6cdcf58db48c9ff2723b5c46fa209994c6b76b2ba00b001becd0c8c6869b33ca

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 5.3MB
Sample260803-azx3msveqa
SHA256 6cdcf58db48c9ff2723b5c46fa209994c6b76b2ba00b001becd0c8c6869b33ca
MD5 2be11ef3f31a6eeb4c5cb19982fd4eac
SHA1 6276bd3cf24b103cf5c998574822f6f73896ddbe
SHA512 6343ee1ef078b3348c47c43d5fc6db9f9ff521ed1d3b398184e6c2337a87d916956808bb11f679b6893349ef3c19ffa1ff0c0f891dbebecb9930e8d0b672429f
SSDEEP 98304:ifwt8eoCua427PrHMlu2dXngqZPwd4Xh37wRGpj3:iG8Yuax21gq6ehrF9
TLSH
T13246CF137A80C0B5E15201706A6DFB7949BEEE301B2585C353C81E6F79B1AD2AB37793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3096	elevation_service.exe
832	elevation_service.exe
1704	maintenanceservice.exe
3544	OSE.EXE
6004	PerceptionSimulationService.exe
1028	perfhost.exe
1544	ReFsDedupSvc.exe
2268	SensorDataService.exe
4260	ssh-agent.exe
4844	AgentService.exe
4208	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1435266383806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a3987b7e022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb1375bde022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000220e76a9e022dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000063fbbdb6e022dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000939a45b9e022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bede9e1e022dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000162f17b7e022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d28701b6e022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeAssignPrimaryTokenPrivilege	4844	AgentService.exe
Token: 33	4208	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	1652	2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	3096	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1892	4208	SearchIndexer.exe	100
PID 4208 wrote to memory of 5088	4208	SearchIndexer.exe	102
PID 4208 wrote to memory of 3776	4208	SearchIndexer.exe	103
PID 4208 wrote to memory of 1824	4208	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2be11ef3f31a6eeb4c5cb19982fd4eac_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3544

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2820 2864 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2904 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b03e5fe29dc9109dbf168835de073bebd4a278751df61da34a1a99bc30d48902
MD5 845e7bc681901ba83c6b94bddc2bf5d1
SHA1 486e257436c613957ff377429f69778f121c01c3
SHA512 8ec58585122e9ab545b042490b129211bfff856856c076e1c6e8f2928a3c15639625e4a385a6616d60e88568cbff1de06f088f164cfbdc71da2fb152c40bda6e
SSDEEP 49152:ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnvLNiXicJFFRGNzj3:E3q6mjBA7wRGpj3
TLSH
T11ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3d28e69ff15fbca1ad48450862a70ca4e533941ee7f1e7329298dd429a6e13ec
MD5 e4c4dfc54c8202847ffe75a9fefb7133
SHA1 2c558cbe74637431b92179d644cca94c9707190d
SHA512 a4e4ff64d4b2605a8c49c80239ffde6bdfdfbc0a0a318a1d0c2128b259019c1972f5a40ca0b2dea8641f2274fe2b909a28ba55f0b9b4c766a88d069d59b3c314
SSDEEP 24576:rXYfDtczAE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:utcVLNiXicJFFRGNzj3
TLSH
T1F475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 93bfcc910c675f0cd5131626077e7ca1365652b2503414b99c4716404ae38637
MD5 a7da57337e51218e5670841d206134da
SHA1 53330af7c3e748880185ce5013b5eed33d39ee1f
SHA512 aaded068475bae767b5698595b73ddb0467d6ee5cea880a47d8e4a3aabfc2b1476c28e554f55766e72424d318c081419aed00334364b8078309dd67e98b7b0b8
SSDEEP 24576:h0Le5ji0hmxhrMX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0Az+LNiXicJFFRGNzj3
TLSH
T17A859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc895b3ced8f90573e5739eff5984c80b2dac80c4b7b2dffd63d2a6b2ed4ace9
MD5 5d47d35ef5056c21dbd92403b0f8fb60
SHA1 688d6e310ab5bda07f92293ee2231cf902644163
