36df29ccb065e5c
SHA1 89397d7539bcd1e329dfb4cb495595c9b64f5c3e
SHA512 fa30b3bfffbe06de4351d2a774d7af88317941a06bf9132ed295d0d26077d122329d0b018cdde0fbadf50ce70097725f01fac8140b07b7a1a0c12d270e4c2e58
SSDEEP 24576:rG0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1505523D3468854B1FBFD003A867A5828B5845E2C9A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 121b4d92951de39cbb18486e2b9679fe89147db58eea24e974ef5e1142db68e7
MD5 e0741f048c53be51cc0f573d4c73dc40
SHA1 cc7239e535ec425e3b201ed70ea5ee525b82a37a
SHA512 5154756de01c41b7cc513dcaede2f732f9486c2b8639dc1e04d55684c5b54579d9ae8deb6b5da20697878eb5c2fb5a149cc14ec318925f8e481debf3db9850ab
SSDEEP 24576:fJIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJIU3LNiXicJFFRGNzj3
TLSH
T17A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7f493509cd754daa910f69895c73a80558364c66493fdba4f4dc8d3dfe240325
MD5 2e67bb92484a7475dbccdca92a0bb936
SHA1 a04930b4243fb5e99064be91ca5fc4332c1fe306
SHA512 423ea812cd8a991d16e3f74fc492da836ad428bc7a96c2f0f0d10fde7967e0599785b0c55145d78376015c146df59dc4a6cdd246a60e08a82205dc3ba9b35e3e
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:mQvGAdlCEL8c/WRNw5CO7wRGpj3
TLSH
T1DB266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 11880a8ddd16a9e5659aff6d6e1381469aa45ad8cf15b99a70e5b0a8867f1e41
MD5 50cd2f6662138ce79a1ad9d57ad0e03e
SHA1 c0003dfd107b78dc9bf84170782abe43fbc028f6
SHA512 ce2867cfec306fb7cf2723217be5f27638cdb28092c807dced60e23b02c09ddc9381362b29f50600912c4f55556775f80cd0016652b54548653e813249f9e33c
SSDEEP 24576:PfewsAjV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XljVLNiXicJFFRGNzj3
TLSH
T12275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fcc6d0fa27d1866997f5334d3f2f2e7d4af7818ce03653873b4ba2640b65f4c5
MD5 c96d0d07542f4d983686b51055dd905e
SHA1 04e6cfb0f5d9c4b0b45d36304de64340b8a48b31
SHA512 1a76079f1fcc6f1d1ef477e5863ccd8f6d1bf705e8d254cfc79dfbb76103ab6994fa7b477f14df5ece8a81f1bd09f73295c2df248d52a8ff280c58301df7fa19
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRF9:cUEtQevvqc2W1cpV20I32H9
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 478382f22dfc9bc70421f5fcca2f282c82842b656cdb9a543ada43696ec4d31c
MD5 813b649f4fa3a863e445c1bccc895a49
SHA1 b558635a1622f59e5aef41a08845fa06ec3f8d1a
SHA512 d41efd3ca8e02f3c802c871dec003a21ed742c467d1fa1f46a4f433d76f1bdbbdb6302614c4e8ebe52cc5632bd54fac11b65488186ba263c566b9cb8c3f3b4c4
SSDEEP 49152:QCbRquA/m2yL5zLfFiV+XenmE3/z1LNiXicJFFRGNzj3:5oq2VjnmK7wRGpj3
TLSH
T198D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 37987f8c119db168a156193f5e74d1158da4afcca42a394f9daa7dbf4f9e80e0
MD5 ccbb85a291d117013df58f31be53809b
SHA1 26a5840ca32993998b261d38f62243dd5437df7e
SHA512 24e3cd738503b5746e75ca68618be5fda9d5fcfd5d9477bae5f3ab33b22ba1befeb18d846316c17bc63523a94c0717b850544b67313dcbe544c4f9df0ba15746
SSDEEP 24576:oAhGL6IFoiwtA5l7S53q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oAM5Foiq56LNiXicJFFRGNzj3
TLSH
T1BF359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d27abe93cfdc35e3a3d1c0500702364f153f2b6d2b9fbfdc37a70b7a7b4035ef
MD5 863e8b9c6c41c3f2e72efc88091b3fcc
SHA1 fec8c5b807211c69d4981e1b37e203725ca03c46
SHA512 5fca1e3a38daef76cec0fb2bf44c1bd6b13b11c880c02b35d002325e3471f87f95c369f24b252688db14760ab027edc3fd11deb7be877d3c3894fb72f5a4d82d
