76abe1e37fe7a09f4dc9d3e78aa702d43fca1271b8b69a55e879f06174d68d19

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Size 3.1MB
Sample260803-sawsdsbc26
SHA256 76abe1e37fe7a09f4dc9d3e78aa702d43fca1271b8b69a55e879f06174d68d19
MD5 2db35a3b8cd6f68a4d1291b87490bb25
SHA1 313e420fb7328fe0508fc2906d5050ac341ec3c1
SHA512 ec8d8223ce880abc634863e2bbeade2e8122eef33e474886269595e030bddd7aff9c75514c081c1e6e04f4abdb6617543c9582168f7a7bcba3d9bcef5dbb2b0a
SSDEEP 49152:znH3qnGeO8p9g0RWYDA9NmQ3+XagftxJEzmh8ezDJFpkCHI8IaGrpeJ9Q/lFTjN4:upOYONmQ3ZktjEilD2Co8ULm
TLSH
T12FE5D013BB86D0B1E453063D42BA97BF8A3D9E201334D5D3A7903D299D366D2DA3D386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
408	elevation_service.exe
3764	elevation_service.exe
5380	maintenanceservice.exe
6100	OSE.EXE
1340	PerceptionSimulationService.exe
3528	perfhost.exe
1728	ReFsDedupSvc.exe
3364	SensorDataService.exe
2220	ssh-agent.exe
3568	AgentService.exe
2148	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\77a73f06e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099503f695823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092d7b5a85823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab1726695823dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b9503695823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068dfd2655823dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Token: SeAssignPrimaryTokenPrivilege	3568	AgentService.exe
Token: SeBackupPrivilege	1728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1728	ReFsDedupSvc.exe
Token: 33	2148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2148	SearchIndexer.exe
Token: SeDebugPrivilege	3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Token: SeDebugPrivilege	3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Token: SeDebugPrivilege	3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Token: SeDebugPrivilege	3552	2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
Token: SeDebugPrivilege	408	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2008	2148	SearchIndexer.exe	100
PID 2148 wrote to memory of 5592	2148	SearchIndexer.exe	101
PID 2148 wrote to memory of 5032	2148	SearchIndexer.exe	102
PID 2148 wrote to memory of 3580	2148	SearchIndexer.exe	103
PID 2148 wrote to memory of 5972	2148	SearchIndexer.exe	107
PID 2148 wrote to memory of 2752	2148	SearchIndexer.exe	108
PID 2148 wrote to memory of 5576	2148	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2db35a3b8cd6f68a4d1291b87490bb25_coinminer_darkgate_elex_glassworm_mafia_magniber_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 89baf2cf44d1633fc63da9039e67bf70dba46bab636baf4b4c4cf5beddd452ba
MD5 343f322cab45f92404786fc873db879e
SHA1 91d70a18d219a486ce3ed05e50decdb2d9838342
SHA512 25aae5308e184fa80e2dd8d586a5361bb3813155f658e09a24cc30c68ad9d7afa0389a5c72afb0e30f463f06f70d45d32454c108e815ae6d47d73a9c7726eb95
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVQ/lFTjN4:Q3q6HjBZLm
TLSH
T1C6D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 50da6f174b43d6c199eda6aac3e25677269a665236218c8b74a789bee32fc675
MD5 f7050a74a25688018f53885a1d1b5300
SHA1 326cf57b38c5bcdb370bd1a2a17d5c1d9a87c9e7
SHA512 b37e0ca28fc295467fe7420fedccd3614cf3018d455485783e79beeb4b3c35e74fd4b02a4b2d476aafd5d4211de95a72a51110de5773d9c17ded1160f3b270cd
SSDEEP 12288:u1XLsswWkxy2lRq2czAiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:cXYfDtczAinQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1AE65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6bc1379d085ef93e4079729d896bfe84921919de4ebcefda90450cb717067afc
MD5 9b507106dfb950aead76159a457ce5e7
SHA1 2e4a719b9965e3dae23442033a197449ab3cb6dd
SHA512 83bcc1e4f247c4ea63446ff988a1d355899d192fb0d25427ddf0f2be0dfd016ae32525c6d66652f4de974f45ff41fc8b4f6c58a775361bc9231cd20863d84a01
SSDEEP 24576:D0Le5ji0hmxLrMdnQ/tbw/2Mkjy6Fr7g0oY:DPji0AlQQ/lFTjN4
TLSH
T1F1859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 594e58410cf31803f9fcc2e6b91050e4d36b199b46d9ffc6dbc9f83d443d8073
MD5 2ad2a1c478926c1e72d18649144b3310
SHA1 8781e22db20e03fec707856f99a0e5420cded434