SHA512 0aa1eb6cd288ae8eb5331afce7be94fa1e971edf425d607eb921dd3232cbcd584e82638580e29a28623b65196a1add632042ff1d0da55e8e9582d78716ac5bd7
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:E/ezSC6vUzPv+HjySLNiXicJFFRGNzj3
TLSH
T1E5756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 11ef14b64f18f5d1dbebaff056dc358ec38fe7234d41a2a2986acad1c3625603
MD5 f996806066fe22a74df4aff2921adcde
SHA1 cc4cb00dc9a4c91914c33fd4b5df68bb9aece1c7
SHA512 d9ddb9532030dbb55ede934c40efba42141cd93155adbfe8c0916a5330b7e15faabaf4cc33a424c9cbf0726d793632da6e1aae9a6e6acb627f36d0b0a800b181
SSDEEP 24576:PVbqPb88hv/l+Bw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVO88hXl+eLNiXicJFFRGNzj3
TLSH
T1CB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8005c94a29072c0cc0a08e3fd5fc735b1e9fa4d540f04140ac57ce94a1f88bf6
MD5 5757e0b40e66d850cec6683d6f0bfee3
SHA1 6d71db3a915aa507d03898e2564aa4dd1875167a
SHA512 a81282910f6e2d55cb3aa2675fec1dcb88c50c96bbf5102170678ad0be379f7ec12d206adbac10481e3b74ae3709e8a06893da6d3c6b07ef06927d454e225b01
SSDEEP 24576:eGj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1A35523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6cc561c87aac0a6b4aa5032e2e9fc71ab18c7c076727fad8e35f53d2a357cc8b
MD5 c3a228386b6c15d667c1adf747b91e00
SHA1 c68516a15323050c048ba51b53f228cc36850ab4
SHA512 4b1abeb7588da9052973692a3ab6ea246529a82eeff024c6fe864c1130b5b462fdcba5a4ff4e53b598e1bf3cde3710831a4e6aed84414125b0e6d1ec4264f4d0
SSDEEP 24576:fJIU4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJIU4LNiXicJFFRGNzj3
TLSH
T1F275CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 915bf019d9a1eb4183aaa1c3216b75e2c40eb959e2b163fa93e38b53c0021d5c
MD5 8972731bdaca62fa64f936ab5e7996b1
SHA1 8ac1f28f721bfdb85887c261641e0ce07eba45b3
SHA512 a929f5ac003e652f9d8ad2133c80b66f4242d5875ca5e5b4770a0291f3f37f47ec6c87640fbc2f2690b9850763fc8edb9f93b1cc12c211058bbf6081aca12bff
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THW:LQvGAdlCEL8c/WRNw5C17wRGpj3
TLSH
T13D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ece232492d21826febbc7ad151faa1cb7ded7c1d70f283ff5ae54fbb9285fe4c
MD5 710dab011788edf4d021a6f4c1aeee1d
SHA1 ac69d0f2638fdf48a0ea151014bd24c1b8a0303b
SHA512 ff02a8ea6ce838482cbabd80845ac6e0705ec20f4a025666d8e44f55f8b197dd41343c0ea1508a7324c509e7dde932b838476f59fc741607ef16c488d8cbb323
SSDEEP 24576:cfewsAju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ljuLNiXicJFFRGNzj3
TLSH
T16375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 091883203d95220561fdd8fc0bdb0c12ddb40445db35027a0b5e6b28688244f5
MD5 24c902f0abc2bfc4d030927b54f056ec
SHA1 36f4c4a2ea7040a139bcee2e08d900efe425c7d2
SHA512 290538d5520b318d4c00961f7f090f6f2611f7f1660e31770075662ac5a4c857900f7e4a048f7d11fb4c06c1b38c92e584ebb4e54ddc19596c7f2092aa479422
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHKF9:KUEtQevvqc2W1cpV20I32u9
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6c3907e0f6b763a6f08db48c6821251ee854cc7271d2a8b9378fc76effa263d2
MD5 dbcb6530818c2205831d55f1fce1ea2b
SHA1 578c3bacb9f9195f0cad5a943849d4030406730a
SHA512 8b4d346d71b713ce0abef9492aac95e76aaf39befd1d4272b68d92ebbc759d7fff908fc5e8147dda91a1cceef0bf9c75e477fef9b46ef10d769a09f5a5b0e14a
SSDEEP 49152:jCbRquA/m2yL5zLfFiV+XenmE3/zOLNiXicJFFRGNzj3:coq2Vjnmp7wRGpj3
TLSH
T1BBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7c2e1eee4ebd7bb8586f8f149822bd8d287a910d085ed2e9e92c2320eb7ae36c
MD5 53768fdee9fa444456d5cb2e479b56e8
SHA1 77fbeb5b5d8bc66f7cc2f6cd3764d50db3c18f2e
SHA512 c380a6e8305c0b48cd5079cf42fb98532e22e373079fc7434fd4f25b0aff88e81d52c0537304e199189a8734540081f58b3fe7ab243d57ccb3f78aa494f7948a
SSDEEP 24576:HAhGL6IFoiwtA5l7S53J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HAM5Foiq5ZLNiXicJFFRGNzj3
TLSH
T13E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e4eded2925d85a3e781b6b3e84840fe35341da705bd6faa374950d046aedb20e
MD5 9116e252fd8b7243ef0eddc7de0a5ec8