SSDEEP 24576:uwuROWh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uwSOGLNiXicJFFRGNzj3
TLSH
T10C65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 03f6370044231d673a42be6ee557c346e7018b54313a9f0bfe3beeb20ddfb3fa
MD5 f6425013dc089d6ee7324831efa5f388
SHA1 610edc02b178899cc72a3a6607104a2d42ea09c2
SHA512 712e256ab5e14d508c022c7de1f9efdd6512d648d454fafc2c3bdfed50ad846c8c68b9a3e07d22373b24fb76782802c00fecf274fa8b48a21a865f57fab07f29
SSDEEP 24576:SZuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T19655129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e46813bd1e73099d22a079eb8148eb657f6ba4c97e629e2d948563acc097e3cc
MD5 1324448d8a3347230b17da9f09bebab2
SHA1 2da342b198f4627ab3aae5e1b5b865e635be6117
SHA512 7ec949d7be95c41618df3050e967759d4103222af07976923f258740f698e01b7591a3b624f37d88f5bca435defe8cda15235af0b0ca1e414f19c0a49fca7d9c
SSDEEP 98304:lQRQyi36YOcPDLvw2gAf+PN3z7wRGpj3:cQyiKanX+PN3F9
TLSH
T18E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 05bf236dfcd9f7e4755ec76c247e13f3163e78a2439d47a4d2445350942a948e
MD5 0f83ef40918bf6ad3500f1f28ad4fe54
SHA1 f43550842f962c1057239a00e61cd6e632673981
SHA512 4f21c78fe2ce588f09182fc604840ccbb9ffdf307cef483b5ecf4c1be8a06f20b8a428d70f35b47edd0e1fbe3fb306beef07d3a01d07565c60be1f507180e684
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3z7wRGpj3:zQyiKanX+PN3F9
TLSH
T1AC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9d5a3cd7aa2bc8dc1d035920139039bd8414c6568fa5a161acc03716b7c78fed
MD5 e234eda338fdccef07e8a40347c7303a
SHA1 e8cbf91944ad34d6bf8b48828e183d64ce337ca2
SHA512 13b35547691b5aab3d1976bce61551fced7f4dc4859c48b36549edb535b4628127f680d651240227b92bd078c5be6a44064217a4296c1f8847f0388f6cfbff0f
SSDEEP 49152:K68Qg55nhkeWu7PNU3/lLNiXicJFFRGNzj3:4thTRc/l7wRGpj3
TLSH
T119B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c08e5236c8b0f96842837b4a19c0e880887d329d80e282019bf00ec5997b707b
MD5 ebc81109a91504c041f52d712966c52d
SHA1 bd25df248b8e9e1697d214c2e6e4eab3300e4921
SHA512 7f49a01bea40876cac97c7da5baf2872fef0f86d03b04fba91545b714c495410e8e6295ec39e65a3ca488844cf921cf6deb7d208186b6745d61230c055843407
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZ07wRGpj3:7LIHRWhGF9
TLSH
T14A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51ae0f10c091fd9bc1e40deaa8bc6bdeae33dc6205f66dd7bc80e82dd36e2ac8
MD5 5d40f6e85b9cb3de7981ef9890794ee3
SHA1 5d01cbdbc5b0222edb8d0f6ead2029e97c9be45f
SHA512 53682a8820ed493dff57844bc87967d8e0f1eaaf635a0a3067de456fa55f9431d6146222f46430b23d104149bbd46dde9bfcc081ce004b4fc9092c6067ec0c3b
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glbLNiXicJFFRGNzj3:Mu6JmIxd2db7wRGpj3
TLSH
T1DFD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c5e747e8308a2cef8a5a19a44757068665b8f9bc85ac7b320f29738c16742fe5
MD5 dad6e93329dc27b77b2b1dfb482856aa
SHA1 7f78913d4fcef9233aa9e54305c406fb48ff19d5
SHA512 6b5670ded15877c6a0bf6f0a957f2e975dce96befe0b53332f61550fcaf004fe0a1be7682a1ab452f9b5724c517e7d0b6ed35f9e1ffd720be469ea3b4c4f2b60
SSDEEP 49152:21hpsNoJpF1A67U44CwH7R4xXLNiXicJFFRGNzj3:2mifPqRK7wRGpj3
TLSH
T165B5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 208936b3c7b08573dd5d76ea2517fd1fb721f052701a80a26acd7ed897fc53a3
MD5 ea3cd23a9a1d2cf04af01d08a10ae134
SHA1 4e8da793eeaf8fa32029c143518d9cc3a23fc03f