SHA512 0322e2d0d0c3833e4eae1682e3947a6c55c40f7ce94eb4989ba55130562f542d1cf06a1439cd472a7daed053404dad8f0a6b593e8b086aeb6f023014173e14b4
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyu/nQ/tbw/2Mkjy6Fr7g0oY:W/ezSC6vUzPvxHjyUQ/lFTjN4
TLSH
T18A755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1cf25a51eb5b22ae0a05f5e6c165b3db6668e6dc55e38712029e7c9ac2d87e77
MD5 f32521fa59c13b15dae456eea79e71e6
SHA1 676981aeb53f3efca415f7b02ed952eca70daebd
SHA512 6504d3dcfcde75302a6d558c2bdeb60a7bcda3f22b6ccc2465668fede523c1b99dc7fad9bdcf0d570a3780d96f5552b82babf8129c3dd3f70f7a0f3777ae38a5
SSDEEP 24576:2VbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0o/:2VO88hXl+xQ/lFTjN4
TLSH
T194559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 51124256d7a20186709e1bc44fcd8223b0fcf2ac65da647003ade2056550c2a4
MD5 d3f7089b697f5768ef92e8c6070171e4
SHA1 1aaa7a6dc839b0d3585d8e1dd83f5da921a01f4a
SHA512 d26742f7d28ed4b0c90b719d76cd10eb9b44855c9542f86870efc68e5dc472ab0862dfc0badd6f87243ab14b9796f644ebbff5e55e7b9047011c80db8701456a
SSDEEP 12288:Pz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:PzJnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T13E5523696A24F897FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a6ee7157d2429fa30c83b7be5a0de36109fd641b758b718c5a0656273f914fb0
MD5 0bfa96ac80f28b60927dab06e5f2d651
SHA1 2274c537af21dbadfcd95bc09588155daae78305
SHA512 c6a2d9524864dabacc22cb56a66b24af0c5773fa81f9fa9d027561fcfc9d9766b56d3a9c2c71d65d2df6bd5c7d4482dd845d4137cec8e4c95c3bc42c767459cd
SSDEEP 12288:SeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:SJIUWnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1B575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5b3e8191443b3414c770dceecdfb52ef78ca1da2c8491f27e8bede39163ae1d9
MD5 abb0b25593fc47709faf51a8bef7b980
SHA1 515f72d56deca5c6b836c639371444103ffcc966
SHA512 a344f9ff49bf51887ebe44885eafe2f29acabaa283c57317e93c46cd453fbe704b7d3c850948225fcbda7da3efdafe329f7e12c5624e27b9063924e4dc9e84b7
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:9QvGAdlCEL8c/yRNw5CkLm
TLSH
T1F5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 315838395e25f4c9639a6c6b9fc07cc3ce0a04a306d2f70f99727d27b3384d2a
MD5 e22f7e7356be2bd7a043cd0d4872aaa1
SHA1 eb1d741218740e8dc9f572723b9d9cf4c593b752
SHA512 f82ffd51a7c5e0ece021c1eee5f1322482597bba3b9475fc0aa50ebc57fbb79a869d1a046c9e49ad63bab81d07bfc158fab40c7fc8cb13478888c8a272e7bd6d
SSDEEP 12288:OAwSfxL/2Dc39DLLmt0LDQewsAjgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:zQewsAjAnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T17E75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e40340e6d36d1916e16ccc11cc4476f63d5889667cfe271c5561468061571b55
MD5 fa6a0316f9e03de7756e71a8ee7ac51f
SHA1 1607d2fab822be5ca2aa4400618314ed18638f69
SHA512 26f100f3605a2009f7bb49e68b78a3cd0449ae6d0b413cf2f16e5058f229811fce722a1768db21e3cceb0e48558aa4eb26dd27f08e076d1d9054b0c92692d6ea
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7L:WUEtQevvqc2W1cpV2EI32
TLSH
T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a1c54240030c6c7f8572fcf9d99fe59d68d2ab04e606f842eb4fdaf6eeaeb75d
MD5 ff4623fd823ecae308c04ad2450cf86f
SHA1 93371d19012a1d81c13271df467361d57994b23c
SHA512 3309dece45cce5a2313a7814aab3e9c5da03fcdb1cb78c25cf17c3e81adb26bf8eddef58f86d549489bd771925a3c78b3f6176c3cc771bbc120a43ddfc0b37ea
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zgQ/lFTjN4:PoqtVjnm4Lm
TLSH
T13CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3cbb5e84d7820e7c4dfd0dbbf9417faf3d9563a60c15f576cab2c7df57736ea6
MD5 88b7c3fd01711746b658c1369c033cc5
SHA1 32a38fa5d00871b0e148f27122226d1d15146acc
SHA512 7cda627658167cf1f41ba0fbf17d80e198f460c1cc297b3849232ea22566462062868168221412ca60171da6997b1564d2c13e327cb2c0f13aeda437108cf2c1
SSDEEP 24576:zAhGLJIFoiwtA5l7S53znQ/tbw/2Mkjy6Fr7g0oP:zAMyFoiq5DQ/lFTjN4
TLSH
T10835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 150d9a3e575a0d98cd1470521c56e3c78a3625c4b67519e52aa37ee507d9ad8d
MD5 57296c9735ab306986a5adad52c3c828
SHA1 b09c2296ba23f94e6d803ab31cfe7fece6357b56