SHA1 c769ece8a2b3229344f1decc112396e209d0284e
SHA512 e21e4b81471dd2b4a6b5abbda66af37edce84cf9136300d91a6f5dc4406e17096f06203eff7873cc68d80c871dcf707ee91b257e67ba71ee76440cc5603846b4
SSDEEP 24576:9wuROWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9wSONLNiXicJFFRGNzj3
TLSH
T16E65F18672940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9b713f3635c15c0fcbea7337334b0477d792e29bb9e519bae614854245aeb853
MD5 93353d05b386238365bd7eb9acb1d5db
SHA1 48d32be08b53d55e88ae8d69cbf571296d90e5bd
SHA512 c15a63b54aed1fb493dbb2ce62f4d5907f7a198a7938f4974f05e45e044e870457f3a297526c2ae93fc4e8deb718ff06144ed9f5fb650de6e3ad79404e8aeb5f
SSDEEP 24576:4Zuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9LNiXicJFFRGNzj3
TLSH
T13255129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d162ba89f6b888561fa2abfa505e58b7e82c6a673f167d4ee87fc4a3f0b92350
MD5 58f2d12be79d4ce7305c30e159d631a2
SHA1 5f0ea811d4b513d5abbd0efe61bb200e17715c7e
SHA512 76484f5252ad8b3e9cb62e6aa9878e94566011a9c44545b4085db02b161ab7f6e53e933615065cbf1a93fb82d2fba73552bb3028b146627532706583a64a54bf
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3M7wRGpj3:xQyiKanX+PN4F9
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d252f69df44f3772dba79fd1a6ac95aca53edd59487447cb92a427e80c25e4ca
MD5 990298c0413a159f6b39101ad9878d60
SHA1 8bbbffc61877ae9fe89f1a76834941267eb92efe
SHA512 c745791a716ef30fcd580663d6d708cbe055b6cb18b7e31349043b4b2c4b33398963bf5dde33a63db7db7fa10553ef565ed6fec1b341e15bfa6005a834d632ce
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3M7wRGpj3:GQyiKanX+PN4F9
TLSH
T111667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d1e1c85fd3c2ac37ebe5db814eb1f81cf140272efc5ad95540ec9f66d453e638
MD5 d8b586dea639c3fcc3c6009790eee045
SHA1 01a321633cdffd4e31860c90a819ae1d81d7711a
SHA512 9093aea06f9a4710f1a6785a221cecd5da791ba62410c98e9e43aec4152382a3ee55130dbef554b09ab01a782d84792803a7b20f919a3cf8a4b79db5ef7a4ea5
SSDEEP 49152:l68Qg55nhkeWu7PNU3/+LNiXicJFFRGNzj3:zthTRc/+7wRGpj3
TLSH
T1A7B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4ea4832dcfe55a6a513517f81058e56b69f24ee5733401679af89af596b9dbd
MD5 d9cb1868c293b4c37ba9abccf635390d
SHA1 9654f62e48fac74dc2a997ff32e7f71bb1d3ae70
SHA512 47bd134ec1b7b74b6b502c17dbb298ecff24ebdc89e1e7638dd07dfc7565b064c6e5d3cf4971e001094d00c677ed0911782c95583bb9c48f2c41798b2e8fcef7
SSDEEP 98304:7y5112gYy5azzVvU69nLKnhZj7wRGpj3:WLIHRWhlF9
TLSH
T1C6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9de18b260e83a5c4221808fb358d2444431e52ee2b78659a6cf951ef5b28214
MD5 1a34d1da0948af1fc58b0737436df169
SHA1 d35ed721453821ae9dd1c5fb5e611a82ecb7f3f4
SHA512 7e1d71b23ffffa7f7ecbdddcdebac3665b4d0d28b27ee61845bc930c4de2dc5b9fb2792b23dc3478056d19ea6ce0be82adf04dcf550bc02865af08feb5f1ccfc
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glULNiXicJFFRGNzj3:Fu6JmIxd2dU7wRGpj3
TLSH
T1B6D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39b7221912255625bf21cf5029461e7ea5d1f57157ab76f8128641872fbfe6ee
MD5 5080dd7e4660ffb81e45e96acff9e893
SHA1 8d2bafac38b62aee5994a4ba80aebe130a05aa16
SHA512 77011105111fb8808ec336a4f8a38933172928a5016ed0d49dec922016935cda31626282f06d49e8d37ead8f0b1e8c52635ec09fc012a1d8c8a1df83f2b7292b
SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4xYLNiXicJFFRGNzj3:xmifPqRp7wRGpj3
TLSH
T1E1B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8f565a2b441217a447dde9702c96f1a26bcce092f6f4343e78f3b443a5f49b5
MD5 4224607ffe23d37bb55ffffa9dcc0d9b
SHA1 f4e97e202733a41d9f63c1e03db9cacdb74a897b
SHA512 17edc6e7a77cf582bd76e2e66437a10bbf004d63f18d3a809e54bf7824f7ab05a668ff5bedb956bb6dd378059bcb9d2fc83dfefe6db25098d3458b2cf3342e90
SSDEEP 49152:wSuZQIY0Be2KkRVtOnks6NMHqfLNiXicJFFRGNzj3:q5dKqi61f7wRGpj3
TLSH
T199C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0b73c9eccd9e4fec714c79693ef1d901988a91f1157ca6b027121972f3246a06
MD5 3170d06f8c23d05657e12a7f4a2c6dad