SHA512 ab6e1d839eb59ac44a6c2ea10e07c38271fb7573e7ed9bd56164715b5d5a91e267d2a4750407d6010ffe54e8ac7dcac3a4fe9b96229770899c6606ccb76c9c37
SSDEEP 49152:6SuZQIY0Be2KkRVtOnks6NMHqoLNiXicJFFRGNzj3:k5dKqi61o7wRGpj3
TLSH
T11EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a8e9c3cd92df34ca94c10d2099e1330650498399c3e26fea1cd207975fe4d95e
MD5 7ce25cf80c4099627594dbbfc63ce0f7
SHA1 f92ab22b0b6b4e3143875dd97d108a9b66ccdcdf
SHA512 4b40ee6da9f1bd31445cfb55b17d7f7553e68835612494dda84de0ca1c3e33f961de668ee70b21e79e40fa474e050eebfd32b181eae8975e27fe32848d922173
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wLLNiXicJFFRGNzj3:/X2iWphm7wRGpj3
TLSH
T1C795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dfbaaf881c8032a1b5ae88bd9b444d579a88313ab2b01977baf4faab7aad4ca5
MD5 adb75a7608308823156e17f780d1dd98
SHA1 e1e59f5ab1e788c67ac40af63d9142ea0b0cd77f
SHA512 1c446cf2776f280a25d54f0c029eb7fac8461c0be8d8c6e8b526e739696ba543812a5144d31383c0e0ee90de818d6534e8638f930227b570b3f4e6ba4609debe
SSDEEP 12288:X6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 38cf884fe9a4c6e48e84dcb8d9a8ebbeaf59778131af346259a7602ddde7bfa4
MD5 05edf0c669fbd03eef3b52e05929063c
SHA1 9b1f2f226dbdf90fffde4cd602c4b89b5b8da60f
SHA512 8c00d9855b90fde7f68d386cc54fe149c48da167bd417696f0402f50cd4a18b3a00ed7a15502db1600dd083c299156a2e9c2313f34aab3d58a5aa18787cf4a2b
SSDEEP 12288:5ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:55/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D3548945B1FABC0039C6754428F5886E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aa550d3ccc0834b4387dee3855eaf9b4659a239dee14ce9f69c67c02b266e558
MD5 f6f64264442c6102ea4811c1598a12e0
SHA1 d676604a121799cb19ebaadea530a4ee87662035
SHA512 f99a7785d3e404fb3ee36a3c0674205f4461ffd2ee9f93389f241ed213804904f39546c68500c37559cc059aa2793a7e6c32598d91b52bd0ed2b490080f90e04
SSDEEP 12288:IriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F45523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1056be8cd21597d2aa9c02309932f0b3b832dab885ab6abf16edce80801e0a91
MD5 71eb6d79e6aa32ad5713ba6cf4043e4a
SHA1 cef08df993598f72b8ba898419ae090b64ab1cd1
SHA512 976885c58afa353b23af7f0ab78201df71e92db77a7593b68a82d5a57a9a80ccb0d42a280539781c93ca26b3e0ca01dda9dc2464cc74360f49ffc563ffac0524
SSDEEP 12288:qV4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E1552393168900F1E9F98039C6764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e0ae38da16fb8ed20938747744345695d5f3a4cfc1d00126ad286b595b2e2bd7
MD5 cb9fc459d72bbebefd598f6d73ada307
SHA1 3086e79c5e60394a8c261d97406e20aa3c85a5cb
SHA512 d889614abdeef8d8a44b8359a8d0724caac9982279495949083fe2a65de6f3c7cf05a565c9939fa6ea18868dc897746572621e28b6ec161254d9ef03173b3947
SSDEEP 12288:SQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 37fda62df09f64db18522df24ff307dffae937d4e234acd2cea7fc2166132e40
MD5 a6464f7e15ec9dd012dbb0fc18d51dd7
SHA1 89a64aa832dc58d1757207794a4a1b7c93dac1f9
SHA512 a10a7d9a5a299a508e759919835f29f711e0db79447c154950afed23d74b06ed1f5df12e83ec676b70574630ebcd0e8178e89ce9709b86c02b96cd4b1aa87c93
SSDEEP 12288:ERiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ed/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3548955B2F6BC0039C6754428F5882E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 41036cf7cc60bdf3fed79c99b3c15349807f62d18853748ce82b99d64e5ed363