SHA512 4e75ebb923c0355ea2934b5beea66ea098d52039b1b251575340ff3f48604c985838d37c33d7df47653bb1581f4c2bb6506904b5ebd98594a861cef2e8b36c28
SSDEEP 12288:pmw5HEjsChN2BFgl0WDm+C/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMs:kwuHOW0nQ/tbw/2Mkjy6Fr7g0od
TLSH
T10E65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 58c517f1c93064cbd26d143a7739686ff7d36e97aea6b1e0614bcbb4c0c78a60
MD5 f1de0fd5fde82579180b6df4a86d519a
SHA1 cf8a4f19249c01103d2475c12d0225a96c772452
SHA512 757306c9bda5fdb616201cab13964ed605e836b564244cef4ab0af7c188a4ae9eeb25e8365d37a3ba54546bbb4afd091bc1a68f6e68e4fab376db3d77b4426ac
SSDEEP 12288:TXZ1IyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:rZuFnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T11055126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9901c83d0b533727d48a66c41866b89ce6ae33fe0208a4c8ae362cd3490a4248
MD5 6f527268df54e925ef3a8dbe8f530610
SHA1 3c318111b2744460489f4072eca7c451adc7f942
SHA512 c8f8eb22bd71158c664d3eb1eb34d552545f6af7cda2052c59b3feab2b754002cc0e8d0a3590613b0bd24cdbc28c810f778e26aef8c5b1f50cf16fd364ed863d
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:4QRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fa2ce29d4372152c274112f454f214f44e7b5affae5c8b807d733a46a25c650b
MD5 d052bfd2e418004ee5754b36199d59cd
SHA1 c650061958bbb3ba045251daa972cbc1bb45c207
SHA512 490178bb735dd536664df3f79f944aa07ebcaefb369b93108c3314c886af0c3ae2415e69583826b34c9f5bbf51163804162ad3287697c5c94028762b2d611f3a
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:TQRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T1C0666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b6ed275e7c82d00d0c252a41bb7c039f86b79a0b38f14ffb96f98892437ca8f9
MD5 4f16c259c20a930ea08cf9355902893c
SHA1 f816f2d42d8efc8699342078ba8908badfb4f1a7
SHA512 3af4469af4c86727a38381ca71fa8fe45c343a3280f5d97e483141aa23e96c52dd3f46c7daccdc9e50b6bc67bfed1eea7b05e0e6d2128f41157da6bdfad04cb7
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VnQ/tbw/2Mkjy6v:s68Qg55nhheWu7PNU3/QQ/lFTjN4
TLSH
T104B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b296751c8c8e7c0b3bb2538b1ab0c0ce6ff3db600fc793e4fdb9db78c39d3332
MD5 2cbcbb23da003bfaa9aaa4724b48bfd1
SHA1 c10c9c32457093bf561da038ef7365fe110920c1
SHA512 d973b92ee97802947f4b18c99d7a342f0abaeac21d975991c9945c66f44e1e7e12405b978963d375cb27d5bb1feb4d6cb398bfc45d0332faaa2be350caff3427
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Xy5112gYy5azzVvL69nLKnhZ+Lm
TLSH
T106167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b658d90261ffd8e8ff4002f6054aa082b8e419df281997d4b530ea1b5f5ddd8b
MD5 b0b0750bbb6ab042b43aac579c6eb136
SHA1 f2178db72def9fa43872cafe5036c559220bd3da
SHA512 910ecd9f293cb3077241a15983a39169ea1a39c1baa23580e2d2a7d28b979dc65355edf42dfd65fa708fa6e985f4cb58883a38f38a50ed13b4fc59abdaefaf10
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyQ/lFTjN4:tu6JmVxd2d9Lm
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8fffae78e67ca8825fff3bb9a261b67126f522d7cf0a4748d9be62a2fc79e15a
MD5 f5e1577813514d104bb2fe35e0c39118
SHA1 29fd8fcdc1fe53db04055260609f4c5bda0f804a
SHA512 c534d616e9ff4753ab02799832f282409e771da09e687c4085f7aa84678ca7c8e43a1fb3cac6226ba336f501eb395bc048e8666a804318d8179fcb5e22c45cb3
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:EmifPbR4Lm
TLSH
T1C3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7714f372ca91e9dada3d1b38cc0919fbfb7615cfa0e7beb87e632a05693022d
MD5 61054136e8dd1337af97e8ceefa6adb3
SHA1 1d4c6781238aa56fb1660981adf173622c91fbb7
SHA512 caa977f972adb878bf7ca23722493397ec0ead91849ba39733329a35e4489440d7fba6e9c353ca3b01b208a379c20003ea86cbe457a220cd797898f3a74def3a
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqFQ/lFTjN4:g5dKTi61qLm
TLSH
T14DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3ca66ff539b52caebe95de0095fd38b461e9de8254dbea987be56ef25a762eb
MD5 31cc3c9708c1a76abde54c8e8d46a42d
SHA1 93896b4922dcb7ca9a6633dd3ac3fa79b2d738e1
SHA512 b38b3126b07bbb45be5e0504bacef16caebbe37c7ae133631f1942a9453b88ff54d01f12874ea4c144e0387161ebaf254e36ec01d8b145231752a3ed5aa67917