SHA1 6e2cc21155f67e2aea3b40415a92e339790f86ac
SHA512 647b7de63260b35d2e9ccef6bab38a818e397c03a8f8c4f628d597cad978837b6d3490a622c525f469a8d83d012d3b3d6a14cba664cf814dfe16b028ad03c504
SSDEEP 49152:whtSn8EApI0figjgiDn0AP5wELNiXicJFFRGNzj3:hX2iWpht7wRGpj3
TLSH
T1D895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0aeed8f533a0b0791cd290409760f2fea292c7badf50d7fcc115ba1c64e9e4fd
MD5 571e97d096610964ea19c66712e0b255
SHA1 69314ffd1cd79f363729fad502df318a80687ad3
SHA512 fe4e2331e0485a4e55bb5c9ba2978328a1da694df232bd2b2da78c9460c3e69c025afcffc499128006ef00381a6b822c4b368ce5ceb2e818c82c90d039fdee8b
SSDEEP 12288:t/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1FABC003AC6755428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c8c590b2a62e695ea1adab34f9502f2f6cedb7c30b19ffd422cfffd39d5e2032
MD5 2e5389daeea27d68db9447aa05d5467d
SHA1 c090e6950870172214e5bb85848150082bd9464d
SHA512 8dad642a161806352d320cb1a7748dfb8f3e51ab975334b2dc88748cec9694588cc83de8020082fce587b8dae21dba73c0b71c2d8f70a7acd2ddda4bc855a382
SSDEEP 12288:JYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3548955B1EABC003A86754428F5881E2DEB5658E3E2483D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 efa93575ecf030eee0fc200d323f7c2b9c1201e26084897d2afa9580343856da
MD5 24bfb6ed69a780e58e38c08287626ad7
SHA1 fc33f14821dbca5639bde258eebe3bc0e74dec20
SHA512 5297f8961dad7acbdfa871e5bf33abab943e4e12d6fd5ecc21084ef2e41dc1cef2731c35c916764b562758680b957bf44ce670035577e404f5f23589f51bc1e8
SSDEEP 12288:s2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1E6FC003A86764428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 15ce3c16e4b94a991ca62c5e39665ee1c58c0665f07dcae1b4646197f1f29b1e
MD5 79258089a89e6c0d4342bc54d2d42cc4
SHA1 660bdd467610350baa614a84b7e839afb16d8240
SHA512 dd4949e2c6470d309cec3e74f8b24694f0233a551767a0cc108aab5792427db587c7ff8571043dbb3bb314c7994f88052d74c47af6a34f9521d88e45ea623f60
SSDEEP 12288:4VliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D7552392168900E1E9FD803DC6764424F2A47D6DDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e8b33f94695e915d04ab9e741a72ec63cda6569802b493092749cb9d579803cb
MD5 a3c2f133a117fb699321587b95871318
SHA1 4282bce4d23fa92acfd9ca728e2c0898acb2a762
SHA512 16ab12a8aa9fd39bf89baf993ad739f55c2f35672252b8fe2dd03f796b372af22fef5fbccb340eae092e29b8fb4039e398a2a29c8ed33d0186ca0da16d23d4eb
SSDEEP 12288:XdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E95523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0985463efb329503c60107f0a6da54ebfbbd9dde18805563ed48177223030abf
MD5 08da7cebbde885f4447ff68a43dd0a62
SHA1 dae9767a77e4d9046dfa204cc768531e462058f8
SHA512 02f99d6e4954ae53cbbb78724542e04609314971778a8ad72852e0df74cf395743f7d9df7e194a91c458825c8c9fafa13bf90394f9033efe31cf8164768625a0
SSDEEP 12288:HsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C15523D3548955B1EABC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 66f9f23d71ef696a0a4c73eefde66157be7d79263acc6607e5c27ac0fbc85197
MD5 69aff69390ee15091f05710a5724e967
SHA1 e92848b72afe49c885d99db50ccbc78abeee0673
SHA512 0eabbf9d3f094c565c24f92d5f03d916d16a564a7744cc7d05793b48a81d236b0e098c86a4ccadc3e86c91df50fadc1f2b2f349effaa4ed2b351fe4c26abe655
SSDEEP 12288:UQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1EABC003986754428F5882E2DEB5659E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7f592d9153368f4be49cc3f4d421db0724a286e15304c19dc07080eafda64f2e
MD5 4b16e6e1cc64f3f37332d9b58669e162
SHA1 2a8b5544093ec1d974284c32f7dfac29b11a2295
SHA512 76a7e4cbf26a3aa049b37386c48f73a7738bcd0d509f678f55ea2a9531c84c93ec5db1fbcc0f12da50df43f24d4019016d287aa40e6a6fd1b4f16e375bc79d76
SSDEEP 24576:eZM3zFVSOK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eZM3zfGLNiXicJFFRGNzj3
TLSH
T172750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c5a970695ef6b213f71610283ad9c65784aca0dc2b244dd7bee78623887cb00c
