4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Size 4.3MB
Sample260708-kdzdpadt2x
SHA256 4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8
MD5 8277c5f8ae5615b7f78123d7baedf277
SHA1 f2a29f57ebe6dea850ca5130812115a231384fff
SHA512 9b834a504e39f5aee1eccfe09b7f4def2ad0de27f2b485985d3f3a8879ac1391c453303f8284098788f01ce6e2b5b5bd4d2bb707cbe359bef45421a862d95a13
SSDEEP 49152:QJABRjHZHCHglfiwz2wkCPhiwi4XWwlgZKUxT2igHF6c9OtZkN6x4x8EVep:vNMHglfPzrkOiw5lgDx2i5ix8EVy
TLSH
T1B726D002F7828170EDC29135287E977E4E39BD28AB62D5DB73902F3548316D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5600	elevation_service.exe
3688	elevation_service.exe
5416	maintenanceservice.exe
1792	OSE.EXE
5656	PerceptionSimulationService.exe
4536	perfhost.exe
5324	ReFsDedupSvc.exe
4428	SensorDataService.exe
4164	ssh-agent.exe
4132	AgentService.exe
3420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd47eaa853e17fad.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114359\java.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd190841b40edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038efc2fcb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003d56e4fdb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b091841b40edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeAssignPrimaryTokenPrivilege	4132	AgentService.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5324	ReFsDedupSvc.exe
Token: 33	3420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3420	SearchIndexer.exe
Token: SeDebugPrivilege	4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	4644	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	5600	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4452	3420	SearchIndexer.exe	99
PID 3420 wrote to memory of 5240	3420	SearchIndexer.exe	100
PID 3420 wrote to memory of 2080	3420	SearchIndexer.exe	101
PID 3420 wrote to memory of 5772	3420	SearchIndexer.exe	102
PID 3420 wrote to memory of 3780	3420	SearchIndexer.exe	106
PID 3420 wrote to memory of 2556	3420	SearchIndexer.exe	107
PID 3420 wrote to memory of 4776	3420	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4536

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 59070df55d213ea62b29a1f9a1232da1e920bfecb29452c17ecc3ffce4c320b1
MD5 26cb9102e232ee1dc1b28e10b661391c
SHA1 352b79920080931fe7ef79899987b5068794d2ad
SHA512 d61abe6031d8c2c8bb41d86adb671eb4e40892ac0ff749f2c1f6234fbe1308cc0be00e6409ada34abe6c347cbcf718a304ed56f8f7af8bf1b423976b3eafee09
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnux4x8EVep:P3q6HjBhix8EVy
TLSH
T176D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 71197f697713059ed55b3467738d067b51c7446a2b7d73ade45c9e58fa1ab980
MD5 b663abc22971d464acf6114c278ac4d1
SHA1 e2a6abd23a3d7caa2393fbf0446438aa1c4d6445
SHA512 7bf6a1e5952e0a9b7f21db54f4750c066de6d3b7431f89dee46025c6f3cfd4be80cd3c48b94d538e53a60650076eebf57bfa6dcc6af77e10faf7c28925ff376a
SSDEEP 12288:l1XLsswWkxy2lRq2czAK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:rXYfDtczAKyxknw4FYnshx8OfVe247
TLSH
T17675F12877D508F9EC6B8139CDB28511E633B8954770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 af88f1c850400ce0fb2a16f470d3a5bccc2183098afb1f14cb7322218c009d13
MD5 381c2f1dee7f41eeb83d6088cbab52fd
SHA1 b74b583a5fc94f1aead7c088a7b1f4f7853eb41c
SHA512 e028d5a6f2f5367dd9aa46e56bd633e9b44ad3c70425cd6f12d8d9bb721afd563488bb2513116aaecc26383712b5118055b70e5ac3553e313555a26866fb4fd8
SSDEEP 24576:d0Le5ji0hmx1rMjyxknw4FYnshx8OfVe247:dPji0A7jx4x8EVep
TLSH
T1C095AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aad08fba0589b640493378dd35d7cc5f53631ac055f6117372f2d847d920250f
MD5 5ebed7245e31436e3e58658816df65b8
SHA1 7b0351c65f7696695a4c2e13f08348e4d4781e85
SHA512 53d00319ea59eabd40cd650301bf1fb25815d2b05e14cf14c7ff52d027b894175f5a98bf2cbc22f0e0676b606c0ba4403d64af18fe2769790ccc4a3ef3c80854
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyudyxknw4FYnshx8OfVe247:3/ezSC6vUzPvxHjynx4x8EVep
TLSH
T173756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4754062e1a2ac0a36d110afd77d711fec1d17f4925ffd250e36fb366d0770b0c