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wiQ/lFTjN4:MX2iyphsLm
TLSH
T13395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3cae7e576bd70fe7c834084721bf865271812c3a27b16d3235da1ea4c20c6719
MD5 5a5acf186890b1414be4f6c59203ac37
SHA1 1a40ce4a7890a4f7b601820c3263429cba4895fb
SHA512 9c8754777fdee9876c2e5de6f246eb99dd7efa905d5b74d95b013a30e5412adc4b6de030ba4dc357fda534357591b9b4ac70e2ac4480e1edf7bae06e721ce6af
SSDEEP 12288:4hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:4xnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1965523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4be3293688b828676c2eb5181044dfc005b908febd3eb211f94c323ae150bcf8
MD5 81dc4f0c0474d23cb0d661bd24c0adc5
SHA1 4e1c151350bfb2aac35579d44ef83c52bfa387cc
SHA512 2def99421ce68c3cf21cf56dcd79bab78da6346755d65548572306eb8e38519b2eb6329b91c9b2334a9679c345862ecc52ab41b736fc70a7c31ac622a5fa430f
SSDEEP 12288:5sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:5snQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1095523697965F98BFA1706F14C828182AB3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 193852b7a2a754cc8f50ea66d18f648faecbe4a2ccbc1cd365c6de409094d7be
MD5 84b3bf0348cbe84e1543268506bf1b26
SHA1 f41ef8ba6e2e3f50f83ea1c092850d9fedea320f
SHA512 b530ccfd3df3ff9ede9c14d5a7d472fc1484b3b5ee8d6760b4a4e703c6f645420deadb345a18b6382d7e7a5029e832680bb3b2018327eb3c67b02928afed9254
SSDEEP 12288:I+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:I+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1175523697925F98BFA1706F14C838182AB7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e5a60e90ba57c8e7ea6dde06c66de5c941f7f8e15283ca7058c9df2cf42bff29
MD5 4140ed372f2bbc731f8c2e78aa0a3657
SHA1 51055789a4169849f0b3061abd3b1a60f3d96ced
SHA512 fa3a1288fe88142ed5eced5f13f6c8020d415e1f9b9d3afc53c8235898a76676dcf898613797b60e125fc3c1c538aa786da4d9980add94c3bdaa346672b13ea7
SSDEEP 12288:wVjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:WnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1465523693B69F4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7d091dee10bc874dfba3a34528b4814f65be8c016115da0c97bac627df0adbc5
MD5 954eccd87e5ffb98a5b7a7161f7125d5
SHA1 aec809ac39254e718c6ad4f8537d655ef2a3d08f
SHA512 c8a5c15f0fab794e40b8722e6eccefb10b2879815ca17b25585a7efc91c95e9284f458651a40f0fc9996a6df4264fd4b79f5664178006194eaf32fbd3ef906fc
SSDEEP 12288:v7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:vrnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1625523697925F98BFA1706F14C828182AB3F0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c855944694d776997e20370bfd003b687d0fba17364e1f389f81310aca2bb379
MD5 732d8d527cd30f28b0c33c5ec8d1918e
SHA1 b8d8ea1f9bb4b41d53d285baeda31507ff48f1db
SHA512 854519525c09e2f61247a648c449b1747ee5aa6c6e78bb4d2ec37ad1bcdee38f58b3938c8d554b49b6bf3f92a17ab8b28c3986285a36fa3dcd03e0548cf61b2e
SSDEEP 12288:4IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:4InQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1265523697965F98BFB1706F14C828182A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 226cd55467fa4135de063fbe34c447e2240e4ddd2ab7983ccf4d875cd2f2e889
MD5 3eb91433b06aab7a35c778efd6ed23a7
SHA1 600ce95b031d53c3f111f196e718a0a05424c3c4
SHA512 699253c48d910db71a873e8afe61547f7da86173163d6f3b31d8e9bee03d044b2dc70cb85ab03d6f722952bd240fbf230e644663464ba53e280f1633eabbdc35
SSDEEP 12288:5kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:5EnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19E5523697965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6dc640414e9581a4982380a8b484d2b7dec430c25ebea65a1ecc3b0f5696901a
MD5 81196cc3c99249ba94c6edced8aab802
SHA1 bd0ab47045f18b9afd56efc2afdf6e93b9d7aaf2
SHA512 7ae91ef46c54be2920808f67d38e30dddbd64ae2c758156956cbdf53eba4d2e93e835ae87db7a11d4875b67c90969a3c0033ddf117f6dd5d36d11c528857bcc1
SSDEEP 12288:XiZwbDzzFEoS2cPvyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:SZM3zFVSOMnQ/tbw/2Mkjy6Fr7g0od
TLSH