MD5 c1e3ad7d57996548555e22b1394c6070
SHA1 ad3c8f1a7e92572883caf150edbaa4fa7f3ae645
SHA512 631e4cbd5c01c308accb607324274f46cdfaef8d4b23d052f4f84e085b622b9d673766bcd591159efb2297ce2d902417205b357f91a9442d1992c2262f32ff32
SSDEEP 12288:/biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3548955B1EAFC003E86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c63e34f0dc447eaae9714d0c38fb476eef440ecfd1aa4886da7fdc29b834687a
MD5 4a6101545e29fead5fd6124eab021295
SHA1 8b5853bc1f1d79882d03f9b8709c66bff823c26b
SHA512 9710e93b515534f0ec350b3b7f6e39ce8b1a178c33cba19155a0770b6f0ba9cf6f1c3d94669963a5f12a836ee46e0c80028899d3c2ae28e508b0a9fed9a85b79
SSDEEP 12288:sniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3548955B1EABC003986754428F5885E2DEB5659E3E2083D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 411ff8d647b99c9203019b779ceab1dcab0b9403d3049ac965041547002731e7
MD5 86b08a3265b90ffe7f9603200f7013c0
SHA1 bd7450df2c98d9e1731528a84fd37b65790f9a01
SHA512 6e8b9a8c08054cb8dea51e4744360fa2263db277386300ca033796784ad342a0d1335a4410dee66d34b390afd1c057d6743efb3c1f2576d46fa0fbaf731474f8
SSDEEP 24576:Bzye/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BtLNiXicJFFRGNzj3
TLSH
T188650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8030411786fa17c216b109995219a609d981906df9ae4c18e8bb120a7b259f5b
MD5 559063809d9a5feaa25bffdf5152aeb9
SHA1 1c33a3a557df13dd738b6722ca39329c8bd9af62
SHA512 e9f2b453748e074e95bf503e9e1b664673312e99a02e493cabb6e52c6683f75c42d3a8c42a423bcd369cfe2b71e8fb2eb2bc409f2496391c1b3a27ff5fd6de36
SSDEEP 12288:3biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3548955B1EAFC003E86754428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 043af6e17d10d97341ac2fa95d135ae4bb73edeb2e0af7053a31b2ec374d53c9
MD5 65a75902bd8cdd42b8c94d289c578f8f
SHA1 951c571b90571b42fe0a60d343a0e3dbb091f179
SHA512 bcfe5f409bae46711229ab0f8770a80f49e97c1e3f59b0d464d6b55d3281d5a4147a49e6891a059ebcc11a8a5aa40a4a6b51d7d5917d1ebb5b672836e406a7e3
SSDEEP 12288:BbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1EABC003E86754428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e2ca62d9c2f883ba131eb26c05fb70385819faa5663cae27873a82fc11d25e3c
MD5 6ea60830221e617d0c058933945e22c1
SHA1 91e825ddab97e3bdcf2fd7f48553e73e1cce8b0f
SHA512 705207adb6fb802ae3b6e70135680c4e115e5e5647795bb02d8e9c7dc43d4680d79d130e3b36b57686add6186848d37fd21187e01bcd24592b705b1aee32ad0a
SSDEEP 24576:Hzye/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HtLNiXicJFFRGNzj3
TLSH
T126650247629530F9D17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 085c73a32091a57f0f8d423d67077876dcbdd81f9abac267ee61c99dd2bfd4d9
MD5 532469a61533fd35928aabd98a179dfd
SHA1 ccc94f4a59435b17520998c14467075b70b2b8d0
SHA512 8b62e5ff35260304ced8e1af221a0d0b5c0f570be8a5b5bcc6a5c7b96edd50fdc27eb93406b70f2be41410a1e17b9fd0bb30028ea22900c7031d49003cf50475
SSDEEP 24576:KT8aLl3z0zDQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KT7LljFLNiXicJFFRGNzj3
TLSH
T1EE7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c914a0f1e185186715bea6a4e301de11585ae63f5d9c5267b1e5651a500b8cc5
MD5 4d9f7590263f069e77694ba183ca838d
SHA1 2d99a0b06232d635af225a17814968a4d663cc54
SHA512 64c83afd4be6f1f6d548311e31001f0c8b7b98f4e7c6861340d0cf80067405f7678f12030ea3ab04d20ae8b29139e7fa2a7424e3807dcddd54f9ba39bada064c
SSDEEP 24576:N3rd9CHKy7GZs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:trd9CHKyaGLNiXicJFFRGNzj3
TLSH
T19085CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 551743352021e4138b52d247b5ccd3096a2a51ed5ebcb6485b9405d1d6da31ab
MD5 c103f2723cf12269330a34a15a6a72ca
SHA1 4569ac3bd670a77d73f045569d26014b30c1682a
SHA512 0cb57c2babea531d82c6dabbe6fca7c727973d7a4c66ab73d2153bf340d53ec30faac45aa032bb0fcca5b1a0658dff081052dcd11181de9448ef8cdddfe394eb