MD5 6cc43f3277e7cc924996a19aa5f22706
SHA1 c7fb200911cc5f5d2087b7ad1d3b98e23af37f70
SHA512 e71ced3f1d40d5dc1f988988713e2f86234bdac40c09728219e2e69505523ba158b708a38e1a248067b77cee5c0672838443680cf0f898b0806bfbcb6429b8e2
SSDEEP 24576:CVbqPb88hv/l+6+yxknw4FYnshx8OfVe247:CVO88hXl+ax4x8EVep
TLSH
T12F559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ae86d1a5d71db57bfd5d841616719d8ab27ebd254424ce81c4569830e4efd662
MD5 f4f3804254f97d0010de95fe8cbce58b
SHA1 ebec6dfcc51295d96a5b36941bcebbf0fe2c2166
SHA512 a3fc3dbd2a9af20dc39032f42a58c56ff7fc52e5061ca4c30dcd4305e8db89a187414e85f442ec610dc219f8eb4506182cdbb0f7da9ff7115529bd329e0eebc1
SSDEEP 12288:hN3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hN3yxknw4FYnshx8OfVe247
TLSH
T16965237CA7DDA4E1FA5E14331B7572622616B9A0DA74C11BC779B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8fdc3a4490f2b430915a29ff75243fe7bfcf98671fbe989f8fbfc2f64ed8c20d
MD5 e6e455664a8b84ad47a1d54d937e490b
SHA1 9149e2e1decbe1195d6ddc75cd220ef39427f5b7
SHA512 31568f4e2fac1318dd157bafe1774ecdbf928a1f5cbf5f3d473a31cefcea8c7f0dbcfa9adbc87cfca9f4163b5fcc9deb43b03a9068468f5c70e907bf19edbccf
SSDEEP 12288:GeBNUbTVO86UW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GJIUWyxknw4FYnshx8OfVe247
TLSH
T1F075CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 44de2a7c9db81032b4894a56a204b09001b5c435c9337a35785b80d897840657
MD5 269bc386e062bf87b6fad99482fb4a13
SHA1 88c75cd2e6f76c47de3b82e1e67044a2b3be36da
SHA512 e7e600f5c6f1ea6474138f608ad30784b5d14edcd0a032a573e6a8811827c2c09be627901329a29400441812896d71a7c5c51c295ebc66c09d20e123fdf33f02
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:VQvGAdlCEL8c/yRNw5CYix8EVy
TLSH
T1B8267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0aa2ef2d4672749fe35c7352d2f0ea271f3e2b7aee67da022b0f18b8a0bdae07
MD5 f2daddbd41e30de408e6dfd427dd98c8
SHA1 faf330f8de1705eb4c34ce7284b4289eb226b205
SHA512 d1baa80b4930eef4291564ea53bdb691f66ddf49e34314d99456f8c43a4a0f6fa803fa043c60123ba31a7cb3e267d57e2811d898ad897aecc9103d8a02b75b5b
SSDEEP 12288:oAwSfxL/2Dc3LDLLmt0LDQewsAjw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:N6ewsAjwyxknw4FYnshx8OfVe247
TLSH
T1E685E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 07af9a7febfb7daa1d354c522b347d3ba489e3c15f355d11dfbd3e6020fd80d1
MD5 58af1b35f5b323b9c7200613deffbe5a
SHA1 287e68ac727073a2aadf213890d19d8fdc089f7c
SHA512 87f51b08b4af89ce4e33d23ca4bb47af33dd51d4927908273d466d4b50f92dc36dd96a906cc54210e10c26113716f5be94f572dd078309da6f192b54b238fc35
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHO:gUEtQevvqc2W1cpV2EI32
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c465a6072621ed6728a72dbb6090ea9f21a02f13b2e7a1f1389a19cad62e2518
MD5 36ff3a4a9dce04b01cdc827fcccfe1f7
SHA1 bda53b3b14498cce55260fe0c3b6b29743508f04
SHA512 a9a890cbe95db833f96fa829bd525399674612667e5828cb3dc9d8648fed56ac2e26a2df60af19e62202506198d0ddb23ae92b32e2281cf26016d21c86ba797d
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zTx4x8EVep:OoqtVjnmsix8EVy
TLSH
T17CD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ce18ce7bc736ccad1a2e81c1128b7af70de58802a58174cdef5e2d348bf7a023
MD5 7c84a4134f0b6f15f4fc4445d57b2c50
SHA1 aedbea0141d041312e56bd83c7f63e2c49c93396
SHA512 d86d137197e8073d3fa4f46f35ce007aa653f9f3b5f17acbc991260f107a18c92b3b2411c12bb1f039898baa77a773e2b6f455bab779d6ddeb9cfa08655cefd1
SSDEEP 24576:PAhGLJIFoiwtA5l7S53Jyxknw4FYnshx8OfVe247:PAMyFoiq58x4x8EVep
TLSH
T18935AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 40323f8e79de1ecf1b5bcef97f016eb7163381745648767a5009686e51c39992
MD5 470d6e672ccdb91d1091ec9801a58070
SHA1 c820bb5b8a94218c2a6528e4fc71b984344133aa
SHA512 b870c807e714918f1640aac511e76aa6652d236cf993bc009672de8e659ebf127ca0f6491fec347d85a88491b7a598bc44128e869a2c3c3b830c76e9066f2911
SSDEEP 12288:Cmw5HEjsChN4BFgl0WDm+C9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:bwuVOWsyxknw4FYnshx8OfVe247
TLSH
T10075F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 82e96108d519996f4f15b222dcb04ce5f2f13bef8c95f1bf3db0c54b2477db30
MD5 42435152d43b987be547a44d59a4a870
