9e8cd3d2dd2c113094df61f4205294b4d4a82ea045de20868f06fa4f216c19c1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 4.3MB
Sample260723-fbwskadr2v
SHA256 9e8cd3d2dd2c113094df61f4205294b4d4a82ea045de20868f06fa4f216c19c1
MD5 c0e36f0d77c5a07aaccfa8b7dd5983d4
SHA1 f4b79ca56334c2e2c7a21bf180de3a7d82fdaf7e
SHA512 1b04155e5e6e32f9dec850cdd0a6e89318af045561516d08c53503f21a8e37b94ce6620708a466ce9de53452dce4e9ce9670664bb915f7d903c267d45b47b3af
SSDEEP 98304:GOMZkM6EC8Xpk/mRuWsxjAK/859y8B2Yyjl:GBZC8X0RxjAoB8Z
TLSH
T13526AD62B940C422E8D20076E6BD5FF65C3D5E74973980D3AB913CA869305E3773E78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3396	elevation_service.exe
3064	elevation_service.exe
4232	maintenanceservice.exe
4472	OSE.EXE
1724	PerceptionSimulationService.exe
2384	perfhost.exe
1352	ReFsDedupSvc.exe
5108	SensorDataService.exe
800	ssh-agent.exe
1952	AgentService.exe
2288	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b07d827423e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a54ebb95d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023be37bb5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000576c5bf85d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddca49bb5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ce0cdb95d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b7cf6b95d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f5743bbb5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b454e0bd5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000239c0bbc5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3064	elevation_service.exe
3064	elevation_service.exe
3064	elevation_service.exe
3064	elevation_service.exe
3064	elevation_service.exe
3064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1876	2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	1952	AgentService.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1352	ReFsDedupSvc.exe
Token: 33	2288	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2288	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2288	SearchIndexer.exe
Token: SeDebugPrivilege	3396	elevation_service.exe
Token: SeDebugPrivilege	3064	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 5996	2288	SearchIndexer.exe	99
PID 2288 wrote to memory of 3784	2288	SearchIndexer.exe	100
PID 2288 wrote to memory of 3400	2288	SearchIndexer.exe	101
PID 2288 wrote to memory of 4012	2288	SearchIndexer.exe	102
PID 2288 wrote to memory of 1124	2288	SearchIndexer.exe	104
PID 2288 wrote to memory of 2808	2288	SearchIndexer.exe	105
PID 2288 wrote to memory of 1216	2288	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_c0e36f0d77c5a07aaccfa8b7dd5983d4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4232

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:800

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2960 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5cfac0f52240b08c496420139bb3fb86101e39d437fff425a1e64b4a89ca4d64
MD5 30e45f9607de9754380d3d5180dafd2a
SHA1 19b3daaa124914fb980f2dfeb92f908411074d0d
SHA512 636cd998fa55c307ab282a48dd09beb41df8942500c3fd00fd1f7a13d94842aee63b70762c0285800277eab290911d335f3377c943ea1ec1226686d88be3c09f
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvaB0zj0yjoB2:P3q6HjBRB2Yyjl
TLSH
T1F5D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 90296e4dbd5507daee582d417811708d85438bd08ac09491c18141498273f8a2
MD5 492ab0068ce9f9efb688d544ab88cfaf
SHA1 27d6eb7eb9ffb41de525af7a3be901725a2380c1
SHA512 f85363b32f152badeb101f0fa06811da46bf0fad87a7b2383860d216b47d1255cae254136255042d70444494439a4934bc3e6f5f050c0572ccfc6c65cfa2c290
SSDEEP 24576:GXYfDtczASatr0zAiX90z/F0jsFB3SQkv:ltcRaB0zj0yjoB2
TLSH
T1B065022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 50a5097b2023cadc85d564ff1aa7decc46f9e8265e05206a0eba98f30eed81ae
MD5 8c927d53a638c00120edb025a5f3080f
SHA1 bf54dd97854f335ce77453ff020c2ce588ba29ed
SHA512 103780f69a2a98d3c9a7135daa21bae878de64271d31765528d5f0a6b0b42c5902cb2c3aeb762665b9ac6f7d167f356a7b7ae275c8b719e61b38394fe5038071
SSDEEP 24576:r0Le5ji0hmxirMHatr0zAiX90z/F0jsFB3SQkL:rPji0AcIaB0zj0yjoB2
TLSH
T175859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e852cd97298b6c76a4a041d9982e667c485abccfc0f7cc6109548d311c5cdf5a
MD5 88bed5f8d695102b83ea74049bd3b0da
SHA1 0bbed32a41b3cd15d0e0acf15845fcf12cbac794