MD5 0545ee52071fd958a526f1d835d56e47
SHA1 4333608a644b0a64a14e88512144b9d3e8855033
SHA512 e4a8d7ffc9a1bddb7ef42864936371f0cf80cd13aabab47b92f4530168e3b0ebd96d5483c20aceefcbefa498843108943384f6576085709b71fefd639c35f987
SSDEEP 12288:0tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3558945B1F6BC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 28d1a7c1ebf1af7f7077faed209d39ee937d616fc8d0257063661f9ac43fe2bd
MD5 4f83d01764292ff7838b5e266babd0a0
SHA1 79b6a991a2d18634caecba3d5879d1c4e0bf5090
SHA512 2bc44a6b88ac350ab31b7e4f2130e650eb735e34274d8bae05d39304cfae6ea28d449a87fcbcf78192c9f0dac747354eb154d658805847e2a79719767984d2ef
SSDEEP 24576:HZM3zFVSOZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZM3zfNLNiXicJFFRGNzj3
TLSH
T198750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 94c13da77227f8c2844fd45d640ef3cb719b9fe4fb6849323c58b089a74761a4
MD5 c9eea4cd403135d341ec64058ace281e
SHA1 dc9c152c5a106a374ab67e3b136873fac09bb179
SHA512 7934b701dd32a5ebbc883fcd68b1c7b11504ad12eeaa1e3472b7241ef890d82a4f9b1b77e8e16b32662cc98a059b1e9b1551ff45bbfe48716c763985e40e6c48
SSDEEP 12288:quiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34zE:qY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9e96ef9980d628ae69177bc81264d524838b2889487c95e92e4858b2fa3773b6
MD5 15284c7904fc899d205d6d4ffdc9eadd
SHA1 d963882590620499bca3aa84746ee3293cfd1630
SHA512 19abd54fb06b9ae799244e4b766c1ee25f5f93cb4722ad858b86311ccb7fca106cc9c5aad7b014abfd1b44749cb0645aa09d69c65c7859ae137db0e031a76edf
SSDEEP 12288:KiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2ce1cf4480ffe3dad6d50e918bbda8bf992b47514830eee02aac4e4d3dfbac17
MD5 bbab704bff3fb88ae3ef8e3cf7c204f3
SHA1 4c6678d414bffcad5ef1d789fc346efd71daeee2
SHA512 f6b173a1db48497906876e973bc19642cb671b448984fc98dff365f679de6bd3a392d0c5857e8a4deb5263f2606d5d8ca068861dcafadd7a169a7ef5d15c19d3
SSDEEP 24576:UzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UmLNiXicJFFRGNzj3
TLSH
T1FC650147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 889aa62b957fc18c0b33e6a1b9d17bef48b4db9b985a6126eeeb0672588c772c
MD5 41eaf4e20e052b3b6a060377eed28ae5
SHA1 2193ed9681bb5c930145928ba07e10c9e46b8d19
SHA512 d73322a3eac43fbf92f4199eb03bee83795f53707f5189eaecdccde131fbcf28e90d44c4350623e0d37c2f41fae3e757d81325b64a88edf576f548121e7a44cf
SSDEEP 12288:vuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FAFC0039C6754428F5886E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aa492bad66bba46a3edbed5c1555aba917b1c533466474d02691742a719d350e
MD5 e914e03d709c31520a5cfeba53c6c287
SHA1 66ea561a87351a7f5baaac0dea53025d1cd19aa1
SHA512 bc84f47ff908d064499228aecf5ed2ad59799b6e862002fcd0d4431e535cb7b8dfe1b3f96e06153ed1aba835aa1d922e9dafcd9b712b95f5fe12e105c439604a
SSDEEP 12288:VuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d07595bf8acf6186283fdb9ee17b341e38852d02b7a36bc91ad2b763ffd93db4
MD5 3f655dc5b820ee792a0e007d5832aa1b
SHA1 1a1062cb85720e94c277888b893cd44bace8aa83
SHA512 41bd5b14704abeb62337ab9ebb6e773062303b0837585dff99e143a11cd7debbf519459326f484090b844e3bc8f76ee16c42506a640195e1c8f9173b42c7f1a5
SSDEEP 24576:6zyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6mLNiXicJFFRGNzj3
TLSH
T12B650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b78e9f1e3bbd8a303a6ff1ba07e20a33c9509550fcbfb0520a02edaf0a50eac7
