859742a81936855a1b3863385c79c83dc6c9504692f9b7da553a0b466843a3c7

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Size 3.7MB
Sample260704-s52bcsds8p
SHA256 859742a81936855a1b3863385c79c83dc6c9504692f9b7da553a0b466843a3c7
MD5 2ce28ca2511f17f7a2c575e9228994f2
SHA1 2378b5dd01cee5f0af4a78224024d8c6af26804e
SHA512 74f96ce47eacf7c3f4edbc0253d4e8011a630810fd093aa671ddaf9d4db5e7f738faaef490223d48cfa3289cdc475dd8dd52da39e8ea065daf0155abbd7a1b7b
SSDEEP 49152:g91VXDz0hDlEU7P8h6+cu/XntP/o+NEideyB6dCFc7mNAzJG:g91JU7P8vcu/to+qCww7
TLSH
T12F06BF11B69544B1F99202B4A5799B7A493FBC314B3CC8C3D3D02EAD98316C17B3A76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
704	elevation_service.exe
3772	elevation_service.exe
1496	maintenanceservice.exe
4220	OSE.EXE
1356	PerceptionSimulationService.exe
2764	perfhost.exe
2828	ReFsDedupSvc.exe
3244	SensorDataService.exe
2616	ssh-agent.exe
2768	AgentService.exe
3048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2443a0ad4a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079facbe5cb0bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d161db22cc0bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000168e2ee4cb0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e6e5be4cb0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009c3f1e5cb0bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000267a42e4cb0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9d848e4cb0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000ba516e5cb0bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
704	elevation_service.exe
704	elevation_service.exe
704	elevation_service.exe
704	elevation_service.exe
704	elevation_service.exe
704	elevation_service.exe
704	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe
3772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1220	2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Token: SeAssignPrimaryTokenPrivilege	2768	AgentService.exe
Token: SeBackupPrivilege	2828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2828	ReFsDedupSvc.exe
Token: 33	3048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3048	SearchIndexer.exe
Token: SeDebugPrivilege	704	elevation_service.exe
Token: SeDebugPrivilege	3772	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4480	3048	SearchIndexer.exe	99
PID 3048 wrote to memory of 3952	3048	SearchIndexer.exe	100
PID 3048 wrote to memory of 1288	3048	SearchIndexer.exe	101
PID 3048 wrote to memory of 5592	3048	SearchIndexer.exe	102
PID 3048 wrote to memory of 692	3048	SearchIndexer.exe	106
PID 3048 wrote to memory of 3560	3048	SearchIndexer.exe	107
PID 3048 wrote to memory of 2264	3048	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_2ce28ca2511f17f7a2c575e9228994f2_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 26cedfd0d196c114786461dd5df6fd09f3ecaa9e288dc493224260d513580be4
MD5 af0432a4780f7b502b702a2e0754ea40
SHA1 52d38d57f8c1b487253fdf98eb2283c8cfed10a8
SHA512 8ca9041750ffaeb9e71e886dc06fbb9bd1862b7693ce1043859d4e87a050c33e7361fd4f77a3144e566fe51fb058ce14b22673ff5ba3ad6e56d741a8bf9868d6
SSDEEP 49152:tb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnXCFc7mNAzJG:z3q6tjB2Cww7
TLSH
T15FD58C03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 056bef48c29b31b8a36afc9513f5fbbdde32dc2dee43a50657a6254b7292d60c
MD5 36d3e36994c3fd5f4b5799f1cae6de86
SHA1 c563530a0b005def51cffd59f879d57274cbeadd
SHA512 74085fa8041a873ded8424b2b89b1680c5914344a4877f642a4624a61b01f581045c72067d9ebf3e243a925b6ec2b1c8aa46a2bf478fa58d389e6f32ff54f1de
SSDEEP 24576:DXYfDtczAUlBQCAdKTrz5ROGA7nNAT//RG:GtcJCFc7mNAzJG
TLSH
T13A05F124B3E908F9ED6B827CCDA2C002EA7378554760E39B03E49A751F636D41D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7dca7f52faf608f8f74d62a9cee6ea0bc547859ba9512ee8f376d389056646ac
MD5 c2bcb7f170528983b1f2e60f401f7b9f
SHA1 9621e70f1d8e0a988f6c4aae971aba4c90134a38
SHA512 6e8b9f4648824db8a1b138bc6131261afe618d8875674c2ccedae20d0e6cb4c9a642953e653f55b131c487127dd2aa714a90f608b550437a661239d50d9dbaee
SSDEEP 24576:U0Le5ji0hmxnrMdlBQCAdKTrz5ROGA7nNAT//RG:UPji0AxwCFc7mNAzJG
TLSH
T13F359E16F5788371D073C0B9C5D2A68EED7230865B308ACB4286D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4aae257592563ef807dc4fd10ddbc0fbc2508bb49e09047f2db65b369805fd07
MD5 fe25002d8b336ef8fea9f4e45477c13c
SHA1 d8f0acaece901fbaae22a5f414046b813efd5f10
SHA512 f00ba67b6c899cbf3d91c63f3eeee2d5904641fa4649aba0e78a14547307932e934a91426e5b957656a8434766b2eab766d8b45dafe0f28bbd207e0366bc6c8f
SSDEEP 24576:8a7/ezSC6vUyDZaqgrvWx6q8wyujlBQCAdKTrz5ROGA7nNAT//RG:b/ezSC6vURPvMHjykCFc7mNAzJG
TLSH
T124756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9bb30ce54e1ce2e803bb4262d1f122dc0e5806fc9a9e566e994123585f00532f