SHA1 d763139089039abcffb53c07659de81542d19288
SHA512 a2ceb07fcc549fc7fa3ec59992d7cb03f4f6c0bdadba382d489bbded5a8722a92af7888c55525d726678ccc6eb62100d8904312ed4d27846f2bb765c2187200a
SSDEEP 12288:FFZ1IyA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HZubyxknw4FYnshx8OfVe247
TLSH
T1276512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6d77b4832a91677e8564fa9cb44d661af69d4b3428b1cf0555530a062a6d2375
MD5 1e07f3640a2848c8d9f0bd76c28b275a
SHA1 59b5a784ec575c6a9513993d63b34c641fbf4787
SHA512 7339c07b46593c6cb82a51d9638d035da80bd081705c72af1a9ade936aa45c4a22499cef430994fb0cd3029b038e757f842c82c53d1aa2d3b63f494fb36de236
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:FQRQyi36YOcPQLvw2gAf+PN39ix8EVy
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 089ec4312295989d2cb91174a71166080c64070ee3c3e75040a02b8eb2aed318
MD5 9f96f411a8575c99631e65fe55083bc1
SHA1 34d83840418fc5a3c65e81344f25c92d2ad902be
SHA512 89720ae44a8f1d8f83f29af5edd85643f73f0e58b1e2976d75cdb8079e87408335098167d3cd1aa5a378b7a73e403e6628832ad83b14de38b940fe7c22410090
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:GQRQyi36YOcPQLvw2gAf+PN39ix8EVy
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 017c8ebe84b8618d90033357a06f6e554d8bc77b83e1ee2556a1e7313d020554
MD5 55ae73c66987d3f6df95a171e6df3152
SHA1 a83aa913aeaedfd21ba384550c7ab65a033a0d95
SHA512 77877c59c4cc3bfd7ca645b3d7413381b5d6b093381fcc9a44e7d7bd482fc73831a10a57f4eff2ca3defc4448659fc44430042ceb6ffd1dc406fa7c13d8c00c6
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Lyxknw4FYnshx8Z:B68Qg55nhheWu7PNU3/jx4x8EVep
TLSH
T1DFB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 951f78e8a7f4e54e1a9d84d8e7c6ed59cea1fddd5226f053f509ef8d3fd79974
MD5 bb7a85bad8f5202be0d2a8867ad3a481
SHA1 85261e1de46f785f16ba01435adb445b9607ecc8
SHA512 a5fb5a62b3e14f2b65e9922aa99470b8ef8a541849648a1c90c8259396418e1fed5f6d8865ee848bf9e3af645a327d29b814987fe687f8710695f4c643f22373
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:Wy5112gYy5azzVvL69nLKnhZCix8EVy
TLSH
T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 577ee4bfb741baca1e143894bfe4095adc55c2309ac9d3ddc63849c84cf3ead9
MD5 8e89c203b5ad5cda6ed25cd731527fe6
SHA1 f28cd43d875cdc7e2472ca69d634254cd9657b4a
SHA512 9933ad95b78e0dcd3417c873b331cd739674e14c0208f9d626b3670be8a16167e8dddfba5baad0e73b53cfd105160f3a27dd9fbda16869aa2f8cb7b64aa6d52c
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVx4x8EVep:zu6JmVxd2dVix8EVy
TLSH
T1A7D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 59e547bf4aa46d16a754b6c9bcaf168120da456f32555419ff27891de6fec351
MD5 c583bc061cd0c91edaf94f483a892afc
SHA1 a2b31c016dfbef36243e4b36c061f8a2ca7a1179
SHA512 46aef07a0d43b9a55d1cd4cdec068b5c9adac988ad63e40df75eaa7ef14401175f76b5e83f029ba75eff4af5be4b52d09e4188797445e6b29b009d15ed8e122e
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xpx4x8EVep:NmifPbRsix8EVy
TLSH
T1BDB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2969a03a65071a37f7e2dd397beb977524a01416c95dd6f599e8d0f0a7dc5d94
MD5 c8732ef37cb66378311ebcb346de83e0
SHA1 254b4f1144d70b7457ad5b8fa650fd0ea3a4d4db
SHA512 7260d4cd17e4571e4d06e6a23715ff5cbaf4fe542be5e024eda36715745161fcbe1feaba97efaa7d6613a25e688dd8ae9552c57c9bae36d76432b22c9c05d98d
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHq+x4x8EVep:m5dKTi61+ix8EVy
TLSH
T18EC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8bec69d0c12666138b39607e931aaef3a68760aab70a6658ba55ddff6b111ee6
MD5 1c0462feeb176dbc35e425a3087ee86b
SHA1 b73852e3ac7aa8048d19be68b281046bcff1f3df
SHA512 0b19a093aa2a0a262e1697c3128d0e57a00b25b7b96dab5946c22239bf41a7e242659e97275d9cb10a26949fcb3289a96018122ec0b2231f93209184a0d51f6e
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wlx4x8EVep:iX2iyphAix8EVy
TLSH
T13095BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 97572c5d3ab0ccd234e825d4adf0d0f8e41cd48109c4d179bba3c0fb3cc3bb78
MD5 fec111f0c3ae63c01e3f560202dafb95
SHA1 cfee77460cc9cb6dba2d9ce49c541f715b8b0788
SHA512 1c01a08d163cbc35565edd4485887e1e71bec9f496464afce77b9e15ac23ebddbb80d32834823a68b0005e92a38718e245717f7c6c655db4964da3859fcf0c3e