T18C7501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 149e332c64a935a7e5fc37ab37a051599afe22039e9e21ba88ee51b2a4395a0e
MD5 d7216978dc31799b764b69f45a5f5582
SHA1 a9c39c1f6f7f29f845a473baa11f9aaf9af24192
SHA512 23a225df0580e45a2b9e46b0d7c3709376043b953ccfe8f651aec343651822d4ea18bf0b664c9b8c777bb5c9cc7477f189b85977df877fc28da7c6592c2cec01
SSDEEP 12288:4VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:41nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1CD5523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 95152031a5022ff4fe38c5c3a16cdf170797cad81a850f26e43600157763fdf1
MD5 812ad3129a35a8174e81e9ef39021391
SHA1 fa172f826780e4304bcdfaa079dda397611f356b
SHA512 d9693a1fc2991502d37d77b716aa6e31335208ced87d89e28fc7142cdf81a9e81127e89880a3cd9b858c507d8413567a94cbbf7537fbf221a0a28ec0bbe0f3d9
SSDEEP 12288:5pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:55nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17E5523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d25d94f9acad3c9c855017545a25c8e20c37f46437edef5c99c0c8b1b761240a
MD5 b45f400cd379921feca2e3f7f5b20df1
SHA1 9b0535e93925dfe411de807a858a6366518e5e20
SHA512 afea9bfb631e71dcb0f2d9c1c8e42ec0c268e22159af9cdfe0c93d6d6cd62e31860563d6a6759ab20779885161ee7421e1a0611e3c35ca9fc993dc30adcac7db
SSDEEP 12288:qyPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:3zywnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19B65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6f20fdb6dc0e0fd4d135a6bca309f1857948c284ff8b0dcbba841534ae9c0124
MD5 5e2d1601272d19dce8cb9cf2da8385b8
SHA1 a0b6a0f3f1d3b3e097e0c3bd132de2a59cd55799
SHA512 0973141574d6f696230d138239a457782330f5ef6c47b54fe154fcf5bf1091ca84b9df580a89fd67846613dc9d20c37feb8fb49e2e9464e4ce681f4a35300e7b
SSDEEP 12288:lVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:l1nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1555523697965F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a7be53eb29ba00bd0456d11a8ff9d9a33229eb22cb88eecfb4614e9012c8ae77
MD5 07f93655ed290ee5c5142d42d007e352
SHA1 55edf0b9849ec951ae84fd5927f0a6456f263007
SHA512 505cfe13c7a00b5e726ce7cf7428ebb43373b299265f274a150fdb090fbf750c9d48aff4ef7d561e7af435644ac80c47e2b24c83bb6657446b83e51dcb2d3c13
SSDEEP 12288:eVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:e1nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1DE5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d6683ccac0fb70533ad3b9de9cfcaed2e6d39378a4874e4ca5888d8dfff89223
MD5 c0fd07491e2d633155be2e85fb37c74e
SHA1 d6c2878a102d321cf9ae2d6fdbc00bee4fb955ce
SHA512 803a08c00ab33ae9e98f99c02135d7301dbfc2f4e812ebf43ca11d7ef360cc80e695cb5a68fdb0e1a9f39c562beea01f0f8658b124afd6c569ebe529e9ffc19d
SSDEEP 12288:QyPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:hzywnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T15165021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7a3bb26e133d4b6a445da9b2859f8be962db304e69c20ab21b434f7e93935f78
MD5 97f5c35acb9db71cabc7c6840f5516b5
SHA1 bba3e3795c467df50f1c3f64a38416c09591be26
SHA512 49e763658b3eba5c419e72a34ce24945f8de3d5d906730083642abc25c9f62cbc6cee4809c08fcb6bb4293a13760b2413f304c7d49b249fcec8c8472f1b2ef6d
SSDEEP 24576:MT0aLl3z0zDOnQ/tbw/2Mkjy6Fr7g0of:MTDLlj/Q/lFTjN4
TLSH
T11C7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d12319301c12fa309157722c90b2cf4b652dce2e02e058a1d78d40154153feb6
MD5 964318e4857d22df3b152177664e4d01
SHA1 31196c0b39bb20fb6ef466f91ca059688d8b3099
SHA512 76267a6d1f8daa356267464ac84c626e7ec05409e115928c16ee677699a37f94a9edae9938463220918bba027eadf88ee1d16948e57ab6c8a1befa57ee4eca5f
SSDEEP 24576:M31d9CHKy7GZqnQ/tbw/2Mkjy6Fr7g0oK:21d9CHKya4Q/lFTjN4
TLSH
T1BF85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9aeb465dcf61381bb5552e339cf9c0c4210b505a2f865b1dc6caf9d9484c5df0
MD5 6b7e35e75ca07a75aba66e247915e21f
SHA1 974aa529b8db13c939d5161cf20bca7fca7ebf0c
SHA512 ce852c80bfdb5889ccacf90c6b0fe91f018284f7a614b1a30d19db848ad3132d2bc633a63429219f7f531e51e60caadb195293437e2cb8bef0c18528e3494c89