MD5 69678e6a53941c31397eb39d49993475
SHA1 23ac53488369b7b1cdebc2ca6b67dc699424a294
SHA512 71ec74c0181b707e474af9a8c8548eac419f9671ea330ba7e728327a35306a8888f9b1e77c3b2481727fc9bace103c1d051d6238e9463cfe0239d0a7e67475ba
SSDEEP 24576:2T8aLl3z0zDP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2T7LljeLNiXicJFFRGNzj3
TLSH
T15C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a40686eb8b198e8be9dc85b2dfce50158adf72b17e515f4f02a4ee06a384b57d
MD5 337f5b0e082d2de5a08a9f9a14dea569
SHA1 37a3d4e7218d3ab23d4845f7d41ff8b276e51514
SHA512 11e841b174699236e77e51e6578e219b8897f72a2e737c1a3a2b87c2c36b8912db4b2a5f8a35a4b54b5f0ff9404d9301e8dabdb2f094254e95d075bf1691b3a9
SSDEEP 24576:/3rd9CHKy7GZT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Prd9CHKyaNLNiXicJFFRGNzj3
TLSH
T14F85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9efd5391aa13588c1e5c2c74ebec36f3d020dc7b36548c84a0689c0a3e287873
MD5 9fd41617fc54759e6290620fbf122dda
SHA1 c24518edcb58015af68e633d3e4ef19f323d91d7
SHA512 bc7604e8e354e2e77b42c97c33a22f0fcad00b6616a7455e8b01d091e4f959d5b2532bb4e66a2bd43d98074a6297e39eec125a751d2bc7fb0415cd2d41a06a13
SSDEEP 12288:zLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9244d9443a1d486b8240fa66a00db226b792802cf9ddbc782e4d48e516fd7373
MD5 bb4609cd242e10b6f718b4dab93bd291
SHA1 0422f5a594f4fe8257d3ca98ad1ad4072b00c22f
SHA512 af8d5203f88e7d2f747d826a83c9b37d4d5278f0cc52dd8c9aca43f5f2d5c81c1065c2e345553afb6f75531a839d8f61fab656c1565919520d9aa47105950198
SSDEEP 12288:O5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ol/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7a0a5079bc9d66e3e572f6628f5a42453bc3c327ddb62f734ddb3ef05de2e0f3
MD5 823a6d68f22adea94b727604c2481215
SHA1 677ccccd2a691c472e038eee65a24757f0c39e4a
SHA512 c14f247fdeb552b2fdfd3ce5327eec3e341b45d9e5b2dc7f19a651c6fe16a9e6b991a53feecb4bce32e79409851b1497ffc2bd1ae8aedb9e0bf8d48c7019d1e4
SSDEEP 12288:ksiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d20d8c0d1881432b3743a4ac87e09a0edbd2afbfb8c8234e64e52441fd079f3e
MD5 e67b1badcb6edb82feea8c316bec67f5
SHA1 5dc9576c647834f5045979ae5ed18dd1b13ec50a
SHA512 d6d81c1a6265d78fa9fc11c8c172a3174ebc3dc53ed90f2de73a9f3cbdc080316f71ce6c6a951f1a592e76442841eafab429b31da5523178120484b3eb52dcd3
SSDEEP 12288:KuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 73e9826a4c807039a9688bc90f16f35260ce1a9316d10ee11b38bf6ed4ef7e0a
MD5 8baee06faf971baf7c726726dd31675b
SHA1 a2ba652082aaddd7b288c10c3cbea63299895e7b
SHA512 1eba0ab6df4c97ac2fbaa9f39c4015b810eede7caa00a9c1749b7d4a1fefa6356023190e74817b4999ee55330ffd94fc5002b40f2b3df29bc8c7518cf9a939eb
SSDEEP 12288:SLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 97befb13a0271383ff28622668eb665c6d087d5322dc58e076831abc0d3f8801
MD5 6a284aae6c172e7b334cb50e648db616
SHA1 b144ea7afc8a258380c88d6e9de5bb2c12492cf4
SHA512 de183f6bdb882bf96c8f5d30ce42a5dc6a9f23b7f91c27554af32d24f3d8030806fe597da7118e46b49f65375c5b119d721a35ff0187f9791e0fb81d21b5b01e
SSDEEP 12288:+miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3558945B1EABC0039C6764428F5882E2DEB5619E3E3043D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f7104315426d77ef440f2f786df0481540257f2e62f2c6df95cabbdd744f04a7
MD5 83c2a3fc4d75112e9dc599e7cefe9985