SSDEEP 12288:Pv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pvyxknw4FYnshx8OfVe247
TLSH
T1EC65237CBBDEA5E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 285ef0f847e617af3f5fb0c26c2cc55ab5fe08c991b7491cac865de01905ed0e
MD5 7a63852a6c69b0d5118082fb3392df67
SHA1 8769fa50e448595a38a5cbcbce63c65da1c3e275
SHA512 77289b09520aa49d16d9dab2bacc29f25d1cb4e24742cc8fc773331fa4ed331733fcb134d5be7ae9e1244ac6eb37e76c516f55eda7815048c76d44684e6b13bf
SSDEEP 12288:w0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:w0yxknw4FYnshx8OfVe247
TLSH
T1DC65237CBADE95E2F50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4211636573e406194cfa098ced18e40394f79a33394ea9b2237b81419cd91927
MD5 0264c6b51f15699745ee3f28111acda7
SHA1 8dc8486eaaf73778cec3235091d94fe53808697d
SHA512 a97d0fcd4c60a079294838f2e0a9c575717fef56c4937ccc071f5eaa0475164d1e18b17f3311e2af955850a55c4c8bf49c939d2d89742a2ed52638e18debe515
SSDEEP 12288:Zu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zuyxknw4FYnshx8OfVe247
TLSH
T17B65237CBADEA4D2F54D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 579f7d686ce061a9fe4f3cbdd7a90f2355b86da95bc5c6863ca378194dc9d50e
MD5 26ad7e30b5cb97b2b7772cd975b84730
SHA1 f9bfd30c418f825a7eaa9d8d388833d028740c25
SHA512 438d2f6534077093a0ac59b93faeaad46a55e74ba96f847389b5fdcf05ea1bd17e19a6f965e2621599cf4fb04f9c9b7d053a241a3221d3abba9070109d72465a
SSDEEP 12288:XVp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pyxknw4FYnshx8OfVe247
TLSH
T17465236C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 62316a34056553b741aa5d35866a8da686d9e7c83e42711d2f09e218f712a540
MD5 d78d130f7117bd12078c52ef63e253d7
SHA1 49a829586b80b4be173cb8320ddb9e14cb7ae5df
SHA512 c1b2a7a1f175fdc099c7d1c4e815cfb78cfce600a1f2c13ac837bfdb9979789e2112e7ade939fdd5b5aedbc665aa8e971488eb2064cb9e7f9daaa5d3d8dd5881
SSDEEP 12288:ux+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uxyxknw4FYnshx8OfVe247
TLSH
T18765237CBBDEA4D2F50D11734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1eec28950da8f73363231868a61ea1cb65ec539acc94d45cd3b0cc61b5b24cbc
MD5 61e90fdd05010541845d3c6321073e7b
SHA1 cf717eef3ee60cb363f961e317758aff19b41d99
SHA512 ac6a584be474f047d7d1e4f40a8f2f955dd00aa78fc79d61b0d6e39cf85f288af8e41e5eb9cbe5ace87f546f1938884f118ab4814d962da7e1e1d8e94e59ac34
SSDEEP 12288:ao+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aoyxknw4FYnshx8OfVe247
TLSH
T15965237CBBDE95E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e84a6c7863362a706f561d4e7bc5f7be1d890fb9d91396b51c8c582111686375
MD5 adae4354302f7f713b5c192a1cddc128
SHA1 4cefc48833e90f0ca38defc5903a9f799ad82988
SHA512 414b2b8197f467c7ece1e0cf53a4312f558e28d89c617084c5bac4ff5519a4e6d3d76fb622823b38c5c0328a12bf5b4c51dc1d2755fd1a99bb5bac0e99ba03d4
SSDEEP 12288:Ac+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Acyxknw4FYnshx8OfVe247
TLSH
T19965237CBBDA95D2F50D10734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02EA63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 0f773e4e978e27b2004fd9c0f66fa326385bd1dc17c7526d9dc3434d07c56cfc
MD5 462107a2f84b412d7b3c0e699c2d02ce
SHA1 f8c5b2e949a72d5597868f1d35920a1f5e78f747
SHA512 d88bcaa7c2c9e01e7c110271ee3421e2b0829e112e4d3b8511f6f98f7d779e3dde0135426f1ec4038e75bbe3bf8885cd4e78580fc481bef5918e7b977514926e
SSDEEP 12288:NiZwbZzzFEoS2cPvyU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QZMdzFVSOUyxknw4FYnshx8OfVe247
TLSH
T1D57502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 06aaea0c6d739ed066fa8e4f1a9b04fd7a4d85287da48b036fe3f8d510b7a204
MD5 10e7f925a1a3a3056aa2fdd2efa47c5a
SHA1 8cb5b1fc31350d80657606feff1094a302b1b42f
SHA512 133064c0553c2aa8f92444aed0efb9cc0568cac49ff9652abcba5bf06a01ea48b0450f8727fcbcb2ea357097577c1ea0c7fe95a7f7584718ff39a83c51fe3b42
SSDEEP 12288:tr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tryxknw4FYnshx8OfVe247
TLSH
T1E56523BCB6DEA4D2F54D11734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 27b686173840dfda630f0b6fb65bc1c1731e057fca975319ab0b35bd10a085db
MD5 43c587caa8f98bd00cf6c61149891191
SHA1 f143e23a7f5d2bd30c8ed722f7873132857226a1