SHA512 e6f460770f8da06caa5c2db69cc6e2e51c59dd198d20855e264a5abfe3036c5281d98f87fd32368a72211682046baeae8ea4fd0d9ad5d3faeb0ffcb3a8ba4ee0
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuhatr0zAiX90z/F0jsFB3SQkr:C/ezSC6vUzPvxHjykaB0zj0yjoB2
TLSH
T1AF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 30fa962970c6c0222a065a615ff7174f19f5ab94213dddf2f8fd89e45746491f
MD5 74e615dd544c6f06a7582f7b3f9131d1
SHA1 944e5630c804641414232706301ec28128c62584
SHA512 82e12243f128b106d8a5ae3685a4c71b18387272087bda23c1a87ecf11260247cae9446e876d52790bf3aa030b0557e31c0a1133bca26c4d97462617288c2cb1
SSDEEP 24576:uVbqPb88hv/l+6Watr0zAiX90z/F0jsFB3SQkS:uVO88hXl+DaB0zj0yjoB2
TLSH
T15C55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c001d6a4c4b82146a4bb124da98dfbe205d2154054b486be9d81b4e756a2cfcc
MD5 7f9dbe2f1215a8d3dcf4d4a6444d7740
SHA1 30fd73000d7d4eb92c8dc177c6bd435c15320713
SHA512 95107c9e43f44bd5c894962a876e2dd7acacf83753c2ae1ebd1625c6280c6a4784d2e4f2d488cd8b7ea4c976f2b5f83a14a4930c0ab865c0ed9e548c2fe1b192
SSDEEP 12288:ORLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:ORLatr0zAiX90z/F0jsFB3SQkV
TLSH
T15245230B341E80F2CDC32B3566989C4B1AB99EB065E2AF85E1913F4FDD3C2C695652C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3bab8a938533a2dad4abe2acfa055af16325c356cbfe4bb0f81e2d29d90a0401
MD5 98acf600691cd7820284dcbd70b464a0
SHA1 732402eda8d7ef0ecd9242ca172b98672becfaad
SHA512 3beb51dbeb4a8301c6b1b940c278f6882ef210b27567ef0b9a8213a798afcb4c0cc3984af8870d80d2b4273c9bf8c435f21e2e0c27cbe3d1c3315240e563bbf1
SSDEEP 12288:zeBNUbTVO86UOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:zJIUOatr0zAiX90z/F0jsFB3SQk1
TLSH
T1C165CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 acb6982350100126ab377264b6afe6753d25348cfc41f8e3c5cc366d02f86abb
MD5 08b6898943ccd36cd8c74ace6b9a0e54
SHA1 c809aaa0414e65cadb9273d40a5b282e95552225
SHA512 99c6e11924d4111d29db0de2e4dc13a20f1029cced8374524dcb53f370359833d68e391606ac774201e70aa58ee8f3365ec8e19a57b9f6fed71243c1e0b05cb6
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:1QvGAdlCEL8c/yRNw5CYB2Yyjl
TLSH
T12B267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e06e79777e26e929e92f71cb2e39942a226d50cb89b7871bc939203cd6878d72
MD5 56a606593464ba7aa56f3dee8e76dd8b
SHA1 47a9b9e6e0386f8115c1fe207590214c650b1127
SHA512 500ef6087efe8a592dff21ae3690e08063b7e9b831c120a96e94e22128368e518984b72bbbac51ad4ee0dc3012abbcc1a7b58a078b7eca24c2ecb29a806beaff
SSDEEP 12288:DAwSfxL/2Dc34DLLmt0LDQewsAjYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH3:8dewsAjYatr0zAiX90z/F0jsFB3SQkP
TLSH
T18475E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 de2de272f0106e69460cc5ef38cc8a092bf4ea6d87f9935ddb5bed2d1b29995f
MD5 9eb732b8e109a7525b39329715f68a4a
SHA1 395736c853176a3bb61e571fb878a51b4e3cbb2a
SHA512 7e90c508d551d0651336e55d4056d934404420a923e0d76b916bd50eb1d9f89f27270fb9fd8a5a79f87f72d31282737c4c566938779a6b72a7b057b35fc0a200
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfZ:0UEtQevvqc2W1cpV2EI32x
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f92548d389e70eed057264c16b85a44e1f8e405346938e16eee2b1f247ede66c
MD5 fb7cdc0fe5d5a0311c4852d883eeacfb
SHA1 383a6c6caeebfdfb9be1f33849008a4b4d140eeb
SHA512 90841c325c0cf2a33a954c4d0cf9f3bcdac06c6624ec05e3ac4bd268630279c99f53c7b0c72579927f103bd56516c32ef3e291cfa66c43358a2e1c58d6938389
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/z4aB0zj0yjoB2:boqtVjnm8B2Yyjl
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0b0e21bb06369a48b9d533bd89dfb95d93106a216901cb8cb5965a976d23218f
MD5 890cac7dc5ea22bfdf544ba6bd9a4a74
SHA1 d40575e08a6ee6caf054af6bd20f4c227079386b
SHA512 e6468ee70d06b7d97f47919af2eb15efd580552a800beeb3cd9b42da3a457ba888626470d9f7e971257b2cc0c7dbe0db5922ac104f321b7d750c57d376dce1b8
SSDEEP 24576:8AhGLJIFoiwtA5l7S53tatr0zAiX90z/F0jsFB3SQkC:8AMyFoiq5daB0zj0yjoB2
TLSH
T1B8359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b03f12fe16bf1a3a225a25cc3d0a59aab20966b9457728de4d48114304b378db
MD5 16ca463c6ec556e5a0a290472393710f
SHA1 b07bc290baecd3b9cb1cd67c4e44bd85b542be1f
SHA512 f1452f2097e0f30d25a38837e43c768c42ac1cebf5c6d4542bccc5823fc852a485589d14061ff8d670a695dbaedbf9847360d2e5e698ae4e1487b69070a79e16
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:nwuoOWEatr0zAiX90z/F0jsFB3SQkg
TLSH
T1BE65F14A36A90CF9E9A342388587C536E7F2BC112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b979c10bc5d0d7b7803afef6aec9e267c9d24e638fe2474217c62007d3acff58