SSDEEP 12288:FeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:FenQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1C45523697925F98BFA1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 539699ebaa8997a1298572811b3faffa6ee98c193bc2abb76a9e1569473b143b
MD5 ebecf45c32a9db3a2174081326cfb97d
SHA1 229d513107d7433c3942d4ed88fc40a059bfe212
SHA512 15cc5b4020501e92b7182d0dfc57c35be2a4e2740e08621a72a8c70a7536eeec0cd2dca9a70942ba8fd45dbd0129b36bf3f3c841b0d4041cf1e40584268dacc5
SSDEEP 12288:PwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:PQnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1845523787964F99BFA2B06F14C828182A77F0EC6BFD1938F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c6ef60e2f3c92529722c336fe4d365af593855e491ea15a03e6e1983938e07ef
MD5 92dee005cd2907f3efb1c1574a0458fa
SHA1 d0b6872383eab58832be8b9dfd679bd1b22502b9
SHA512 270904bb46fd4295f9909b9d57679879e21d00d3a3ef5017fb194414b8ae5a26003699ec55c2943c5e0c6bba8e37bdc53516c0d02d63ea0d63d5da3f26a554a4
SSDEEP 12288:EXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:E3nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T11C5523697924F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e1a9b004bf121a015017dd82c95aa897b0e44903a99ba29e0050f0a47181548a
MD5 ee896490f92e3aef2548ad1b04db0034
SHA1 0a62b03a71ab022a0a657ee5c47f023e6f661d5a
SHA512 6e74ad3888f53257ccfd4f5df7f5ec730177395d40a25ea304389e1cf3cf08f28ccd567cb0564dfb342f54c759cf3cf94cd68f9fd7fa4f32c436d9e381cb29b7
SSDEEP 12288:XVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:X1nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1825523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 48028aa15ba320ee536fa135b9b7d854b2bf455e038b3b4dec01580d4257fcf4
MD5 5c986e04bcaae7f887fd82174f8fd92a
SHA1 b762bd1dcece8f40b1353be6ea5c8d6127d85691
SHA512 cc8f24c3b723e6925aa4b44c642241bba2be858892ce1bc631c4cd463ad6b11f13609ae82448bf76d0d99d2b6c081b2c28ac5f5b1c01af1bcf400f8fc4b78fb2
SSDEEP 12288:xeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:xenQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1175523697925F98BFA1706F14C828182AB7F0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a9d89c544086cef1142f167a2d34fcff385262493d4f57c4db04ff8aeed9db3e
MD5 917a016a5ce8b0e51a4448cf6c6cc6e7
SHA1 6ae34b651eba809a2138dd4b75fca70c640d9499
SHA512 aa70cce0adfd7668f15c087af0cbd95f008eaa53836f86975334e18b24fa14e79d19923844d834440a2451cc9fb7d5705298ae6500ba3dd9c83bb32dfe7ddf77
SSDEEP 12288:cNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:ctnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1515523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e9af96f8cdf109946687910dc7500bcb98bbafaf8d7b5cd442d4c2e4dd23303e
MD5 fe8779f1ab7aa3159eb9720c8cca142b
SHA1 1a6a176321f05ed07b3d97d825239848e9f137af
SHA512 9ec4ed6d63c240a20864d23c4cff4f0b9f41f05d3313299c5f0a11e81d356881b3ea1d7857a2982766ed83f7be352121b28a8deb5becf73c28bcd34c22bf7fcd
SSDEEP 12288:g7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:grnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1C55523697925F98BFA1706F14C828182AB7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 41bd21c1e833f93f4b0829556071cbfbee14403a4776635bac6c18ac0a2019c6
MD5 1ea132db4ba22ebb98c3b938b26d61ff
SHA1 aa7f2228c1cd89b03144c1fe41ab67eb78b27e78
SHA512 b2587a95b2b0568a69cebfda87c30a194ee050ac0e9274daf833f4c7a0f9a53a2d6fa25b3dd4664cc7baed4f9a159b6535b731538678a18965b615a3f09b15b0
SSDEEP 24576:lfwv/k9RX6wkyAIpnQ/tbw/2Mkjy6Fr7g0o3:UMnYIpQ/lFTjN4
TLSH
T13285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cce97927e8581fdc07e37e248e4234257313c35fc32c78c36bc17038cdd06077
MD5 8f5275fe47c8161d5903c2cfb79dd4e9
SHA1 cca442afd1cc03fe95702e84ed364f6b60dea0c5
SHA512 809673e9ab59994e428e9b89a3ea86de1282ef577ad5c433e4a97a670ea8606bd117fbc8488a1d2178d09c6d95b0ef8d93996bc09742b052b03af5e5372ddd0b
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CQ/lFTjN4:dySzPlLm
TLSH
T1F8066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8128b7b2e189e6989c5c523e4400b908a2b9db19660441a564f17621772c4e34
MD5 dcb8fb1a4f434ef32beb8054cd0ccc82
SHA1 85c7b8254fb0baef442d057061ef3ed3f45d9113