SHA512 1102765fe24fd03d943482608ec76566c12b5554e5c01b00e798a141dc5960780f9f813c2c8d813cfb9ce19bba6379ccdc9d2d0b70aa09747dd3d9e4594382c0
SSDEEP 12288:fH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fHyxknw4FYnshx8OfVe247
TLSH
T1A065237CB7DA95E2F50D11734B7172626609B6A5EA71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 4be0fc9d5952219344dec8abf98ed49c8b7183cc40cc85268055e816bf9be030
MD5 f62f1db3b35b3625e37164349716f38b
SHA1 b142a9fe46f12ba8c8ff39c7ac28914ee166ad98
SHA512 e2b119aa44c80822a18e8d701c44b5fcd7eeacf7c58c94c8e3f711de4e03e09d330778bbf299352fa57f4cf9c8cccfb01c384a059b71a669fb2e44f8c07f6844
SSDEEP 12288:FyPz5L8A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MzyAyxknw4FYnshx8OfVe247
TLSH
T10375125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 4e8c32d6f4c76c35fd628aa0eecf7d10900fa04fdba031f7c163a54fcd98c877
MD5 2a1a00f23dc996d5053beb4936f5e56e
SHA1 9a8644892e53cc685a8cbd4fa89d321bf56651b8
SHA512 4a89e4bcab3d2748a06a3a040c870a3a8ab5529a1d0166c3ca6b7de62e884c1a73347954a1f1352e727be26480ad52745340b9e47e28a484bc8edf7f07de2346
SSDEEP 12288:Pr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pryxknw4FYnshx8OfVe247
TLSH
T1066523BCB6DEA4D2F54D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 079eeb7d798cbbfa7a590f0922d24ac4362d7ecb959a8ac1ee0d6eb328773c94
MD5 66078f927fc076600b69835dea0f04a2
SHA1 def23ba947297e1066cc19d7c762f09c40cb3d1c
SHA512 97227e25c0c08711c17fdb78b1cb3995e435ef86d479c26c8353f36759fe01bb525203203e317d11a56a46d725b995ea6e0c9ac9cd102cbb10539d63653643e5
SSDEEP 12288:Ar+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Aryxknw4FYnshx8OfVe247
TLSH
T1BC65237CB7DEA4E2F50D11734B7173626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f3152b778333f8165790f63c57215c775209d698f66763fde333cfe65c8d6c35
MD5 67f6f599f4b03474453d3565f835c8cc
SHA1 0882e3a6815a5367312f343c157ee4ba5c97b194
SHA512 9f8e31e536754028ee8d01fb389a2f256b9eea7e7f6ef403d885eb6b535eb6d72ab96b392a2f2b935b677ddfddda756ac0ccde49aa806a17c067d2e5e771b8a7
SSDEEP 12288:4yPz5L8A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZzyAyxknw4FYnshx8OfVe247
TLSH
T1BE75125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a1a630456fd5df8ba452df4411867b0bcaf1d03b08eaf9826640a1dad401b731
MD5 b26b6cc94e1255001f1d02e94c3d57aa
SHA1 2c8107167aa041b14b12a70fbfef9b50545c8db9
SHA512 c19c9069fb58b583fc8465de2253dbda674d1e864d20d09df380f3fd264e92f69edf06ac4dafe2405184bb6131b26de2d3104272948d18f00f44445dbb94fb95
SSDEEP 24576:tTGaLl3z0zDeyxknw4FYnshx8OfVe247:tTFLljIx4x8EVep
TLSH
T1197502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 198551893df6c365f91b24c057fbefa94ed579d5570785ba24d82c9c9aa5b83b
MD5 84b413c401ebae10ad757bd39581c8f1
SHA1 e3a35e0d910c37cf1aad933555b9457123d7bf25
SHA512 ccd2c66334a5cd0b72a8cd93231669cefb89c73f6183b3c55b312113d9bb0b8b842918635292321c0a3d222baa1a4da951caa2f1d3add270e6556a88a69b00d8
SSDEEP 24576:83Xd9CHKy7GZiyxknw4FYnshx8OfVe247:mXd9CHKyabx4x8EVep
TLSH
T15C95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 668fc45846bebf12cfa5c01a8acd02ae7bfa5d530098da6d3c8d7a79d65327db
MD5 98e8a38895dc9065a09224362d217aef
SHA1 337a1eb0133437beb2922b4ea369eeb966ebbbd2
SHA512 c65c6058a39afaee73af24fd935bdab7c2873afabba10bb3ddce14e90aef4cca98460ef7a0fb21418ff943026256e33c56b76d37ba6d8907388ddf53da7cfb81
SSDEEP 12288:2O+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Oyxknw4FYnshx8OfVe247
TLSH
T18465237CBADEA4D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e66a7d7ccbcf26875825cf9c4a2630ecd05cf7a857b6ca2e9ce2409087fa424b
MD5 383fe651e162c471741c418794902287
SHA1 ccb3245e3d2744e6c9849bbc10dcd71b6efe1971
SHA512 070cb454ec430b3316f00308cabcc73a09919003e4348fa51a012cfb9e1ef2d28fe2bee397929797561b3ef741314c3d5925db1a8ba68c033ce5609f289c74d7
SSDEEP 12288:yg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ygyxknw4FYnshx8OfVe247
TLSH
T1D165237CBBDA94E2F50D11735B7173626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 37e778bc7277224973ddf324ff2b498283282530e60f66b4ef478d0757f0d72c
MD5 2425b1bda7356e83aacfff6a61796c0a
SHA1 0e679b39babeadf247b5bef250828b79b62f8c0a