MD5 d4b8c3872d87a70d801780da5b4f24d3
SHA1 5bd15de1881f45846a50ad843b2520e62cc9c40d
SHA512 68bfb9f973fa18603d10e66e77dd0cf28959bdce837fd330df2e7c30fb84492d52193d59a7a2ade3a6eb89197e057c48186bb2c175e3ee47f51d7443bead16c6
SSDEEP 12288:aBZ1IyoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:UZu/atr0zAiX90z/F0jsFB3SQkw
TLSH
T1F155124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04c0816ded4a318851551d464ef2d15d1e370e9f61a1dab48e7d31d6e3a50b36
MD5 b99a0c241935f37732391c84e3a2ba0e
SHA1 b9185bdd4c076d6e9c3e15f5145bb6d94e89b821
SHA512 8d94c78b9ff4937ee43932788f554349672121a338e3dc85dbcd3ff58e861ccbf6d079cb107785cae74c7e3f5e8f62bb5b5325c71fc6d5df017946fbacee8279
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:aQRQyi36YOcPQLvw2gAf+PN3tB2Yyjl
TLSH
T12B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c907e2ad24ef4e38b4cfa7293b3d6d6bcb1e1dd84fc842193fa2d89eb788d54d
MD5 4e4b96dca3af9ba23be63b161b70854f
SHA1 8ebcdd953d9223909f11a5f20421fe65e891dc0d
SHA512 40c93ef3d2e0d1d269edc21d69f09e7f79bc49968a2132d5243699502277fb07ead8a5368478a42b0c1dbf45cee51b0988bd8c0206d2506f92ee279d5325352b
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:9QRQyi36YOcPQLvw2gAf+PN3tB2Yyjl
TLSH
T198667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dcf9e305136edfe4c6bdbaccc2a3880263cbae15e5f8604288fdfc3ecb1334a6
MD5 7275426ff66d4147a4d1e0427d27dcda
SHA1 ded87f8a3563d08ca4c4fc082e768d09567bf2ef
SHA512 a7d247f3fa7e5d6234a393e2cb4ce89a303a4217dda7691449ffbdc4fa15fe16948a44a317d313cdc1b6bd274f57645f90b2f8544ada9ee9eb0af4932053b278
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vatr0zAiX90z/F6:w68Qg55nhheWu7PNU3/IaB0zj0yjoB2
TLSH
T18AB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9446699e70b4afd4fa7ec3b4a318c246e8801e8f23e8135dd034cf1bd239ad63
MD5 e86375174db257aaf868db33c070a76d
SHA1 d35abb779773a608cbbde722348b89dc3c388e84
SHA512 4b7e99318c6e488294ff4fea30d8ae697fd7588c187bd37e79c2fde5ceb0110737d459be805d0ead160dea36881ba329c4dca84584f64c3b01b8cbc7f7d64d85
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:Hy5112gYy5azzVvL69nLKnhZ2B2Yyjl
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7cbb8b7a4100acf5089061af10fbde2482ef37fcb29295dc9fe00b81d6d594d1
MD5 b1375ef5cbe1aa4e831e143a90224811
SHA1 16155dbfcf2ad74254a46499764c368df0a40686
SHA512 ee959604a494d4b97170483433fdf5db15f393300d59ea686c0b789bfbc04f00a093f495b1a949fe3ef5c891a76d52d2118de3c68e2ee743010ed53f8eddc489
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCaB0zj0yjoB2:Cu6JmVxd2dFB2Yyjl
TLSH
T12CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d686204280fd91354e5336fc387a0cceb3f852a13938ee3cb26e71bd3e99b77c
MD5 8de1ac44d6f893efa193039d1b28989b
SHA1 82937a2c7405c5f53e810e4cc056eb2dd14f6086
SHA512 bf8b708f86e191f43a6de223402ca632713623dd65f518c920475c56129ecef75c4e3ebd02f7da508fe7b393d1a891066da52f2516c89f51ad0297856534c114
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xuaB0zj0yjoB2:hmifPbR8B2Yyjl
TLSH
T14DB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28d975d452e3bda1dbb26b06c48c35996935805471867fd7e2577b66fcaae9c7
MD5 c1b96b4dc5bf29434bfd1c3e7257db76
SHA1 88381247fd19bf25fe8c6d9f6b0c3be0ec01e4b2
SHA512 79166dd9db7a4c3ae5101718b68c6143e36e5fe1abc79dde2bffeff9e8f7211f5c075ea77ffa0f321f5a60ba1291c18248860cba745fc056106d877197264a4c
SSDEEP 49152:1SuZQIY0Be2KRRVtOnks6NMHq/aB0zj0yjoB2:b5dKTi61yB2Yyjl
TLSH
T1C9C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f9eabe87cced67e06f1c518f12842bebfe05864fdbf5c5b75605ad247da6f3c
MD5 a0e2b380ce88e15b882539abb30368cf
SHA1 c0bed7bb8a029fa5f1a65cdfe04dd94bcfa1b64d
SHA512 f741732d9017c465bba36f801a36c5babf02cda97ff3e1770d2f9ab699c2efbabbac351d3afb38a19da84b720fee756f3e4c63c8e0f821c149ad6c902daffb28
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wSaB0zj0yjoB2:hX2iyphAB2Yyjl
TLSH
T18C95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d2ba7d6bece6bd7a92481b5dd6defe1fd4e7e9380ba4cd3a70374787adf7ffc4
MD5 2c80b30199be10e41ce78c7ff804ddde
SHA1 128ea66b63336e06f460e110d0429acef2b9c90a
SHA512 f63c25deffe8179ca323ddb5aa07b25b3089a95291db9fcab2ae133855dc98e489193eeeb755094ff2a04222e2e71dd4f8554afcebc063eee1825d2b4072a046
SSDEEP 12288:jDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:jDatr0zAiX90z/F0jsFB3SQkv
TLSH
T1F545230B381F80F3C8C31B355688984B1AB95EB0B2D36B95F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b20d9b4b7d9f01edd3d35680eafef847b32288e93ab8153dfc8cc8499c71816f