SHA512 ba93b2855b39542e5f1bbe2081d44a452d2462c9ffb6d702d60765ef4565ffa3b06cd2cc685b88c52fe6efbdbd44395cfdf51ac7e72b245ebb9857b7a3d25bf1
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8nQ/tbw/2Mkjy6Fr7g0o+:R47JUQj1irIhCnDHUPfF/yQ/lFTjN4
TLSH
T11165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 05f800fba5b6a3d9f8f1bb51a0a1c51d71e4ae1e7473efdc87082bd9071b92df
MD5 a054d8f0c1f783f67e8fc865fd87e661
SHA1 4758893e9c9907aff00d0fabd81eb49af6951487
SHA512 9df06ec892818acbc90ad2a360bae8be1a2e9257e76cd2fa5c16c353974c534baf898f28663b77699565dcacc1d84f2b526ff12077c5ee98cc3ed107ba0b09ae
SSDEEP 12288:LssflGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:HFnQ/tbw/2Mkjy6Fr7g0or
TLSH
T15265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 165abd7352517ee254ba578acb13af3d56b28a82bea3d507be098a59cae2c54a
MD5 84fcddef5d7ff7585add3678a76f4e1a
SHA1 bfea689ec5371201892139a1aca652b1aa63734d
SHA512 d0b32495d354c7a0872b04b31394087143fb82a82ae92698da5ef0615200d55a18541fd03e1e83089bfffb7f2c00e70ec7b05fb94c95ba993c967862f8e0c744
SSDEEP 12288:x67dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:Y9nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1055523656668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 37cf852324a72017943519fff8ffd248bd9b18298a41c0d0ef329a2c0eab6cbd
MD5 5463a2e3b1f6d1c7664e8406e925553e
SHA1 7c31f3f87c0c217c64fb55fcf7cb966cfede721e
SHA512 e52a529e4b5d89b3f8c1c50e2bb152f99db7566bdcd2f6bacbab0c9942b85f7d284c378bce1c68ffb842a5d4988a3043620a272e9ee81ca262b4cac113be5aec
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bY/nQ/tbw/2Mkjy6Fr7g0o/:Tgb4mBIBhGF8Q/lFTjN4
TLSH
T12E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2c694cd2d2edc51267cb8c817008bd53549b930867742949866c075f3decde36
MD5 4629faacb7e0fde6c9caecf5d4421d91
SHA1 56a6bc69348b712891fd7a1c0602d4e3ae764804
SHA512 68ba7181fb92dc3a112a3019b028c3a06c38f978904190201f162668b0cbca5b75f905b797aa16198216bbf7b34d16456f7073f00993587efb18cfbef6d8701c
SSDEEP 24576:LG88u8FpJqH1Qzria7/mMnQ/tbw/2Mkjy6Fr7g0op:K7ZFPqVva7/XQ/lFTjN4
TLSH
T1B685F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1fc845a1dbc393f88cf5b762a368a6a8cc94f84b4b72fe5cbe27c37920b636ba
MD5 dd3d7ddf7f8b17446b5a2a045123d618
SHA1 0df568f7b2e925afd81a28ad425afc2f0d729334
SHA512 fe6ab810cc1db456c53076d97c3e48a976f4d5e6874d98f358571831142408b2c725e98cccb116087292039f08f75526e3487caa0ce14493d1f3b8e8ac5d06d4
SSDEEP 12288:hHvUrBFrEjwaQ4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:hPUr+NQ4nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1A765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fb26b8be02a23a3cb9e195dbd402d4fe779122b83887c8738caceb95d5927e68
MD5 6bbc7c6d7aa21c5355304af9347c8105
SHA1 d8fbc95e5384bdbee3e6e15622cb0a2590405f69
SHA512 e72edbd79a1379efa45117e08c4fe03a99c7e7ecd05f0bacfe133ac1257c3b67cddf1b56738b7d01b6edb82609788b16bcc82940624536d96d75ba4c2c3b96d3
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIQ/lFTjN4:YG05lO43bGLm
TLSH
T127D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f9b8287155093e744c7120d41bdedb39ec9002b2c265f2fea3947032d39a8f3c
MD5 102aaf9badd7fc3657709db68410d630
SHA1 b6d2c4306db6b5a923dbec9216eb9f01361eef0d
SHA512 038ccf6eb43266805b2d0327e9ed44c791db3b7aa7cae3e777ffdf58d877ff95f20300534beb502b9781914e8d99c16ec10ebfea60ee19ebfa1d4ff866778d35
SSDEEP 24576:wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnCnQ/tbw/2Mkjy6Fr7g0oE:Ia5POZ3+Jt2pasx2+mQQ/lFTjN4
TLSH
T1D665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e982813dc8460e4d68402144b5dc38411362e99ea9af18ea1399a9204e36cd59
MD5 c3334e9b33a329f881cb2ad430a2846b
SHA1 f55aed7b62e8ea1f320e81a4a7b50b37d6cf68f2
SHA512 d7b77df45d99f0fbca15b06a026b6b2e8b41f3437964574278563cd58f94d6a1a53cd3514eb41e0b9a7cf762b82f9c1441125726035291ebbff3c78f1f902617
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0oJ:KNc/zEOVHF3Q/lFTjN4
TLSH
T111858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1468b7d80fe9bd7d0f8ed6e118d69ea5880fb367b51e528de2d32f419eb4f78f
MD5 b441ac9c78ac44f6151a05e530b967a5
SHA1 ef58bc4edf0b5fd1bb20f46b6966944833835dce