SHA512 fed53d4f87527c9856133baeabf40ab371f17740a142614c8e1ae9af1ecf8ccc8bd1d70b2f98d328f0adb25d618b246bac54ad211b9cc228651ff38aa67a88b1
SSDEEP 12288:YF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YFyxknw4FYnshx8OfVe247
TLSH
T15D6523BCB6DE94D2F54D10734B7173626609B5A6EBB1811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f633b6de946181b0cad070b9863f8f0c36e64807ff65b6b785afa4c5e3c025c8
MD5 ffad45b34e6b3536fa3a0773ea41e0d3
SHA1 7a37000302574ed6a16236e2e064ec06750acb12
SHA512 ceb3a228dc5c06d72f9ed47a3c442c99e4fab25e55d06d153dfe8269363914ac55ce61e745dd81d7e0c681e00d2e44227302351f69d36fa6ea5da63875725590
SSDEEP 12288:Ar+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Aryxknw4FYnshx8OfVe247
TLSH
T1776523BCBBDAA4D2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 faf08202b285afca224f668ec38706eac0c5c7fa39c5d1b4078cfc5697692af5
MD5 afbd7a0a8c48bef6a80124ca5324b07f
SHA1 3965b6bd36566d75e1993b343ac9cb7e90c15f73
SHA512 c0242d5b422c6abc581de8f1e335d0bf0bf29db82cf325d650c480fdabae72fa83c82bfd561a3b85c22b4792211122b946f1991c3940e4330e2cfc6bcb37ba45
SSDEEP 12288:yO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yOyxknw4FYnshx8OfVe247
TLSH
T1D265237CBADE94D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A12E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 43e550d1a1f1d81cf0cd8fb9d3f2fd4467523dbc1971719f7acac893acc4e7d8
MD5 743102cdcf78e3b71787eca123bfa214
SHA1 7b9a149c65a491cb57bd713975a9774d7857dc64
SHA512 5ec16e21d31b152aa769c04ae04e4ef4ac36daa41dc9d11244b38f030424800a653a45e4eba79d4eaac611d350775ecad29af00b9511f997c4acb9d14b50a2fa
SSDEEP 12288:JT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JTyxknw4FYnshx8OfVe247
TLSH
T13965237CBBDA95D2E50D11734B7173626609B5E5EA72811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 16551015dde73c3f1a91bbe285cd2965e2ab675e45464662c5f4e93ec0e953d9
MD5 e64f56344365a31132c8f2ad06248a25
SHA1 1506e8b9daffd7c7e8cad16c73d48e45ffad34fc
SHA512 4508eb956229e18f2685568dcfa25eefa48747249965871f68f8e19a3223971412a0d25b9729da1efbce192d474bb6c1e7f5e57e7597c95a9fb4f7cb51ba5190
SSDEEP 12288:Ix+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ixyxknw4FYnshx8OfVe247
TLSH
T11465237CBADEA5D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 232005551802f6cf9e6194dc6e387423f07d0558d7496b542f460b219f9e3549
MD5 a74490b60c6fc0dccdbebc0769f5931c
SHA1 d6556abaf9bdeafc33cbdcbbcce2a3272c2986d4
SHA512 39b24270e57d7f5d258df40d6a01681405297f85cdf90ae6d2a1a7f04afd0ae43d9612d4cab39989a70852c6ff77e85d0de8e851dac4110fc38c7482632334a0
SSDEEP 24576:GfwvJk9RX6wkyAIXyxknw4FYnshx8OfVe247:jMnYIix4x8EVep
TLSH
T12295CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6025310663f023f2b87a4857eafb2ed1c1b60169e001991d5337618cac057bfd
MD5 e4d9aba608cd9bc4c77965357679fb3e
SHA1 cfed69a12c7d2ec32310499221bb5cacc29b408e
SHA512 ebf241725dd24dd3446829c6266c11b30cd3acad3fe6986114414d4d238c636d1e4a56771ef8800821a355ade9367fce5fd70e7a2b60a13cffc191695a3cf807
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Fx4x8EVep:OySzPdix8EVy
TLSH
T160066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e02407e5207f3c1bfb0f4f175a28b1887e055ecf750db68af8d0373487848a89
MD5 a490a7f24bb3fa3e0fe9687a4a262887
SHA1 560870ddd0e4e74427a8c5998594b819c9cf27b7
SHA512 c126ee39cd9dadd5c417c85b6c6dbd73d8f78bcd0334777a72f9d04349aeae48554295a981b985136cbc7d8d28c3d8ecf174056f3b71c90b24b8ef34b568d027
SSDEEP 24576:q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYkyxknw4FYnshx8OfVe247:q47JUQj1irIhCnDHUPfF/Vx4x8EVep
TLSH
T1CA65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 823263df7f252c407be4ceb462d15fd73acbf8452fcab6922d3a35e6bb912bc7
MD5 14f6392f2b85654e195a6c63d790a49f
SHA1 3b687bcf19220f35e5c314c4897a7648e4653fc6
SHA512 447e76df0c72b68723e22be2733ca7f26c4d179acd5d5085a484ea6402b7ff3d148b93b570adf917ad12f288fffd3ccae2eb1e67c23fd2fe50f1862665c1ce4d
SSDEEP 12288:Z+sfb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vbyxknw4FYnshx8OfVe247
TLSH
T1BD75F028E29842E4D06E2276CB625641B3237C6597F1C3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 8681efa5f2dd7cf76725533cf22c99f9d24e2b3017797468eeb69f924cf21506