MD5 12c32c3544c3cd9c9257faeb32511781
SHA1 bc6064a50f96d3e70d800a467028fd3c3504bab1
SHA512 726194af053ecc4d650f110bb6691c09adf80f60aff395191d38fc09b2319baeb98749036fa52fb1417fd204f3232a083194c827a48c94995b5c3629192c9a9e
SSDEEP 24576:QVbqPb88hv/lV7olBQCAdKTrz5ROGA7nNAT//RG:QVO88hXlVSCFc7mNAzJG
TLSH
T142559E66F5748331D073C0BAC5D2A69AEE3234424B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b945201c72047df31b4b12173a80f8d5b10428fa00b66ee8201cdad57647914e
MD5 a1791dc353365a91e44cf6620a40dba0
SHA1 adc3042b927669d397c7aa52e1bc7695734a53bb
SHA512 31d4087fd8a2fcadfa6547b42b458e7276e8ca784a6d5509872a483bd676303558985b1a91466746ace4a771de0ecb3b5a97afb677a9fa74243caf94d3331ef6
SSDEEP 12288:WG7tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:WGxlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1BBC4230291AD91C1CB6F727AFB99D0875DA66E64C824D37F22943FF005F9CE2681718E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 722b674358f2a7ca9365d69c934a0eed3c273976239739e2dc621c8831d69bae
MD5 a52d93aa0306fa1cb728778a30600103
SHA1 831aa3f31721b3c60fc574577ce4849b20d773b4
SHA512 a71a67123f5fe163505a50e8e275f73b84951afb63c7e87ce2e5a81697d112246e5fb04841922856a1a9639c34ddd3a6aaf0780a1b8ea4350922135a3af70b82
SSDEEP 12288:WeBNUbTVO86UytltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uA/:WJIUAlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1F705CF3BEE28FCD2C27E9DB95B91C24097B278704B21A3CBD165834E9E235E11D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b2628171857c9d7f15dc440140f62522c87f7479cd9168c2aca5aae1f89a0b17
MD5 9776fd3849cb20b68cc9a6bd58f57240
SHA1 d7ab73c3b5baca3db27c9b2383b4ac2b526d5706
SHA512 ed66999b3823e9a6f85ce71ba6b7355836dcae6331d3d61ee699dcc89812467c6da0e086060a94055746002b466dc1a19c1df2cfc19913a2d87cf3eb14e53868
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THT:OQvGAdlCEL8c/pRNw5CpCww7
TLSH
T128266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0601fac9fa0248da33a630c2941746f976a43bb35777381c77a5d65ae0b08d8a
MD5 e8bfde6281c27a58edbe75119c219ddf
SHA1 793133b12e82b358039da72d9e2ca868afbc4976
SHA512 5c205c6c6f3fe283e526f2bb9bd7e8ba3aa4b04197b4bdce0eae2f6039ff7648e446dcbed78145a1d572c62ccb783e704ca552d8ad7d4baa0d6d39da3127265f
SSDEEP 24576:WwewsAj+lBQCAdKTrz5ROGA7nNAT//RG:PljgCFc7mNAzJG
TLSH
T18B15E031FA79E032C77F0DB61B26C306187D7A204B611AC3E3E85E9D59706D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bfba213f5f474d88b6dcc18f4886b26262135438a5f1e0e1a073abaca8f7923a
MD5 2edeba73be461fe3c7d637cdab7c47a9
SHA1 8eb80372aa21789030baddfd6a2aab7fc5d01b30
SHA512 84f70780b00b53262600c211d99da595c76db0ee9723ab46837b36abcff9c463e2241411b61d87a02ddfe916bd467b95ee743f2774545a01d1997f527f5d5a4a
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHNz:MUEtQevvqc2W1cpV29I32Nz
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 87c9cd70f3d98a9dc63e8110c2f0d8d901c82bbc06b0179791c2dc43b1a5a2ff
MD5 a54d5a0b844ec61d7a5a9bd31ada50e9
SHA1 4f2a7e6765313a07dcfdbdfd1f669a934516f7d7
SHA512 1c5f06af718253b45fb0fea523aaa3eaffcdce07a4baaff1506d6aa29def5db4e100bf556f7622bea400040b3b227fb3afaed2d8a9bd6950b73ed8c8fa9275b7
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zACFc7mNAzJG:HoquVjnmdCww7
TLSH
T195D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9c040b5208c0431be86c5992fd3ce40a2d9b91f8eae2e82d07b545a542a2c25b
MD5 1b897614934e98fcf629ec9cf1fab6d4
SHA1 5369c06cfc512b56529e89eb6430ca5051b4e067
SHA512 b2fa4317cab5c2f724bd871e60d48dd69055696c32b014c0d74b0fc346bd9098e40074790073c2d6e7272ddee22aa534e115e9ae437440d02ee1261d69781423
SSDEEP 24576:DAhGLmIFoiwtA5l7S53PlBQCAdKTrz5ROGA7nNAT//RG:DAM1Foiq5NCFc7mNAzJG
TLSH
T11B35AE81E7F955D4F5B3AAB899B69071EA76BCA95E30C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0f3edfcdbb8332898de3a31e9891972c808b44bb583243493411fe1f7aeada94
MD5 b5ca2a1f575c38211eb278dfca3e0a37
SHA1 b29cf26da46aaf7da29f99f83ff33eae02366989
SHA512 6e90f8c2fb4caf562d3911f7401cca016c5e8699c442d22a9c1f4c85339438d757be774e5e8e6f736d3a0f9d2ffb6fa7828fabf892fa06b340e1221db52b84a1
SSDEEP 12288:Mmw5HEjsChNOBFgl0WDm+C5tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7rl:pwuXOWqlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T11905F14672A90CF9EA679239C697C036F7F2B8112A20D71F1360C76B5F772616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bdcce6409f1112dc752fc2547f6da1380ba847e086a1ac98ecfeb4b7d4df4045
MD5 1c6ce7e3adb95cc835e8f93db6e6a1f6
SHA1 26bf0b37d7b3a27a71881ec36bb6f24a1966856a
SHA512 6093533fa104b1581d1e439337767901792137e2fd9f089bc56603e5aa8fc7505a6f131a5f3d4f2ace3357a1c9964b0c1dd5dfdc58aacb8b239075750e35d5c1