SSDEEP 12288:KWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D2548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5a6e16e0568b60c0efd332e4dbef86ffed4548cb8cc5b54bb1803066cde4c147
MD5 6365e8839cd430b60362cdb5ca45d7b8
SHA1 c08cd2a8e7c33447090af7dc1d01c59beacfc3c8
SHA512 ef9ca0855123fbc53291ec1c46e8b151ff3ce8dc1cf16302bdd12abb8b38ef565df83aa7c71b5ae6c4fa4fbc90009e9fa1c84a9518154db869352fd6bf650167
SSDEEP 12288:iUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D2558955B1FABC003A867A4428F5881E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f362050d55a82be70a298a706d93e2035550b5bf341191211503035662a0e522
MD5 092206dfde9d1de0b0e07f1a827a7eeb
SHA1 977ef8dc4096562455a75b2f0724fb1c5d506701
SHA512 2c79f8ff280831f618bbc18ab7f7c1f3d334cb3defdcd576d4204c21f3526af2a56663cf24c345b64b86d577bb30b877b550edc287b4d7ee496809eea2e2f6f5
SSDEEP 12288:uRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B1EAFC003986754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6b00a204e535cb3ecec51bd10da01533c64178dd1a7de199fc1505c4f2074a3a
MD5 213ef492219dd2839647b3ad351f4478
SHA1 8c989731d7e91aaab69cfe871f52a33a290c6677
SHA512 c02e825de43e2f32a392fbc388e8c574d4d764a373f429a7d2ec2d150a262d4dfd9f99ccbc1d05ea0593f4c54185133d27faf5a967d4caa4ecd1ee36372bbb9b
SSDEEP 12288:tbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1165523D3548955B1EABC003E86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 27df6c3244362b22ce7e73678ca743a373b3f0632432cfd0eb9e87889782d79b
MD5 7189b4bb7aa1aadd5bfb4e0b1d95f998
SHA1 69e00472f432729433354740d25a748e86bb420b
SHA512 705246c7db6215b8ded8dd2303a3ed342779d375f51a6400e017d8fe30704900b4a831e7e31c49a66d032af2e7b2dd9ed470e70589959303d913c98906335153
SSDEEP 12288:LWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1455523D3548955B1E6FC003986764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f42ba3df66ce43ccd70c647ae8fc30317689a850adcc4153785a6ef6dc41fbc9
MD5 87a76278707f8dceddbb45b8c557f2bd
SHA1 3ad3ba0d9f5836aac69addbf4cd6e5bc9fafe413
SHA512 ae5eea3ac1264a8a26e0eed73ddd7b4fff1ebed8346d3443cdfcf07c18e94ff1bdd7385b97c4435cd52a753d81a6198341bf210ddf10333276b90e4076a07b15
SSDEEP 12288:yTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D2548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dbaa2316c99ab0321bc879f32ccaa169e56f56061e8879a753a4985482026e7d
MD5 f9d50140bf1f1af87b9f935d33bd8cce
SHA1 2c703ba1d835e66b037aae1be12fd1c072fd7942
SHA512 993279f551f351d0d03a4df07dc5b2135e18a1288b920e2757347e5b8cf6d42513147011d2b598da8cfdabd9e6321f16903cce1268c26ac7f6fb7f0cf9cc004e
SSDEEP 12288:odiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1EABC003986764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9441d505106e8e4e2adb152e86e55543f63071cb5f4d84cd4e820075ef7cbf47
MD5 f8e9ab7e80c720138ece0141ba802c6b
SHA1 1c2333046c53e07719eee01962124c9bb3d5aedf
SHA512 7dcb816764b2a9a159eba9228591b1cebc312086da70dd8407fa621d793f8acc8e5613b37723124e6bf5ea677a00f10922b1d70eb3906abd0416ee49cfd04ac5
SSDEEP 24576:4fwvzk9RX6wkyAID/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LMnYIDLNiXicJFFRGNzj3
TLSH
T1F885DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cf2e70b7cd34fa8f822a91dd89f0a919fd09963e42381591f83c717b8536a446
MD5 4ca985ea5988d9caa4aae5ab3c8b1a18
SHA1 3fedc586436c5366e2b15ee18ba0b1f48a59e749
SHA512 634b5c1d2523fa29bbc1d3898d40d418ad21baf97f0bd508e2f63b2631752b6067516e84b2b17b9fe014ae10200b3eff1345ddb41bc8189c7babcd87464c5355
SSDEEP 49152:pYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kLNiXicJFFRGN:gySzPs7wRGpj3
TLSH
T13A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1aac3b8bb095a25851d227be42f18bca061dcfe1b9bc1fc7450129c8dda56560
MD5 6e44b3435920b3c2c89986188587a4aa
SHA1 7670bf1f38e4ff05bf6464271651159065397f61
SHA512 ae1a0ce55af7fb7cb81baca7ea2fedaa805a97de4767f64a8f18e5593fe532183a2fa6bed7e0b09ac4184a02c4c4ab1384b1f20cf2dcc2351ed6218bc616d86d