SHA1 20f3ff980fcf385a82b3076f7d12538ce1325509
SHA512 fcfcb6022fbf5a412b3f19707e8f9a5df9b032623efd79581336eae64080764534d7d62c32448e1d5524045e1f36d3e61151b80f9cc8dc173306cad587d5cd96
SSDEEP 12288:0QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6c4ee8c93dd465e718b554955f0fd8bfaa9a979014e2c67f44ea69d1e37aeaff
MD5 85c41ffc64bc98e6beb701fe9dc4b744
SHA1 4234d9eaa1a0120660c1bbbd15f1c919dd3d8618
SHA512 d5307ddd7b34256f28e4857a5024e038aba05ed5c94a7faefaa7d5fb3ce14bb81e16b82e9731764b003fc34697b075f02cfc1a3d8966bbc83fff36b1f59db3c1
SSDEEP 24576:Pfwvzk9RX6wkyAIU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KMnYIULNiXicJFFRGNzj3
TLSH
T10D85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8faf995dba5f20c29d96238315c1f3956e52c0b7491afcf88e34b30419bb7621
MD5 2290fa491efccbeb79617908789beba3
SHA1 57f1b0ab2e760e300b417d0e3066e878b7ccb0d1
SHA512 4302eb459e196e515a573b2517ee6c8e8e077f7bb0e183fa53365c9d846fc3183fecbc9e522463b485847acc14a724c5a9dba28525dc4cf200f1cad3dc184706
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rLNiXicJFFRGN:zySzPT7wRGpj3
TLSH
T140066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c8249d903167a2729dfed9bec55e6c0d5f1dbd38bfb28c8a1eb20c11050a3ec5
MD5 9115bde5b77bfdd40f1fe6642a38b2c9
SHA1 b7cab46e6dc3d96ff4a9839cc4a0c2a0a628f55f
SHA512 3e824716fdef16af32cd3857f6b7ec5887b3ed1f04add121edff03ebe69bbae7c2e5226cf2b81ca2ae8301c8119a7da60d689b716d145cd6a9b48083071a9f20
SSDEEP 24576:f47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f47JUQjqirIhCnDHUPfF/bLNiXicJFFS
TLSH
T1EE65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a4f55f0bebf85ea51b991cb91f5e61c604b4dedb55dd399c0585890f4ef970aa
MD5 32d0072813d9035c900458f2a833c409
SHA1 ef355b7fd4c9941c1b1ce60834f3e29287a4f8c5
SHA512 68efe63a257548239d1baa9962660a16b281bb4055f98cbf81627baa4511c11270240002b6855ba69e54839371461c0779ca58b0bf195a5002b93b133742c5bb
SSDEEP 12288:7psfeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 dc258afaabdc4fa424faeceafe6f8f15a614a939f3df1fd6f591988ac0756fe9
MD5 d67da92252c224c2ea1ca31afe1d3fd6
SHA1 4d51ef9824118c2bb365010f8137f482e253c751
SHA512 9194c4d4b1e9f8e54681d03d3716e7beb5d4f509106b0a142c608067f0ea62da334d27a542d310e2c2944641d23a26824d82b83fff4a7e67a12b25f51a37d6a1
SSDEEP 6144:9sBC2napWRuG0b5L/ABa+/IibotMxc9PRU3f2klvgbg+K8NWpwlI5865YJR3auQP:qQx/7LU3fXsE86yXbreDZ2rSPudTEN5
TLSH
T171351701B66AC78FC6A940725E37C1CCA7707D41EE45AF0373C9872FC576658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 13bea80f764ef79a9cdf197ae5b4cc7e76a172f755addbcf9f7aaa0dda3b39be
MD5 6f1d03e4ab3216aad5be629b2690c695
SHA1 b7d53a4e1ce0a165628bf64a4347e93bd7b69f7c
SHA512 24b676b7c8d8a9a0cb48a593b8662b85dc2c87993ef2ab5f4e8b8a1c42e21e7e14d36f29a5a1ee362573b6461ec04d426a75932b3ad853b6548e8da21f99214e
SSDEEP 6144:drQB5DM4DBCXTjYfAIfIYIUIq3Qbd2CvRFx4VwRFV5RiDtMxRiDtMxcL7OXUD1nW:dmLmhpbjE1nxzY
TLSH
T17255E7409536E3CFD1B66072072A9B0CAB64EC07B7496F26B3C9043ED86A755A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2c0497be5932cc6e25938f7cd827093b90199ea1f0c181ce307071685a7dd16b
MD5 be5bf97d730dbf2372c30dda2e0fd726
SHA1 f919686c75a0b55bad094f29868ee28c7acdfe27
SHA512 36108f0f47c1baf46c3c6454f24b512a3198242b504f679bb45bcc87e51d9d39e50ec87a26693d470eb61aa291e8272cb0d525968beec38729f912f1c8a1ecbd