SSDEEP 12288:qbZ1IyUtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:qZu1lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T12BE4124222EC20F5D6A7627DDEE58046DBB27866573483CF126417B51FB3ED22C3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e09835e6e6b641c17515e87db14e7ec0f479d04063554698c3fdff9f876abd29
MD5 95359eff06e769790e130c1d1286e796
SHA1 e562cb0c8576184bc64d554647262e17b82fee00
SHA512 3b0b14919517e8a97e9dcf32507d35b1717fdf4a9278d3f0978d0372e7e95b7ce49b3e3f53b065816e60a4478ddae8e8862e1362377a6f978ee8a02ab302f488
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uf:1QRQyi36YOcPuLvw2gAf+PN3iCww7
TLSH
T1F1667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 24010374b37c2d6db250c7e862732d3694b930a0b34f3f208783a3b07349cf96
MD5 ca36fe252a07b8435eb6ed3348435596
SHA1 c5924768580e7f22659f7e8621ea629d31bf5a5c
SHA512 75deeb723d4ff3734454cdef23c07365e07687920e92f98e07a43a0117fc0c19586f524941e67b01d39f127fa78c3eff864fb3e973306eb023725b175c493794
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uf:PQRQyi36YOcPuLvw2gAf+PN3iCww7
TLSH
T18F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 036a6aa7eb087635104681ad054e68ab134e8eb3627c0aa189ea66778c441eac
MD5 ac0bb9b5591f92589e56dcb415212064
SHA1 15a0954b4a3c0473162eee60a4c1f61131d6f564
SHA512 4a95d0d43d0ad5e2eb349e250c89d190f8f4edd1429759a631fa98416ecdef136def836328c7c1f80cd356890ec40633728b6a5f194241dbb21939181251e140
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0llBQCAdKTrz5ROl:X68Qg55nhxeWu7PNU3/wCFc7mNAzJG
TLSH
T165B54933B2F60099C44DE1769F4A872296D27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 56b59a32e1fe1087690d7b387a78718c70691a42de03fbfca5c61c7c3b6bd9bd
MD5 cf843bb109b9b4808647252fcc6a195b
SHA1 3892b0d6820841dfc64696c3dd85a51f4702c182
SHA512 d09a05228cb52310b896cc17a9634cedf279c4bada696f94bbc36ae6ed3755d7895192f633fc7186b6bdfa942ac8ad0643ce3b94822859e27c4b1859b36790f4
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99l:jy5112gYy5azzVvD69nLKnhZ7Cww7
TLSH
T12D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a68d22e42092758eff65fec17ae4b00093b6871a8323edeab4a6ff502814202b
MD5 8e75481174115406b1434571d5ee8750
SHA1 a79307f283efa5dd4d494229855ff65766c365b1
SHA512 9b65b9a85237bf6bd98ea10bb23427ecfeabf1f0e72e51bf3002985854aa520f2bbaf38380f4c8b04b5693cc5f3965c2fc19882c405a045a3dc286c3ee772605
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqCFc7mNAzJG:vu6JmQxd2dqCww7
TLSH
T160D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 432879b552a7f69a32ac11c3ff143fa8d45a6d3ba9a94820a89028d98da930a8
MD5 cf43c9ae46c555eb6dfe72890e72a24d
SHA1 8119f0fc07666a2e32914b3c370e6daf66dbb5b8
SHA512 8a675ee4300257dde268e593aef1b1ec2b6b661e196bc80ec5ad2468e936a9b85bbe13b3926a2764d5a4a98a643fede2f628f76f7a9fde49d9bb2dcdfb10ee87
SSDEEP 49152:e1hpsNoJpF1A6yU44CwH7R4xOCFc7mNAzJG:emifPVRdCww7
TLSH
T1D1B5BE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0ce0d09e2a3c2c43210db22abb8783e33f4434559babe527a5c0dc6a76ad05bf
MD5 251ce1f3de1433ff73bb2cc59475df36
SHA1 bf3bc3c59700a8df1f1441e2a29798d255dcda1c
SHA512 8773dc490a71985fc187bdac9203ccd04dbb6079ef0f324b1e4bd28571ff69e7bb3a97369c1a01d5b5d622f63797df8fc5a076fbcc10f654a44098b386b416bd
SSDEEP 49152:BSuZQIY0Be2KIRVtOnks6NMHqHCFc7mNAzJG:P5dKOi61HCww7
TLSH
T17EC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ad57f0b0a427e6b4a7a5965f1c4a286a031884f2b09356a1b18e5ab24207c26f
MD5 10811a9755f6d1324ee0fd4814c28e61
SHA1 c673f6677a19f9ecebf8482a365c38300654dffb
SHA512 8ec7362b5b86420114dd96ffa246cb201f4ec9bf4242e1a13ac23ab504e17367695b6599e2879f95f7bc560b5449e84cb4cc36f369ebf4ed41ff6d6fb4d7faa4
SSDEEP 49152:AhtSn8EApI0figGgiDn0AP5waCFc7mNAzJG:RX2i/phhCww7
TLSH
T10695BE13F2D901E8D05ED178C7568632EA62BC150B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c0deff57d232b9ab89c4f4b83647cdf8155657ad13742624fcf4c8712985432b
MD5 8e22d7024c11fc827e8c63ef23753580
SHA1 985d8995d25ae4661760969a4372bd9103ae1522
SHA512 97abf9d4a0aaf552986ac66356eb59da3f8352a77c7196d51444e8302151bdd53307a711a540c775626f9122d5cf550d5353ec7a784ffeaea27374a5fe9ccb4b
SSDEEP 12288:NTtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:NplBQCAdKTrz5ROGA7nNAT//RG
TLSH
T11DC42302E0AE41C1C71A72BAEB95D0875DAA6F69C824D37F33593BB016F5DE2381718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 05e2e0aa6b44db78059db5225851c77249b0406fc3a63a36a6b59a8d4b35f082
MD5 ca15328957e432dbe97cc13fedac1d1d
SHA1 09583eccee4a9aed1f717b310be7448af17539e6
SHA512 701c728db1cf392bb3da75be9d462e4ecb1617187ddfd4040696658284c1f116b72669b8272bc003587150ba2edb241ed5f0a4fecdce524c3936f46e682f1ca8
SSDEEP 12288:nItltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZq:nSlBQCAdKTrz5ROGA7nNAT//RGq