MD5 3dc54abbc0c59e18d382014e853469c0
SHA1 bf025a7fc1f60bfaf15423065d374e1008f11a68
SHA512 fe6abdb954bfbf505e5d9176726f3094184feb9989a31790ee3f8ecdf64fe28f864e63d18f7621cda15ac3c309d8781493284e2650313138de0fe9f6a2a445c8
SSDEEP 12288:cC/LhU3fvooYhKvah7Wk5MKb0fvBSsZJvOdxftd24PkKV:cC/VUPvoD57WkyZBvJvcxftdJPkKV
TLSH
T17E5518007626D68FC6AD40725E36D6CCA770BD41FE48AF0773C8873F9476658B6E6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 152c58ca97ccdf8db9e726c45f647b06b45f896d57e3d1478a8c86e8a676a427
MD5 7ab7ce38ae2ed33a47e9fcbd14b762a6
SHA1 7a22c1fa488bd9d9fdc9a8aeffb1551031757855
SHA512 8c5e9ed1181520556d7fb3b325086f0a39d924d04821f2db6c9bce914b6c1a45ca4b8496ed9b413cf44e883c5d5c43438d20b54b105175add641bae1456a68f6
SSDEEP 12288:FjOI2AySj8+KCH7JOZB/OY53PIslBehQkmFVwFFEQG8KoWPZI28eu:VQlbvqVwwO3PIsliF1n6qz
TLSH
T140551A00A5B3E30FCA7E9077463286CDBB746C07BB452F157348893C986795EB6E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 64657f06f50f93d3f03576e6c67a80372faa6e86c28bb5c63aef2736b06c3783
MD5 0971918acfeb6e2ec11950e417b9b24d
SHA1 8460040073a1ac73434c51f881fe00b8628cd93a
SHA512 8cae9f58b97e9ed2311bd6f6ee4c5b6425e3e18698db79864b2a33fc9cd5fa931640faf5bf7a9c39661489cde73213db45fab6ad7bcd95b123a513a381d9f94a
SSDEEP 12288:g47D+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lDyxknw4FYnshx8OfVe247
TLSH
T1F965237CA7DEA8D2F86D11730676A221360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f420b3bf17ea0ded269bc4c9c1ab09ceaf8d0aec89b8b1c50e6ff71f9dd2a4d5
MD5 13753b01ba74c067bf4acf0ad6e261f5
SHA1 acebb34484a4583e82eedd8eba32b2fc5dc232a5
SHA512 0b33f958b30dcc31555f84c21112f7644259d9044cd97bc4ccd54e66bb7ff1dbcb1cd5438c24be3dc67613cc63d99e913a7963596c0c36653497015ca1a0b932
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYdyxknw4FYnshx8OfVe247:ogb4mBIBhGF/x4x8EVep
TLSH
T14565AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e0909b72a91c3ae7b6f8a64d22b786904e2d6c115479065fdf766a985f89aee7
MD5 bc40c398d37375776943e80e8a80d2de
SHA1 1e0d8726d4d28f4925c80cf10b2ecf4804ec080c
SHA512 48c2b5992097b18eb9f4d6fbf4f4ac83c6b237048fb4aaa5341586f69fc1cb4c705bd5dafb026b717996a8184989c9aa5235943c53533fd367d737a4b772921d
SSDEEP 24576:nG88u8FpJqH1azria7/mUyxknw4FYnshx8OfVe247:G7ZFPqVla7/wx4x8EVep
TLSH
T19395F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 15bb9ca4240b0f996c6a127215f02f6ec38ee9302cadcf54a960cfb57d6eb069
MD5 0e648d36b9f0f33106814e833d7a5c21
SHA1 21dcfd413beacea74a2c927f09309c49002e6703
SHA512 24d0426252f230b1e9a71a65c509150bb4817d39a8f670e2b0f607b862d64d7ec2631bae994005e8a00276440ce4307d7120d4e9bbafb2485a5f69b14be4b55d
SSDEEP 12288:oHvUrBFrEjwaQ4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oPUr+NQ4yxknw4FYnshx8OfVe247
TLSH
T16075F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 10a957c9ce522e3c7a90cb706a7e62511cf2fc86500f50976fcb7091733eb0c9
MD5 11dd565d5f4e79d0780873de290a9e8a
SHA1 9ee04152164db9aefb12fa1def7f5c998f2ebf72
SHA512 b42af90df87c299e1bc9e58d929e4cbb6755547bc422b5c80135b527debc8205e37bf839a3ebda6f6dff7ec21aeea99aa14f55f1e770463efed4c6af53beb61e
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLx4x8EVep:0G05lO43bqix8EVy
TLSH
T19BD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 696fe27380c993619766a726f33d885a69e1e1d0d37d0e6478de31ce5a41240f
MD5 669997e5a0a5c8eab5fb354351ecdc3d
SHA1 de8e5a6d80afa1a7058f3c70b7e886787fa49166
SHA512 121980e40f67c16f495e9f2abc16f9c339918b2779203d3501efbc35b1497d3fd3cff7cd4e88ee69c09e1909a3bb0b3377e67d04f0addb3f501256e9592fc6ab
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqyxknw4FYnshx8OfVe247:Ta5POZ3+Jt2pasx2+mjx4x8EVep
TLSH
T12165AF5DA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8479bf8e545667c93a9868c36d05449563d8c64b1c2f177e8be8d674b62953c0
MD5 e56aa585890b017206dd1107d96d7119
SHA1 ee468cf5978fa592145ebf6bfd29fc21fcf20083
SHA512 6526d378c6e2b1f547d4f2f69ff542ff1f12dc100fc18c7ad0a2d97f3d6d6b7d3afb133bdd329e80c68a804179a85340c44b3567747068d07c20a3b17ce8dbb3
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkMyxknw4FYnshx8OfVe247:LNc/zEOVHFQx4x8EVep