MD5 68611589bea8c2c08a038205725919a2
SHA1 03d38d2f1687c5ab00a9b6d9bcfa2ff4c6e876b2
SHA512 c2e5cbb7fd7ed531f73a826bdb3721b4161ab17762a0663a3b834e68a125f137befe02cf929a806e460e0622b512200efb42e95d88ecb359b7288af29ba6e860
SSDEEP 12288:SsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:Ssatr0zAiX90z/F0jsFB3SQko
TLSH
T15045230B381F80F3C8831B355684988B1AB95EB076D36B95F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e469fdab058002d5b2ad6268e11c511795bebcdf9830a6e0dc5c875592937a5d
MD5 3510652d474e8d94c75f5e5fac02469d
SHA1 2aaa6be6fb660ddf336c1310fc530421d6968085
SHA512 59aef3e595d0ba62efd2070440e7c418da18c18000e2e4510782e88ec53b0e585661ddf549ee884a26a5689cf0a27ce97ebfad39f7e5bb9ff17f5b10b34a3bc8
SSDEEP 12288:eGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:eGatr0zAiX90z/F0jsFB3SQkw
TLSH
T1F845230B381F80F3C8C31B355284988B5AB95EB076D36B95F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f59643add6136e57c60ec5b7b6d6561ad1fdcd0ddd98f6ef742ee3ffab35006d
MD5 c0fb11a58b521b8fcecc71d979cdaedd
SHA1 a8169c68ab60be5bfe1da532da61521e16740b16
SHA512 ec61dfe7621ed105b61856750c2fc573f9df92f28225c1b73710006c6e047c1538e3603b9b9c2668b36cf3ab86acdd2f221a81ebe3ac68876b2b8b616f835041
SSDEEP 12288:xVNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:hatr0zAiX90z/F0jsFB3SQkD
TLSH
T1E445230B351F40F2C89397358694984696B9BDB0A3F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2bdcab5717e335b12e53925592fbedd2df9a75537f676a5f577a31c72835240d
MD5 7dffe3f76ed122b432cfeabfdf12576e
SHA1 dd68ef99733806061e02212e88f465d2b8dce928
SHA512 94502fe44d26e93a9d79ce10d837744bb05430a687e596e0e36f985d57a1d7c8140b7a0b84e4745fec7ab4bf80892ea36ccaee53749ed24e85b867201ee81c74
SSDEEP 12288:IVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:IVatr0zAiX90z/F0jsFB3SQk/
TLSH
T1A845230B381F80F3C8831B355684988B1AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 177e53b5d7546b597206a858bfc4bd2a12306ede96495bb2ee2203f5c2378208
MD5 d8ce32d3f014a2f00d2580e6a53868d4
SHA1 e4ef79ed2d604b0fa960420a4ca5e7ee0323c65f
SHA512 ce7cc039216076e3b116eb024f9ddea0102bf2332e424aa0c14363c90c81eff941f0077f1ada6d7f13d9e9f049f09e38424df2d3ea89b55b49edcfef4f5908cb
SSDEEP 12288:vQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:vQatr0zAiX90z/F0jsFB3SQk8
TLSH
T1E445230B381F80F3C8831B355684988B1AB95EB476D36B95F2D13F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1036db6e9f38018ccf3a22447540aaf658fdc8439be7a64a07d97de370e6e50a
MD5 2222ceea58e3b060e0160f270815892a
SHA1 3fb0c834e2fcc6e6a1f97377c7f314af65e9a7b8
SHA512 fb156cc42d7b5ed70a034edc0f1b176ee2aa7f0504554e965162a3a73678ede1129c19ca8a7da97685373d3a39a2af4c549b177537c73559388cc2cf6701bb00
SSDEEP 12288:a0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:a0atr0zAiX90z/F0jsFB3SQk8
TLSH
T15A45230B381F80F3C88317355684984B0AB95EB4B6E3AB85F2957F0FDE3C2C625256D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9bab093b668dbafc9f358514d301019d0362d191d63defe93fe65df57f893365
MD5 8bb4dfb4a416e95f26e164848a129704
SHA1 1fa202a0430bef63eacd426dcfe6cbd7d4f5124a
SHA512 dcf963b05f3a1d3ce7715ab9bd106a12c0fddcd5c8223a92ae09dc0a83d4d369db750e1a67872b7e6439697ea7cbf28d03f2cb9969eef3b18915a4e95901556c
SSDEEP 24576:KZMSzFVSOMatr0zAiX90z/F0jsFB3SQk1:KZMSzfgaB0zj0yjoB2
TLSH
T1B965019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a6ab87e2a933994ac9b2bb39cba0bda433d0b3376b98d4ac2b82426b11b78f5
MD5 f4e1fa59980f5ec5d63772ff661bc868
SHA1 a0d9918f091728ddfb89f64b549a335bf97f3860
SHA512 629e337ca8d65808b4bc9121d62ed6cbd18a776f5e59d154308d5009d8b4fa9ba56b548bd1a78d42bd38504977a027d8999b0c85220ee344c6489ec0c52b8778
SSDEEP 12288:APUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:APatr0zAiX90z/F0jsFB3SQkM
TLSH
T1EB45230B341F80F3C8C31B355684988B1AB95EB472D3AB85F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 41ea01bacb12e97cac5547223d78eebde17214c6e2d2933fba2795298e6809a9
MD5 748bb61fb635559fc68f4828bc233e30
SHA1 2efe098201d0a5fa4a2c745de2c5abf9064bc86b
SHA512 d38a224576f77394c1fc50f2dd9bd85e828531a00bb4bb4d17fbaa5b2b5b6f2b8d50bcc5352a2afa92c5f1b41e874dffb630e4cb269b6b06162e1d581f48759c
SSDEEP 12288:ebUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:ebatr0zAiX90z/F0jsFB3SQkR
TLSH
T1C745230B381F80F3C88317355684984B0AB95FB4B6D3AB85F2953F0FEE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9fe5d6ffb6bdf2aa5976e0e6b51cbca6c349b297297c7b1f1a7624a2e97f8ac1