TLSH
T1E9C42302A0AE41C1C71A72B9EB95D0C75DA96F69C824D3BF33593BB016F5DE2381718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8fdd8cd9ca30167045d4231a9ef5b9d814ec4cc7158b0ca8c5fd3606d934119e
MD5 ffd83276752fe7c2e97fe66ffb2b914e
SHA1 6b34acfb9846ef877a419c2ea56e43f818b91706
SHA512 828a997c2fbefa1d644bed12cb575b0556ee1b606d947329ee52943d2239ec83efa9980bd740f9f7a4e84fdf2e37a8bc6fa11e8958e8ba2c8dced20c9d5b1d06
SSDEEP 12288:iKtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZq:iYlBQCAdKTrz5ROGA7nNAT//RGq
TLSH
T1A2C42302D0AE41C1C71A72BAEB95D0C75DAA6F69C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fd2f666dd33443056a8f3be7b25ff0c613fa274704deb2a6eb47c1f549700568
MD5 e7ed5ac14e2c0f8c08a7207d47747074
SHA1 ba31a93596dca3b2a408b1d6e99d0f5690daef8a
SHA512 c95a277c7eaafc6367497ec9edcfdc7fd0c1175c162310172c8662d084d1e61ee567eff926a169b78f7f05699b1da1866ef71db829a8cad64862f6ae1a2653cb
SSDEEP 12288:dVltltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:HlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T114D4230261AE41C1CA66E279DA95D0879AF67DA4C530D3BF63502FB10EF1AD13C2778D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8d4b710b2de8fef491db4fb744ff6f6354ce9d334f09a9ab220c8bc6ae6ab780
MD5 94308fabbf529d120cab50e8e1bf8a79
SHA1 eaae2d42852f7b31e1b1cd823fda552f4f1606f9
SHA512 ce4a5b7460c182bfde6dead3af3b0f3f42136ce1acbc5cd29498fed380da5c4288ebc5d1eda5ffe782224606ae129e47d0cc3a0ccb17560e7ba760ba7f56c6c3
SSDEEP 12288:JNtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:J3lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T17BC42302E0AE41C1C71A72B9EB95D0C75DAA6F69C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d3ad4450de762c6ca2be10fd92f4857d3bdabcc2d32ad21c545a0eb719e5132f
MD5 7d9d8a0d051728ed374bea754eca3458
SHA1 1b32c073ed42084e9b42b9b948f291bee66e7eca
SHA512 9bbeef4a411785e727bf4174172d77f80b6b60e3b71e095c456ddce77c634416ed5bc2092a901a29985a1ffa5a0b8f796d5c44805689ea92f94e0ba90fb1d191
SSDEEP 12288:SctltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:SWlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T19BC42302A0AE41C2C71A72B9EB95D0C75DA96F79C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 71580adffe571cffb8d1caf0c1af10e09896f6d317c475903c43497e1521f953
MD5 fd78879412c9f276166063c863e1a7dd
SHA1 eb234f57ce87fee8ed8c67b53d32063fbf1d8a2f
SHA512 7752e6aa4acb856ad9d963c3b4d5670e9936a8361f804c2d9ea72d2791627e46095a083b44b104fc4b3c3ea27c59d8e3e9492335ce13729d3cf40c32204be170
SSDEEP 12288:iQtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:ialBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1A1C42302E0AE41C2C71A62B9EB95D0875DAA6F79C824D37F33597BB016F5CE2381718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f17b18a504b913dd44c653c294adffa56af409c27b4eabeded6ace0fc55e7497
MD5 b823e810fcdb12a0193e92d28222adfe
SHA1 e1b8794f3a370c3506a7218db049dd5f40a930ec
SHA512 3d16e4709e2e74e1a6f7894ae8650f243f7b27bb5f98be8ab139a2e96b87141f0ab4f6ed86e1fe3b837b4634b9cb62e8c6fbce9290398f7c3ea6e5c8c91531b1
SSDEEP 24576:ZZMJzFVSOylBQCAdKTrz5ROGA7nNAT//RG:ZZMJzfYCFc7mNAzJG
TLSH
T1EB050191B3A418F4DD67823ECD558806D6B27C6A4A70C21F13A837761F737A11C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fcbf8c414afa889c27cf43c6250ff07739158f9e90b0745e1d656d0d1f1a3392
MD5 402bab1e55157b075ccd69d86f99ca68
SHA1 7fe3c6394487c2cd3995f91932ea913d67202bef
SHA512 9789f323c6f880a365c98beaaa5c4ddc84f7304074d17281e2b34574f97d6376d8b1cdb853bb561399e5338bc8178196725d18fcf2b99fb5c996a348b873c977
SSDEEP 12288:O/tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:OFlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T19DC42302E0AE41C1C71A62B9EB95D0C75DA96FB9C824D3BF73593BB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3bb14e739a0bd934b4067a34a42c0ce496ede791d5b39d32fe7f5aa517d32cbb
MD5 cbd60fc8ce224503d723ad6a051ed37d
SHA1 a845dd7f44750237eac35390e77b6e9adf42cd10
SHA512 3c73466657282d836a374b05d843a7125c7384edacae959aa40d7b8ee2727ccb89b04d825953f803e7240284fa408b4cb6637768a929bd98532c250c4ce703d2
SSDEEP 12288:BrtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:BBlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1BDC42302A0AE41C1CB1A62B9EB95D0C75DA96F79C824D3BF33593BB016F5DE2381718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0259c3dbdae2a44901b0649c0ed66203b18ae6385fb9bc9394f6d4d5087fb3d8
MD5 0bf1d47c2c0aca168e6b66c5f8d53860
SHA1 8b3e9dc3335de1a5b5aa57bfae92579dae3402c8
SHA512 93ae9d4718bcedfd15fd14704305ced1462e868148275371b6da4604892f0f36cb7611552bb4fba376e85f2084eeba3914d6eb61f1090d51e5141f600f27b605