SSDEEP 24576:s47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s47JUQjqirIhCnDHUPfF/ULNiXicJFFS
TLSH
T10865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 800d63f99ee2460ece10495149e6da9e79da5a4ded1e57ab3555dd97ce418a85
MD5 0ed49701fe172b76aa67a0ab4e671d19
SHA1 04222d82df8517a031cee2f0ee06e075c354d037
SHA512 30e9e1964efde7975dc3935ee10ee2daa660c520568a091d3269b0c0b76fb14e06beae1f784b9c7ea968af4ddca74d0902fb94a50f00e61cca14efbceda830e6
SSDEEP 12288:HpsfLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:of/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12265F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e9688233c04aa020a4bf8bad836b12d34063edad97054c7bb1fc034e882b2c70
MD5 2d124a90e400c3eea36b492e2f5ac1e6
SHA1 de648f8965ca41cfe1fd54612517c43a61058eec
SHA512 8ab1d28c25f0a1094e74901a81584b8584e7682b9be299332626cc22629fe5eefb467a8e4a784ae1e5b24ef012a705605501e318c9b5f79e3bad43d79017c214
SSDEEP 12288:VF7DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523A3468959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1bc1424a71fa3cfec1190b3a3816d01365bc520266469af5de08bf45db57abc5
MD5 70ef620978a30a5fe2900298e750bf85
SHA1 3946e21b70eeeb201728242a699b77cbfb35873c
SHA512 f8a79f415668ca3b3544ee6b372ec7607f563068c94365085f8ebd550197eb4d6118d1521be8511e1800c93948fcb77b246f6155fc139c3b9cf8e74ddfd6cdec
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Tgb4mBIBhGF6LNiXicJFFRGNzj3
TLSH
T13765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 858a6111204659b2ed68b8c28106c52ac84b0f0487722fbf9d4ed770afdd21f5
MD5 257749333f7de44beaa4c082e7a49751
SHA1 bffdbaed98f19ab2783cdd3df968e6b0b770b2a0
SHA512 d4f1be071adc96b2cc1ba1eeb95fda27d9695b7f0479d55decc8c8c88f4b2233b6615b29fe19a08363265ca9c4aaf69e8f939ce5a3c64f5285872608ac92a431
SSDEEP 24576:tG88u8FpJqH1vzria7/mK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g7ZFPqVya7/9LNiXicJFFRGNzj3
TLSH
T11385F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 67c9bd636cdc22856c2264da8db000543f6da496198fb595397c412d0b3656e6
MD5 ffa6ed5df49d23510a70d8b47f63859f
SHA1 632c96bd4831ac066d366da2c7141b1b0a5a967b
SHA512 d296976b7eaebde1ffbc4b72a1847f09fb67147a2dda2bff17216321397a7b7fcc5d4c27f1b061687d12c381f0165a81ee3e4afd1fe095c58f38909b1ff2221c
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWLNiXicJFFRGNzj3:ZG05lO43b77wRGpj3
TLSH
T1F7D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 918363110fe428a1be4410e16d8d9f5154b13a38a12b86386e7d8279444c7751
MD5 26893032fa7bfb100b4a2b94b90d32e3
SHA1 454e9371e635c559f7f50c8a9101403618ba82b0
SHA512 9265b6a9f98109b8ba911b9bf14dc6a5dc9e557c67c28b96de7156c15bc7171e3d2a47113a7ed36400acb29ccd9411259ef57364dbb5886b9014054ecded456f
SSDEEP 24576:Zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnk/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ja5POZ3lJt2pasx2+m+LNiXicJFFRGNf
TLSH
T1F965BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 67dd89915bc54b53ce2c0eb7613277db6a3197e06d5c9dd7c389d45ecb7d7f47
MD5 8e651738087d3bd2ca36ded185a3987c
SHA1 c9c234196cdb8997ccccf060d6c633a1df6e3dd7
SHA512 51b642c0f793d0805c807221945842cdd7b5306737fbcb2cd2fa24f82067057a1a610b074198c698f2a71c03ed1a79d63f5699b5a41159ab7a11634c405c463b
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uNc/zEOVHFdLNiXicJFFRGNzj3
TLSH
T1F6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e93e2847c17c65269af1cbb57fb4c85a0af72707beb6aa30a93afcadb8758b00
MD5 a03d2abbcca88ac680ea030a1cfc8a8d
SHA1 db525b6daec374e9a0e7018ee97efc365605d770
SHA512 d6cd3a9574ec6653e5e302b2359ef39ceb860b781e4dd90b88bf8d51462c715a4685b2521f55cb038cd37c361e9cfb108db4d254549a5e8cbdd70027fd7a8673
SSDEEP 24576:PzkNvNnaFeYhJNtmZBmo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PzMwBtOmoLNiXicJFFRGNzj3
TLSH
T11E55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d69f5a88f120ccd298c7fbe8ad77e08047ba076cdbcd375c60fdf0a733ee182e