SSDEEP 12288:cF7WiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T140552393428D59B1FAFD1039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a788b37fabd78716239cad5f91dff51d326710f47ddb47f8263b1be5999d6b71
MD5 434f933074c0dfd3b8a7b7c330e2489b
SHA1 1526185dbe660749f169fda71067d95eca6387c1
SHA512 50fe54197e389f03950906680b55fe03efe190b7d51388b9fbb6a2655896c7b20b11a30da86c87fdae0d6a86f829148bd79962629cdee9e2cfc2fdabb7bbc1cb
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ygb4mBIBhGFJLNiXicJFFRGNzj3
TLSH
T1E265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6c43d694efed02498f6f7ee02299440f1d5b91f05168f7767a5b0daf0c42bff7
MD5 e1258b7e547ed8515b001e1e1a90ccb2
SHA1 01a90b997b2adede38d21c8f67f57cf8dae03db4
SHA512 a272c884210694785f1b6d4483b52e42ae1e1684379d283ee09c66e508618e13976478ff5adac8051e0b178863eebf7258e8ab37bc7ae5d0473aa699745c7f3e
SSDEEP 24576:RG88u8FpJqH1vzria7/mZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:07ZFPqVya7/2LNiXicJFFRGNzj3
TLSH
T15D85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8e88ea3f2ab17f72bc278f9584b722df4023042f4ddb7264f349096e32feba3a
MD5 3485c5376f08b94a620b5295595b7a5b
SHA1 2e838fc88c62c328480fd2fae5eb7112868a9bb3
SHA512 95bcca259f85ba2faf50fd8126108fe843c2b5fae19a0e48d28deabbe2e0da744a43043f72370e2690531127861e832dbb06bd4d1dabb6b176e6bd9795df320a
SSDEEP 24576:+PUr+NQN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JQNLNiXicJFFRGNzj3
TLSH
T1CB65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9b879a74e853ba2a91ea16152fd5655e1a0b4689859b15aa610bfaaa7b90ad4d
MD5 e59aef4d7b64270a0dc62303a6501a21
SHA1 0713293ced4c56ecb136ac3c3c9b9f1fcbce27e1
SHA512 d9c08cb5cd455a4348bcb79f7bae322cd047f19741a1cedad2c8c12df41d2522b1c80f2654deb7179fa3189e57809c84442379ca19fdcdb16d0ddd2c695d6c61
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdLNiXicJFFRGNzj3:CG05lO43bM7wRGpj3
TLSH
T194D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d11b75b658554640837e0b1726f73852b6a8271a43b14119543689568c9a66db
MD5 2d6d5f861592fad8e24f0f219e66ab32
SHA1 3baceb5f0b07bf765bff976979e258d2ccbb7608
SHA512 2d03338a8bca6a092ae368b4a94caefb7cb1eb721760519b64844c00e1de431868378f9a70af47de3a4388d15d94d2a83e0d649c9f8ab00998462208d922eda0
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidnr/TwSfVcYG3K/cJHlnFR+IGNe8jg:qa5POZ3lJt2pasx2+mlLNiXicJFFRGNf
TLSH
T15E65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2457f20ab516cd4b8be944b3d41b58feb2e4d5ad45ceb45affe0c33549402fec
MD5 7c5276cf6098d01f865a4ab2e118be63
SHA1 75a1a8ff29f3f3a3ba953231e9861b928af426d6
SHA512 84774a70eb402cb258e343f50cd269e21c6df7416ed2098a40ebf9ac22b214d9890db433f032eeb97ef5a126d9b7542ec49cbfb98f2e70342952e2cd4caa185b
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZNc/zEOVHFWLNiXicJFFRGNzj3
TLSH
T187858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d77fffe425fd0768d548d64a7403f1f245564859bf0dee12a2ef6e8f3f9ff635
MD5 d4534000e8229b0cf3d9efbe3d844439
SHA1 1085f5c8b80448bbea74f6626a198cd59dd3ced5
SHA512 8ed45cb9f94d202f3b8b97b7adf0c2cebb4c419b4131ecf455f607550f01ce4dacb473db94a9b70f039cf3ad93b74fef03de61208ed54f3d28b4ce5d7061faa8
SSDEEP 24576:PzkNvNnaFeYhJNtmZBmn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PzMwBtOmnLNiXicJFFRGNzj3
TLSH
T14A55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 05e077adf24d5543e63428460e865cfeab971bd031a5f1857e0ac88e9d6cb03a