SSDEEP 12288:jyPz5L8UtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:OzyOlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1A1F4020372A930F5C2379239C9A25542F7B27836472087AF13A417B62F77AE16D3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9e9ac0e990c4f949786acc659d2b2855b8c80567282d063e38742b69107b5249
MD5 9cad6e1a1c7c412c5a2c469178e444ca
SHA1 888064089fc186ef339228bc64b6acc9d025388a
SHA512 0c181e7b49fd6908bc815db11291edb7f068a751a994b9359a28e26026c15aad3e14d0b498b6681fd8f30e39c05ab4ad02da586a716bc8139a03ad739d7e6f0c
SSDEEP 12288:l/tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:lFlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T106C42302E0AE41C1C71A62B9EB95D0C75DA96FB9C824D3BF73593BB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 dac1bae607651b7f36c3d5388c25f7e917afc501dd5a6bb02092a9156fd90038
MD5 dc23b6090df12ee52f732eaf428723b6
SHA1 b884c6832d546337dbab7d880199192e239ee08f
SHA512 a46bdf0d483d37ec5eab2d4d2b0448ea21eaf5c889e771b7f0fba8fe054e9c4e9175ea1c272e0e49b815171d0fc24d0bc3bb8d586a1c2b4d7c38627a0ef1d7f9
SSDEEP 12288:j/tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:jFlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1D6C42302E0AE41C1C71A62B9EB95D0C75DA96FB9C824D3BF73593BB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7397d3d770daf4c30c59ba0ccc53a962f025744ff188a9a5907b376bd54ba9ad
MD5 c97f41960d65fa848aef78c6db6d7ba9
SHA1 493dad69f2fb87b2bea957c6ccd5f2de4e4b20e4
SHA512 8014ff4315a64341d11a3f0e2500b1839e335ab54805cd36b2cf79bc3fc5caf3e71d56f18334ff5fa565197df9a70a906f7bddf59ba7abc0b0804a56da7fa6d6
SSDEEP 12288:HyPz5L8UtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:qzyOlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1C8F4120372A930F5C2379239C9A25542F7B67836472087AF13A417B62F77AE16D3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 43af10f40ac024663191381f9689300e335cec36d2c589f8da0566b35e7fedab
MD5 664872bda893d810a1e5c077f2b130e3
SHA1 5f8454dff76f56474908e2cf60573e5895e86817
SHA512 5e1e6e21185df5a30a0947298e508de927546e2565638662f941404add1680dce557ab61e41d27c959ec6ab1a5e277be4ba1f91453b1c5ecd053608c9aeaec00
SSDEEP 24576:YTuaLl3z0zDIlBQCAdKTrz5ROGA7nNAT//RG:YTdLlj5CFc7mNAzJG
TLSH
T1F3050191B3A418F4DD67823ECD558406D6B27C6A4B70C62F13A837661F733A11C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7be73cad6996e1667b5f34a4b8b0ce717a2ecbca1062ac6bc49a0779d47c5cd1
MD5 6bc6db9f353fd32ae0889de5678dc857
SHA1 6dddd50a123f03ed4609d1cf207f284e1fbfd765
SHA512 35a584c2a481cf0626a5e20770b9b25f40c8b0797bc27d2cf8725244cdc39a7c5109bb2c363b02325d9c3a7584806e872ba668308f696f60be0dbd40e346bfec
SSDEEP 24576:J3xd9CHKy7GZslBQCAdKTrz5ROGA7nNAT//RG:Zxd9CHKyaYCFc7mNAzJG
TLSH
T15525CF90F3E810E4F1B79A35CD764512DAB67C595B30DA8F03A4266A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ef9cba32846f5112c4a441687c4b655abcbd2a0af604a1bf227c944b1bb9e4e2
MD5 4c194d06e097f48f7c6d43b8aac591e8
SHA1 73f5249d99f760fd0265fc2f64298f8a64f8ca3d
SHA512 667fc6236928990b4907e11b4717e63d7094fea06959b15fa44d2df0c311a716fc656331d1f42ab216808d47fd215d8a577ceaf93e2544cd4b9078f34fbb0e5e
SSDEEP 12288:MqtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:M4lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1CCC42302E0AE41C1C71A72B9EB95D0C75DAA6E79C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e8a81d37d60cce7946230b1b307c28233708b6dcac14e1287590bca5ac7b08ec
MD5 45caf2c283377365c68dca0571e581bc
SHA1 1a7dd80e02a1835f71a077ee1a41c6cf3252c5e0
SHA512 964a4940d29328ff34ee391f6711521bb8bc4066cd0762eb1d3af1781cd3f8ddbc9d52c72f81b79169fab0423e798a5e3f6a64f998e39709758cea57d8b1b3e2
SSDEEP 12288:e0tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:eulBQCAdKTrz5ROGA7nNAT//RG
TLSH
T15AC42302A0AE41C1C71E62BAEB95D0875DA96F79C824D3BF73593FB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0817c9ebc050d23c63c96cef55cae06e96fe24cac5016068c7b25b3bddfaec9c
MD5 bdf09175a932ac650912d25d3858c2a4
SHA1 fb1687c359a4b536ccd714b72bf5b6664c920015
SHA512 007861b7218923740bafb681789e874aef854169bb35bc46308243f3d5fd07d07aae32d641eca41dc2456c7882bf1fb3e8c861d4bff8b821e9266173909a2707
SSDEEP 12288:JhtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:JLlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1D7C42302E0AE41C1C71A62B9EB95D0C75DA96FA9C824D3BF73593BB016F5CE2381718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6c293cd60ac3f875bd288525f998c3f2deba80f0ea39effe23a0f29c3610791f
MD5 ff46850fcde7ab28dcc8484fd4fa4eab
SHA1 ccc1c316beb274beec7cf888a9ec8bc2355c2c1d
SHA512 7ecf24b4d607e197a5483b3d26408a25ddf495a39e2cb03d7b0e8e91d8f2aa0299224651bb3b7836381e95949c50c3c6b5423ee23f8a7734b7ae5eedb64653ff