TLSH
T1F3857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6d8fa49bb28a218d13504e850a9c4c4d164aba1ecb6cd15d5ce68debcbb147ed
MD5 2fb41e2168af9185f4dfe54723b39075
SHA1 457b973f716ce59b0a7ac2dfb5c23eaf62d76428
SHA512 aead62a85f073fc28c9258d5a76ae08bf84dc7e1fdd0c5ce1680d4b9f73c67afc3bcff9021635caf5ab8b404059da3ca963bef4852c31164ca16979d0d044460
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmmyxknw4FYnshx8OfVe247:x8MwBtOmZx4x8EVep
TLSH
T18455AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 2a68400b10da090a48eab532fd5c81af29c061fcf503d137ca4aa2dbbe058af9
MD5 dd4aa8d44ce48395cb62c7205199ec35
SHA1 74c9ec4197b752863bbdafdb2f8a7ae3975285a2
SHA512 87681972012d0f8e3300e972b732e64ded36b25d347b919c565dd617ac6abec935d3782ca381e6ea874b2fd971ebf60f2f63f42143cf573423891e86c1150dd8
SSDEEP 24576:tD3FHshBIYQgAPyxknw4FYnshx8OfVe247:tDVHeBIAA6x4x8EVep
TLSH
T19685E17DE79C04E4E57AC1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-252-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1792-59-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1792-53-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1792-52-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3420-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3420-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3420-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3420-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3688-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3688-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3688-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3688-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4132-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4132-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4132-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4132-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4132-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4164-111-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4164-119-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4164-113-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4164-311-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4428-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4428-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4428-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4428-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4428-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4428-312-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4536-81-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4536-294-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4536-76-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4536-82-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4644-75-0x0000000000400000-0x0000000000852000-memory.dmp

Download

memory/4644-1-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4644-6-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4644-7-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x0000000000852000-memory.dmp

Download

memory/5324-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5324-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5324-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5416-38-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5416-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5416-50-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5416-48-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5416-44-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5600-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5600-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5600-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5600-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5656-63-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5656-65-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5656-279-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5656-71-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download