MD5 efe3f35473a707f4eb5bab03b369801f
SHA1 a42daf87cf7d10f0be2dca1e4df9d74c4b817164
SHA512 198c9cad64d7acd51ee3d16e0b1f07237455d3635e5d54d188547a18a57b606a0ce3bc62395dc102aeef5b5fc7b05029acada006d3d853e835378d4e9e86a8ef
SSDEEP 24576:tPUr+NQG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJQGLNiXicJFFRGNzj3
TLSH
T1BC65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7ffcc6bfd936634d029e65c4dd52c0bc2f227e1333014edfe01c15b99597f790
MD5 8032e547c874a22338dc4a254bc153d5
SHA1 238e86f9cdb3d4deef9162a6d4488e0ed04e939e
SHA512 a5e552a7a0fd02e1346bc121933a502e1d7505aebd660bfae959aa083e6da80d8429d0103df0fbdb0c6c27713ad32e96e90b95b33db7e618ec67d7e62e4a11dd
SSDEEP 24576:7D3FHshBIYQgAr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7DVHeBIAArLNiXicJFFRGNzj3
TLSH
T1A075E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/832-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1028-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1028-78-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1028-297-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1028-83-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1544-317-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1544-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1544-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1544-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1544-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1544-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1652-0-0x0000000000400000-0x00000000009A8000-memory.dmp

Download

memory/1652-6-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/1652-1-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/1652-7-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/1652-76-0x0000000000400000-0x00000000009A8000-memory.dmp

Download

memory/1704-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1704-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1704-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1704-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1704-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2268-309-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2268-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2268-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2268-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3096-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3096-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-20-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3096-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3544-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3544-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3544-277-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3544-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4208-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4208-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4208-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4208-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4260-121-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4260-115-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4260-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4260-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4844-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4844-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4844-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4844-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4844-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6004-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6004-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6004-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6004-292-0x0000000140000000-0x0000000140222000-memory.dmp

Download