SSDEEP 12288:J/tltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:JFlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1A9C42302E0AE41C1C71A62B9EB95D0C75DAA6F79C824D3BF73593BB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a2f46143b95ede3d03c91081dadb572e529fae62b677419e4dbed5b66e207e0c
MD5 8594b102f779ef7bcdf839e2f6522634
SHA1 d396a701bb61f3aa310379957b16513e80b7f139
SHA512 666a38c244ab2a86c38662e6aeb626a039cc9538fd38d5ac7df0972eaf75aa76d8b45c45df67c63b1de29de631dacdd6fcfc7faa0ed758af536794f2609c56b8
SSDEEP 12288:LqtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:L4lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1C7C42302E0AE41C1C71A62B9EB95D0C75DAA6E79C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 60eb574ea51ddfb7f91ebad5cc0d78841c7e0de5c56465e2165989f29c6d8b91
MD5 4a49b3d8f277b4ae1e75a47ec982bd34
SHA1 59df5b78e32f76c26085e2c48146522bc34926a9
SHA512 3db527b2a425d806c16efa1adb391486c4e89898fa0ac4a17d7025ce16c0ebc1cc64307bfc8d3a164e167f0e8ceca794f893a719a62c61578685c52dfd3f7405
SSDEEP 12288:5HtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:5NlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T14DC42302E0AE41C1C71A62BAEB95D0875DA96FB9C424D3BF73593FB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 de6d2724aab8e3ddbdf6c68bccb6ad65c00b7a9e4775ee54140b3ef63c2d1848
MD5 85cc90d5868742c7984bf15467441c35
SHA1 0d4ce1bda1cecda0b42992fdef31ca707aeaf4f0
SHA512 e53b0c9817794cf3247ceb869b51149f1c932ac54d40c12eecc06f0d501848b2773b99b6a7560d61f1045e9a54d88868effcd073318a2dc1c6b941fac815ce1f
SSDEEP 12288:eNtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:e3lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1B2C42302E0AE41C1C71A62B9EB95D0C75DAA6F79C824D3BF33593BB016F5DE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 7b5be1858f329650ca2e8582bbb8432c939a0e9634ac53ab5a8904fc663155ca
MD5 8735a1608bcfcaad65a2277ad78df0e4
SHA1 9ea84ed0800d1a8b1a63a6eb36a8081dc9f601e8
SHA512 aad544d0cc95602ec8aedd664c8ba18fc14e2bbe84c0882147b27cd529cd51774fc1badae3e4be96cae2d06441f5ab8b0952cdfcf8f2cdcbe753f7121d27cc8c
SSDEEP 12288:CitltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:CQlBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1E9C42302E0AE41C1C71A62BAEB95D0875DA96FB9C424D3BF73593FB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 16844b71c88f16447ce25d5de26c381bb4febee185c8182b29ff850d81cd8b36
MD5 814bbc5f6ef051229ac49343f7c4fba5
SHA1 1c4daae95e6b522498344085a85226f792bf03bd
SHA512 dd2040546a591e18548dee225f219da9ad45e3e2c3345fbfec9ba8e17b36269f703b2b043a091186f6a64fb127c25d7b8a4ce6d7035b00f8bf0ee3e451d4714c
SSDEEP 12288:hNtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:h3lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1E0C42302E0AE41C1C71A62B9EB95D0C75DAA6F79C824D3BF73593BB016F5CE2281718D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5976a275e763928825f93d30ac2b63c91ebf16526dbad03fae559bbea111e377
MD5 dfb4efecf25236cfdcd64bc7ab9436b2
SHA1 b1a5811225a4b3d025a6a3f49805a05e5643fa0a
SHA512 16f2f2e97402862ce4dfb543d92dbc6640146d5b283febd06b1da7c7998b8424c42094c9daeebdfef23e56b22f345ad33785db1f623c850a66215de06ba05823
SSDEEP 24576:HfwvOk9RX6wkyAIRlBQCAdKTrz5ROGA7nNAT//RG:XMnYIbCFc7mNAzJG
TLSH
T11135DF29EBDC44E1E177923C99B7460AF6B178691B31C2CF129A53AD0E37ED06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2db2c65b685a306c4e7033d66cdf03c2e7c150f2bc55536029b90663c8a090a9
MD5 594bd4865f197e18c933468379e34360
SHA1 a2aa0580b50e126cad4788c9234f76050c3d4e5a
SHA512 ffa6c3f17d7b352ba60651bf0eee73893e1f8e0496bf37f2128e5771faae8d18a0100ba35dcb369f200c9e49a549a75a4a984d23ed34845373a8998192b1f3a7
SSDEEP 49152:aYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06CFc7mNAzJG:6ySzPCCww7
TLSH
T144066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c076174c6eb1329e1323a927450c53a2c96d5990209a14ba0a82f991451bebe4
MD5 7035f7e35ceb70f83691d77c4ce9bc9d
SHA1 ee472df37062e644fb4ca8c5b8c66f987ce6b384
SHA512 dc22af0f36d79a5a6987cdb8b599657ebdffc79b2ddfff041f3665c755c68af31a627a2d17efd3fa9851a9a7668586298bd1f3a7d7c649dee765b956bcbfafdd
SSDEEP 24576:947Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYClBQCAdKTrz5ROGA7nNAT//RG:947JUQjairIhCnDHUPfF/qCFc7mNAzJG
TLSH
T14D65AE1EA3EC01D5E1BA927885158A5AEA71782E1F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 79281280936fbc8c32476e71f442ba824340446d32485f907d5b8f496a1cea35
MD5 0bde2c81833698e8419fd24c8fb25962
SHA1 66bef999a57f3dcb72984057c8d2d8c848afe695
SHA512 7c41004c48c1356d1aa638066158d6962364bd83682bbe3fed646743e8fe598cfbabae7008d6fa236bccceb2a81cdcbb458552a6af97b26355297f3bfc580939