MD5 9f256c9fcd47bc983f03efaaedd5de79
SHA1 a16cb46bdd54884175313d13f5a4c47b826f5270
SHA512 b5abb41f2660b53cd1d0d5776da4b61d9847f79c3c95fe195d69d79fbcc42f1ae6d5b7c7f1359ddd3246116d6769292e455e6a436644bb718c6a8041124ecef3
SSDEEP 12288:fyPz5L8oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:Szyoatr0zAiX90z/F0jsFB3SQkm
TLSH
T1C9551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e06269da45feb9b02773afaf32cde3c6727ff44d251b42bd7e82fcb2f2a57289
MD5 73811f2379fe956c3b5b0a007dfe7aa8
SHA1 10a6b4f9561c47bfc22049767856cadd73e2200b
SHA512 ee535a0cf0e6a4b550b5e073b99c8d2dcd593975c24f8bb154c16a499fa28333f022bf06e08c1f527d00bafc7fb916df8b6891907dbed3fe7f56245bc63369de
SSDEEP 12288:tPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:tPatr0zAiX90z/F0jsFB3SQke
TLSH
T15E45230B381F80F2C8C31B355684988B5AB95EB472D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 967e84e71eed423f3298534d1d99144ca273fc0bd7094c16f6e1a675e32b1b76
MD5 17b04817c6bde5c323a743d9fbe92b66
SHA1 c9a2358d377b192f2882f15c91cb8dd744c6eabf
SHA512 9d6d431aa16be9a490747089f738304255da5c09ce6b27088b52fb65f744605c4d6535765d81e8b41d2d29d820210dc714d14c8def451d2cb4c7546cf823059c
SSDEEP 12288:hPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:hPatr0zAiX90z/F0jsFB3SQkg
TLSH
T1B945230B341F80F3C8C31B355684988B5AB95EB472D3AB85F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4898829bdb2e2e6ee8c314c7c4917ffb3a53e0de6f2764ae7a80774f37f45a6b
MD5 2d561672db733b31e5071bc3665d8ed1
SHA1 e8760f9a34f1aa6242156a95fbfebb02d8864be7
SHA512 289b0b5d4eecfb4f273d660dc053e98b68ef4130d092d533cba4cd6a55aac27dbe0e6f8c81cf789c03fa669508c1c70bea5d8b42a7ae4449e4d0736052ac216c
SSDEEP 12288:WyPz5L8oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:rzyoatr0zAiX90z/F0jsFB3SQkX
TLSH
T18D551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 171b6afb93d2913c3792a21638cad8e0aa1860e8015af17e9b7476fe81c68100
MD5 1f9429ca93a7aee9283eacbde8bda356
SHA1 6d648e70f1ad8ca6f9d5ea088e84eca6b3deb37d
SHA512 3e2467d344c30a3062dd4af41a46dec87abdbcb829c2f0110f579ffad6a0e6674b5ade993d12c554c9d5826f84059089862e09da30ba7150ee1b3fdc20712d61
SSDEEP 24576:nTHaLl3z0zD2atr0zAiX90z/F0jsFB3SQku:nT6LljhaB0zj0yjoB2
TLSH
T117650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5ad82ca34df75e99791220af29849e5cb51d232ae16671d8c436d1a118e198e9
MD5 fbea18e9651212bfbbbc69a4b9572ca8
SHA1 110e1ff2927727dbb93e3446beb64a4a9692bdff
SHA512 dc6709e7bf90aad082c04c415c7b2a8a07e8bd83da2bc23a2adf67bcd1aa19300d9dba453caa2fa272750373bb380ccd4e9d45e504e64042da0708a9defb91e0
SSDEEP 24576:r37d9CHKy7GZKatr0zAiX90z/F0jsFB3SQk5:L7d9CHKyagaB0zj0yjoB2
TLSH
T1B375CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d8ff083ee2db293500b38d71fa3224088fb1224724b76195eb8e4bee4d4ca6e7
MD5 d49d310847c9aba711a34d24d14473bf
SHA1 842acff9ca25bfd583aebdf72af045c2291aef91
SHA512 9e0797fc6c817c0b0af64eadcaabd8f279bf71ad30a8790ba8b7662d91de69f838fedf5b9094a131e7d697813aa6c926e63560b89242a72021ac0f9e93772c04
SSDEEP 12288:ImUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:Imatr0zAiX90z/F0jsFB3SQkt
TLSH
T10E45230B381F80F3C8831B355284988B1AB95EB476D36B95F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fca9e9486b28456b541e0922676077388254aa38d3a84f351c297cb42848bc09
MD5 56ff3be22873598f94ee2e4e6dd869da
SHA1 293ae928ea595ba370352bf2594f33ac18b79d9c
SHA512 3c314d0c053ede17083dcd800c6c2d961a23a3f25a60d95513686d5605fc989726d9fef3aa87305f259857d077b1fe940e5c5842ad51b8b015484e24c02d4dfb
SSDEEP 12288:MIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:MIatr0zAiX90z/F0jsFB3SQkh
TLSH
T1DD45230B381F80F3C88317755688984B1AB95EB0B2E3AB95F2D13E0F9E3C1C615656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 186b38ab1d0db79a2c73798b4dcd5edcf3ab33689e1679a2a573cba8cd2310f9
MD5 61c0b08200ba8c339272c143dd0163c0
SHA1 df24e03cf319369b81b9870b1f059ebf4dbf97a2
SHA512 e3c9dcf34a1759294cb2912ede2bc2c71103c03a27342dd2da2946cfb377faa644abdec0a524bd0fb5b32ad457d9484b72461fc550325c5f2d7c162851a04f67
SSDEEP 12288:cJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:cJatr0zAiX90z/F0jsFB3SQkV
TLSH
T1ED45230B381F80F3C8831B355684988B5AB95EB472D36B86F2963F0FDE3C2C615655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e38b43c08cb4b691060f36e6393ee813ce2d495587e5e402afc515ea45a5b5ca
MD5 4b5611223fc077cc505ac5e1288033ee
SHA1 ee56c20eed8c18e36692462364341cde0b202621