SHA512 a71a149357af344f0a747d7b3b0e801e22dd86d3e728549ea5ae3869a3517ce7509c297397389c477279ecb1622ccf666c6080e2d8d2d00d0601b4bd0a05c596
SSDEEP 24576:N8kNvNnaFeYhJNtmZBmGnQ/tbw/2Mkjy6Fr7g0oY:N8MwBtOmGQ/lFTjN4
TLSH
T1E855AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 999d293380a6d64cb3bca4bbb647e6b62a77b642d2d05df3289af06b18fa70ff
MD5 04b9bc93c26391ce5b9931e51bc2f7fb
SHA1 b6f56d48b44ac0244c47363d0db7384a8d3331e2
SHA512 43ccf9f32ed696059af958f39d379a06d6d828a6877f7492eba55b3b842269940f6a6a48a611e39abe1a6e3e7a01aa760237cc7d9292c83d47e865eef4eb2db1
SSDEEP 24576:ID3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0oC:IDVHeBIAARQ/lFTjN4
TLSH
T1F175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/408-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/408-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/408-13-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1340-77-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1340-300-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1340-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1340-71-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1728-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1728-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1728-340-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1728-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1728-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1728-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2148-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2148-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2148-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2148-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2220-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2220-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2220-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2220-320-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3364-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3364-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3364-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3364-112-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3364-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3364-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3528-82-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3528-87-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3528-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3528-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3552-91-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/3552-0-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/3552-8-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3552-1-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3552-6-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3568-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3568-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3568-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-142-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3580-407-0x000001FE70030000-0x000001FE706B0000-memory.dmp

Download

memory/3580-338-0x000001FE70030000-0x000001FE706B0000-memory.dmp

Download

memory/3764-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3764-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3764-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3764-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3764-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5380-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5380-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5380-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5380-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5380-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6100-59-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6100-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6100-65-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6100-284-0x0000000140000000-0x000000014017A000-memory.dmp

Download