SSDEEP 12288:kksfPtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:+1lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T1E3E4F006D29802D4C16E6279CB568542B7737C6587E0D3CB23D0FA7E1FB6A906CEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a313c017c670b62655379a3ee29ce80bf08b5a902fbe057d038f7b53ab3e9140
MD5 24f2b73ebd85ebb77f9339caddc50006
SHA1 fdf86f4e7839dc5f5905fb7fe6e3b160a00b0a01
SHA512 c518b8b9013d3d62180bab55bd09e07a162357e126ab93f2ba7724408d0c362eea55e9599640c59c66862d0885b09a00b6c51ac3ce537c1d99130c6329b60b77
SSDEEP 12288:VxmUbU3fRKh9xaerfvi/v7T6aHzViG+gRM5BaRj072Qub:VxdbUPue43uvXlRitkMLaRjerW
TLSH
T1AE352840B66AD74FC66D40321E72D2CDA7707D51EE04AE0773C88B3F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 bb0e0da211b3bfbe2f5b8790cc6a20e7181254651545373a50390f2cddc40d20
MD5 e54a3b90757ed8cfbac5f7c77ba9d070
SHA1 08c3bcf8ebb4946d8a2d7c3011b3066a811bdd88
SHA512 059a8596143833dfe5d8503877e831b8378cd4dbe62762bea7aa347c83dfeff1798dad9772445ec15fe45275f99fa08c5f901facb086d754bf47fe84506fe7d0
SSDEEP 6144:QAZQu4rpNS3Q9IybcU6ij9gX1PYJzGjiFdaAdXbA/EusOkbKSGstHHp9zZFX1bZd:H7XWJqc/NUab1nhVRTKrnzw
TLSH
T15955D940A437A28FD1BB603207195B8CB7A4DC57BB056F26B7C9153AD82AB15B0BD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acc.dat

Path C:\Users\Admin\AppData\LocalLow\SogouPY.users\acc.dat
Size 80B
SHA256 d23654ee920504626fc54709d1b6ae2f193a41ec655b80eaaa613dbf8881db96
MD5 edd555175d270712da22aa6d09811721
SHA1 1b314daa46fa5771d60dacb627f36d9e978e53d8
SHA512 2ef77f52b8761a69397eb18ba9110fe801600691cab117a047357a6250f1d7413721ff7b420670d686e2a15cbe9a01483e6ff9bf2e1e3fe4f353e86297536049
TLSH
T1E6A0122A01445064CAA5009543083C019E40400BC41850E10900BA0B122D22CE50C031
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 fea446d8a544df2f274cdf3de4c411517bbe0be1e07ee5f9f4b4990481636bc0
MD5 fc59a76bc096e4f5dc4629e5a279d2a8
SHA1 12192c7821c9a8ffd1be79db8260cc5150a2c71e
SHA512 f604797f58455bcef39ceb5dc2e3dfe21c1d5fa8bcd78ebd75f15ff8698430b0f28c8ea71d03827fa088b9012f43ff104dbd28c0d2dab201c1984a3fc1ad4af3
SSDEEP 12288:m07XtltfQFLGpa3dHqTrB1uU9a4OIlUWsTRBWA284w7r6EALH//4uAJZ:f9lBQCAdKTrz5ROGA7nNAT//RG
TLSH
T195D42302D1AD81C1DA3A72B5EA99D0572A6A7E788F14D2EF72443BF015F5CD22C3724E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 509e8c4cafca68beb1a9550dd4e7756778003d02a715ab08abf244463cea525e
MD5 16a29afee01eec671b6369d7afd1d394
SHA1 4ff0117f2ac1e1b6f1734a9ba8b89fd76e944cc5
SHA512 c718786cfce387b391405001fdf4e57f5d3ff74574cb5b2305df1bbe05805059d748aa18062ea0020b2d6f74e86c635e91f1abfc3d87799a9bc7e359ea85b8d0
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYjlBQCAdKTrz5ROGA7nNAT//RG:egb4mBIBhGFMCFc7mNAzJG
TLSH
T1F165AE1E22EC02E5E0FAE2B8DDAA4417D6B278160731D2DF1151427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 37984f1fe5451e563539dd9f7c50fbeaf2f9b21d830129d7bda2d0cf0838e2fe
MD5 d43c5933d5d2c678bd3dba740c302815
SHA1 a3bfe78846be4e354ce6f26acbffbce563617c84
SHA512 65d9845bd07caaccadc269486994fdde26001870749171bc86b0dbe694f7bdd14ba4a12f3ac1415ff95447a125e338cce8c293e0c3e3a402dabd9463071cb3bb
SSDEEP 24576:rG88u8FpJqH1nzria7/mylBQCAdKTrz5ROGA7nNAT//RG:q7ZFPqV6a7/xCFc7mNAzJG
TLSH
T1F935F16176E501F1D47BD138CA864663F6B2B4250364EBDF07A88B611F23AE11B3FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bf1dd20bc763d6119d79e0d7ee24ff2f9960143d0075c7a3e2aa55ca322c6f5f
MD5 669003e2c06d803aac072fe65f16383c
SHA1 dc988b9dfaa5c0cdbd9d1eaf342e53513c2f3162
SHA512 432a157fff94c6f2f8d0df746715a916c0ccad08095aed6f8d9c0892dcf8cad065a5ecd887b95b99a0cb97956dda450421baba20c9e9b16d726c159713dc7fcd
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoCFc7mNAzJG:VG05lO43bzCww7
TLSH
T1F6D5C06A62EC11F5D1BBD17CDAC6860BEBB23425033456CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 530abe13b548946812e45a85c46543349fbcd0fb9fa096f960591066f436b577
MD5 f2318c2f6b5fad570a8b320791382f75
SHA1 6f2637e70e8d6d97068820288979776c793c66e2
SHA512 11d83834bcd689db4bf8a0bf0775fa02346ef9308bde4c7373090b548f8bf14df9b2070cb7bdd9f2ef0e167a1b69e43bbdea329a6bd0d6ca01cafc2f3026f93d
SSDEEP 24576:Jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0lBQCAdKTrz5ROGA7nNAT//RG:Za5POZ3hJt2pasx2+mwCFc7mNAzJG
TLSH
T1E265BE5EA2FC01D5D5B9D17DC683861AE5B1342253319BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8755287e2a247ed0f5f58f4ff2de146d43272ab77765396359da99b3e43dd937
MD5 89d73437935f98b1796e26a34b9682be
SHA1 8940f4cd53969e67e89fc4e538e38fcf5ef89657
SHA512 6b1c3dd81678d59d971aec8f8341db0f80931f6000deb118d7613a6273ed6c1fa55a04f138347ee266caf6f390fba9280bbe4b2371566e9bcd5f891057340661
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkKlBQCAdKTrz5ROGA7nNAT//RG:4Nc/zEOVHFRCFc7mNAzJG
TLSH
T140858C1623E901E4F1BBE1BE89779546FAB17865533086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9b04e0264f721bec6ef1c7aa663f09ba73d1a9b1a3e552badb7a80846be72f18