SHA512 eaf8f5099c5d7ec9155594cf5b0ada67db939839ff478e0501717d61ec4569340c182e9227abcb4c3a7fb98262669cf519e6945358f830c9c702ea5668d975a8
SSDEEP 12288:GPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:GPatr0zAiX90z/F0jsFB3SQkL
TLSH
T1A345230B381F80F2C8831B355684988B1AB95EB476D36B85F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0acc54389a3322f622102ab16d8c93f9e3995a90fe0fd6a1d402ce8a64c81c60
MD5 0a73a1ee986efed78d597adab5083891
SHA1 bf4584c6afb493319621919db483a27a1b3cc859
SHA512 de3e1490ce866857c0f464265b7188c501cb6cd5bd62def207537454592b6b1e9db04d24c0fa1c6fe834f8ce545ba23882e202135358adfee4f10dc59864cfef
SSDEEP 12288:hmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:hmatr0zAiX90z/F0jsFB3SQkN
TLSH
T10C45230B341F80F3C8831B355644588B1AB95EB076D36B95F2D53E0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f091b1b71d39e17a8998df9cd5395f923fd9966d1822285d7c7b9b87ff4080d8
MD5 4de950843294ccc66d4e156a518d9eb9
SHA1 2c89df9f654cda6876f52b1a0a814e5a2f3295f0
SHA512 6f9e283e96d5154aa343e07df8c99c0425ed8f0b0c372f317850618a9b1e692ea381ae39ae32f675887aa129684b87c76d74aa0fb7efd6d6d572b4095d4a4898
SSDEEP 12288:I3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:I3atr0zAiX90z/F0jsFB3SQk1
TLSH
T16345230B381F41F2C8831B755684984B0ABD5EB4B2D3AB95F2923F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e90832b21fb13470b760868663c4696dfce52eda093adbb08b8de533ad4ee6f1
MD5 2102aa9dfa0df85085a34edcd451be84
SHA1 a9545caf0d6070bdcb1709f6e3f72f3ae53b0851
SHA512 d99a90f8a5cb79b922a2546e43db81787a6f05627cdef3085abf347c74fc0850a7bfbf34856fad37f9e8bec66b0affbcc11c7b6060a39d2df2d31ab919ac69fa
SSDEEP 12288:SVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:SVatr0zAiX90z/F0jsFB3SQkz
TLSH
T1CF45230B381F80F3C8831B355284988B1AB95EB476D36B85F2D53E0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8f568128cfeaf5f7625ad6f8684b9d4f3ab5cf71078a10bb1a20b4e8e6d0c22b
MD5 6f31a2cb1decd0108def115cabdb5178
SHA1 0924aba9398d5d08aa214a118cc8ee42e1102bc7
SHA512 67df056699b5ae0a34b2bae0d7da1438949f5d70e683e84c2dfa50efb9082c77d34da49876a2d529a8e5d564b1f9624ca4c940e4d165a75caa58cde49ab32c26
SSDEEP 12288:0eUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:0eatr0zAiX90z/F0jsFB3SQkP
TLSH
T12D45230B381F40F2C8831B355684984B4ABD5EB4B2D3AB95F2923F0FDE382C715255DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 54639977853b0cd1f6c748081df8c90675e0ca7014c7744b605dac773835beb2
MD5 fb1279558e91f82f82bae80fc8a7885b
SHA1 b28923a6bf9bc7f07d6faaadb9b41170fa4e12bf
SHA512 8664678bcf69d9a309beefb2d01152f2ae41260a6f1c9eb83a46b5c6b5d98597b0aaffb59f4a8b7061d432a34b69a3f5dd6ea3bdafe9bb71dd769ee15dea92dd
SSDEEP 12288:BVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:BVatr0zAiX90z/F0jsFB3SQk8
TLSH
T17E45230B381F80F3C8831B355684988B1AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f06c1e6782dbe3badc536972d605b3eded14d12e1fa4899ab7a54224c0459456
MD5 dbe8610cd0f35c24e434045b42679b85
SHA1 6925c4588f5c3be8d4ca37e5daa53ddedc96f7cc
SHA512 ead7e1611e38ae5c67d72a1a84c59d616ee52d8e66b35395a9ee53e26c59bc79bc923bb67106890ddb752805247dbd9abcaa1fad7220455c79cca950243c232d
SSDEEP 24576:5fwvok9RX6wkyAIratr0zAiX90z/F0jsFB3SQkB:fMnYIraB0zj0yjoB2
TLSH
T12985D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f12590a0a5e30e3a1e137af8f433ca4eb5760b563907c997d8d3775312c658e4
MD5 b80462e4c1e58ab6aa0a1fb3c255e3ba
SHA1 05b40db608c8509639ec5323902b9f0c27dbe704
SHA512 d1bfef7f129dc53f961bfd9faa05758e0262eb012c88aa4697477008589d92683decad4fe63611e1642a017983a8e0bbe107195172b21b405ba5280b0f1e0fac
SSDEEP 49152:EYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yaB0zj0yjoB2:KySzPNB2Yyjl
TLSH
T143066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 74adb6d7f2151e65e354a8006c6f3124a7cb80f6b8c9ef0614c82090c4849722
MD5 1db2830d8fc2a62aab38077f5797138e
SHA1 6ad50fedd0521c30eb2ad6aeb12cd9ebe0bec1bf
SHA512 665e1949d4f0abb5ecc658893514dc72ffc8d4249007dc78ce6dc8df82dfe974b4cddb560a90af7991787a5fc1e554fffc34b473c42a2183fdf06cf82f17cf7b
SSDEEP 24576:E47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcatr0zAiX90z/F0jsFB3SQkI:E47JUQj1irIhCnDHUPfF/CaB0zj0yjos
TLSH
T14A65AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b94c6ac8ab603360fed5463a23a5155f005f4118e7f0a7e8f938a2c8d2b742f3
MD5 59adde5f03bfe219d9404c24a058cfb3
SHA1 a692ecd1f9a7dad2152feef52c95103cef241706