MD5 ca3d38a64508ce4d96794d8386b4c24b
SHA1 5d1d5e3db53c894c42b9f0bc9b2c4ddf2165123a
SHA512 a93cdd6338d989e8392d27154e6a429a6868b85cb2abfcdc21d828ae345883ec7e3bfd6a637c1ca75e8dfc6cfbb57274f44e3b230799ba843b9a984b43c70d53
SSDEEP 24576:eD3FHshBIYQgA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eDVHeBIAA8LNiXicJFFRGNzj3
TLSH
T1DD75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/256-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/256-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/256-113-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1128-245-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1128-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1128-65-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1128-71-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1560-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1560-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2440-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2440-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2440-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2440-324-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2440-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2440-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2464-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2464-48-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2464-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2464-38-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2464-44-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3028-280-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3028-84-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3028-75-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3028-80-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3132-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3132-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3132-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3132-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3520-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3520-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3520-309-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4868-5-0x0000000004250000-0x00000000042B6000-memory.dmp

Download

memory/4868-8-0x0000000000400000-0x0000000002454000-memory.dmp

Download

memory/4868-0-0x0000000004250000-0x00000000042B6000-memory.dmp

Download

memory/4868-83-0x0000000000400000-0x0000000002454000-memory.dmp

Download

memory/4892-171-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4892-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4892-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4892-61-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5876-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5876-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5876-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5876-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5964-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5964-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5964-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5964-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download