MD5 7d71f24e4e70fb04daf7a1e1131d185f
SHA1 ac82005bad59c1090d1df6089299dbf68aead6a7
SHA512 c12996bd49c90d8b649a9863e31a7ef8b6b5005e804e1fafc2cc2f93747f59b3bd648996c68310f6f416d66a332ee475832c364a903a1aba05f261b59506eca8
SSDEEP 24576:Q3kNvNnaFeYhJNtmZBmQlBQCAdKTrz5ROGA7nNAT//RG:Q3MwBtOmeCFc7mNAzJG
TLSH
T18755AF2EB6F846E4D1FEC6B5DD238512EA727461073293CB5290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 7171c92357ae0ad9820ff302536b360aaa346d2c4b1b6d0ee682899e59f71abb
MD5 9a7448e7435837096850dfd1df2e4cd1
SHA1 077f08a4f62ca39f0c662684a23c876193ed6456
SHA512 5ca47769062c2830d5dd41df2715dad2055777604d17d65f9715ece4ffc6631db36f5ed4390bbc813cd66f272d372552933d886a980f17140c1141f0a0108a06
SSDEEP 24576:dPUr+NQmlBQCAdKTrz5ROGA7nNAT//RG:dJQYCFc7mNAzJG
TLSH
T19205E11B62ED18E5E67AA17DC9868209F772B8620711D2DF02E0817E4F67DE47C3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 58d3905533909054c4481d3631ccfa0f60770485fa8b90e5c2927c9c3a35fb9d
MD5 bf0d8f356b3749b0ac3122dc8bffdd1c
SHA1 b2874dae3176aa3c75669508f68af11782b04d8d
SHA512 9740bc8769ed8f3c3e53bd5160fd98921f29a62d2d264600272cd12673daeb0332ca127e89ca62a941f4a7d1968e01f3d300366862f62e456f064a009066400a
SSDEEP 24576:ND3FHshBIYQgAJlBQCAdKTrz5ROGA7nNAT//RG:NDVHeBIAAjCFc7mNAzJG
TLSH
T1F125E13EE69C00E4D57BD2BCDA638507E7B138A9032166DB12D491B51F6BEE43D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/704-32-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/704-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/704-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/704-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1220-6-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/1220-89-0x0000000000400000-0x00000000007DC000-memory.dmp

Download

memory/1220-0-0x0000000000400000-0x00000000007DC000-memory.dmp

Download

memory/1220-8-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/1220-1-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/1356-76-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1356-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1356-271-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1356-82-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1496-55-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1496-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1496-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1496-59-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1496-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2616-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2616-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2616-368-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2616-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2764-283-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2764-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2768-140-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2768-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2768-135-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2768-129-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2768-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2828-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2828-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2828-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2828-381-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2828-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2828-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3048-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3048-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3048-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3244-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3244-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3244-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3244-353-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3244-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3772-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3772-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3772-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3772-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3772-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4220-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-64-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4220-205-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5592-380-0x0000022960B40000-0x00000229611C0000-memory.dmp

Download

memory/5592-398-0x0000022960B40000-0x00000229611C0000-memory.dmp

Download