SHA512 ec0b1339bb8b47b46249179bfa5f5c02ae5b230256b6472f74ba98e52488f2eed18b12761abb7cfe7358431738cdd2e85a0ac98c9e3378634f14934cc3e3dbc7
SSDEEP 12288:tNsf/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:C/atr0zAiX90z/F0jsFB3SQkc
TLSH
T19D55F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2763aada08809418968e4d43403989521c06f814cb26886bb7e6842c811df30d
MD5 8238d39615db1610a3ab082ca190ecbe
SHA1 1b6444e132090299b65c138d72896263b087ab9a
SHA512 47828397a26b3eb79c8296dd14fb0fb1514c66f3f330aed17867836741db9cfa3f5a9ceb74696fbbf1f976e49a3f9b9ebaa00a2e49dbdfa4216388ede60ab1ad
SSDEEP 12288:cFkmU3f95bCt1e9QLKNQAhnKCgRMVQu1KdF:cFnUP3se9yKNQApDgRMVQVT
TLSH
T1164517407626C74FC6AD40321E32D5CCAB707D51EE04AF0773C99B3F95B6658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 39c6d3f4f5eb1e0cfd49c4abf3737cb446c3aeaaac89f6fab5a596c8f7fd3083
MD5 a6d6d1ca17b407de50023b441d3b928a
SHA1 82ccdd3fc48b2210abc81cb30d39d5717433dc79
SHA512 4bcc8b923b5754872e164c0554514605fb7aaf46308a441acf616722dcfefc463e4263eff0efbbdf7bc1fa5f8e65b4f5a12d96480977ac5f7685a019fb96b1c8
SSDEEP 6144:WodojptfrgQGElYCt5XCcyxcD9tMxU6n+php7wHSnLHCe1Wv3Nkj5E1lpD9tMxg9:mbfrgzElltJCcy+/KNkj5E1lCH7rDO
TLSH
T18565E8806437A28FD1BB6032032A5F4CBBA4EC46B7495F2673C8453ADC66B15A4F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 27e00eecd81ec560c809e13eed35de476523e90c56bf9bcb5999bb54bc07a988
MD5 397337f2e7a1f36f37e25c4f91b1dc75
SHA1 088a8a46d61e7333e80b3274a3e798abf1dd1c59
SHA512 1920abe3559b6292853a9f76264adc8349c40ea8278ca98568048d4815b8523300f9441889c794359a7b3b266079d5e1cc13afd79cb72cc11da5a262b4598e66
SSDEEP 12288:NM7nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:mnatr0zAiX90z/F0jsFB3SQkK
TLSH
T1F7452307351E80F2D8E32B3452989806267EBA706BD29AC7F1813F4F9D386C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0220bc8c4f79b6530658e79382f99aa3774d4c19b36453de94f7cde24e6a5d8d
MD5 ecb8cd944690c77ac7a84d5935743c66
SHA1 350e3aeb8b8ef60a6d687ed00015879cdc1b9bab
SHA512 da6084ed5f172196341968ed9138d45c7904854ebc90ae88a980f9101fd8a5548776700f524454f7c0eb1492cf25b1a7b998162ae53e0fdc4df85ea3e1059176
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYhatr0zAiX90z/F0jsFB3SQkd:Jgb4mBIBhGFcaB0zj0yjoB2
TLSH
T11C65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 25b2caf68cda1be05f9f7173b65a1c0b08fddbbd619ab9f4dd1a844db67fe44b
MD5 835ff83ff620c86b46abe7f7a2ba64ff
SHA1 fb750e3e70f3a90fb66e5946ad6db2781427b76f
SHA512 7e76694545bc77fb760de2de8b403334923ccf6fc41a36f8de6fe42a152f93be67cb64b788a93adcb0bdb79d026ffc240f4faa5f5f3fc6818ff1844bf1522e8a
SSDEEP 24576:jG88u8FpJqH1bzria7/mMatr0zAiX90z/F0jsFB3SQkY:S7ZFPqVea7/paB0zj0yjoB2
TLSH
T15085016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f8fc53b61eca826e15680d6d2478afb0c0830422b598761429defd478e02cbe1
MD5 04c989b6f46eb8317f9c474d89507b48
SHA1 813192f778eb933268275369013996bd78030cf4
SHA512 8375244d8bb24ffeb8799f87175dd911d76eb445eb746cacc8de2cd0447e967a394fb18d5cc733a4a835028059d00752f790ccc2857235d0270bee7754b34da2
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQaB0zj0yjoB2:5G05lO43beB2Yyjl
TLSH
T181D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0b88c27fe779f4e36acfb2c64ed5a1acee9716d1ab6c5e99027a453d1064f45f
MD5 d490eec4fd6cfbe542d1126241243b8e
SHA1 9c7a6f73b16ed9672f2b430801985b887f8018ca
SHA512 ec41ada37c496d97793c70c7580086827da4a3c4f208fbde53bd3915cd75ca0962aaa41b2c4d0b8d2c12f925afa9df07408d3c9a9010504189a67baff897b83d
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnyatr0zAiX90z/F0jsFB3SQk3:ha5POZ3+Jt2pasx2+mIaB0zj0yjoB2
TLSH
T18565BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a6fdb8a437ca5fb921beaace66cfc030129c64a780a4b885a5ad3469dbbdf894
MD5 f2e34a74b4f6c16af0673fe2d938e727
SHA1 0a661d715cd8aad04d98349726cfefac5435baf2
SHA512 50b0770f8e4eb785202e64be417aebcbfc693997400e46aa3a8f87b5cd432315b8c1f03199e743afede721082818984bcb20fc8f1dfe3bcef90cb8540fcccf0f
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fkkatr0zAiX90z/F0jsFB3SQkt:mNc/zEOVHFJaB0zj0yjoB2
TLSH
T11E858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 982002713628b52aed9e14b57b3205b4357172668029f70d0283442b4180560a
MD5 42a87c75ed4ead3f6b5257a48e02cc43
SHA1 3a48852e934768be499cabf54ec9955129b55f3e
SHA512 0f2402d55c8cf6efcb2e725a6bd919c07dddb82a194208864cd662fab39ff215588d0624a6ebad7a0757cc406fbd52e6369a1de1b6a005cf817c1731e7773b5c
SSDEEP 24576:A8kNvNnaFeYhJNtmZBmeatr0zAiX90z/F0jsFB3SQkw:A8MwBtOmeaB0zj0yjoB2
TLSH
T1A755BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5f6c587798b5d7ac3d05554914de6f640324d0ce9382f5177edd4509146dd26c
MD5 6d0fbb13b01a6045aa68d7cc82bbe5d3
SHA1 ddc5ba86f2653d45ba661baff66eb7b4c4df0980
SHA512 1fb78dc047600a509fb9cad5f5ec719a7d689b77c7d5a0ac654f124a0ee8edc08a1b09bd6702c96f0d51c3e7c6c2b72898ded2579995a941de884bb1acb62882
SSDEEP 12288:+HvUrBFrEjwaQgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:+PUr+NQgatr0zAiX90z/F0jsFB3SQkp
TLSH
T19065E11F22AD18E5E677A13D89818609E771B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9d6c2563bec76d96e039d7146616c286e8149800b174de1adaa69ff0b3544529
MD5 0dd2d4f11b843c0cc751c915a0dc383c
SHA1 a612536361895808e7210defb7c8e55185c89022
SHA512 9a7c98eca2f9f29c00272395dc90f8a77e42564d02192913d86e3c8a9fad0ff11807419fd1dacd3946ac579cd75a8f40bdfdffd54f882f468916c0c762cfdef1
SSDEEP 24576:aD3FHshBIYQgAjatr0zAiX90z/F0jsFB3SQkz:aDVHeBIAAjaB0zj0yjoB2
TLSH
T15D75E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-358-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/800-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/800-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/800-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1352-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1352-278-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1352-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1352-383-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1352-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1352-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1724-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1724-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1724-227-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1724-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1876-275-0x0000000000400000-0x0000000000865000-memory.dmp

Download

memory/1876-11-0x0000000003060000-0x0000000003061000-memory.dmp

Download

memory/1876-0-0x0000000000400000-0x0000000000865000-memory.dmp

Download

memory/1876-77-0x0000000000400000-0x0000000000865000-memory.dmp

Download

memory/1876-1-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/1876-6-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/1952-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1952-132-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1952-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1952-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2288-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2288-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2288-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2288-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2384-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2384-84-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2384-257-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2384-79-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3064-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3064-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3064-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3064-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3064-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3396-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3396-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3396-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3396-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4232-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4232-52-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4232-40-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4232-46-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4232-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4472-61-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4472-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4472-55-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4472-190-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5108-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5108-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5108-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5108-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5108-349-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5108-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download