5825b7cca12411bf2ba7dd9f23b1ab70ba0f994089da749eea4f24b5adc507d0

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 5.8MB
Sample260809-qk8tlaae73
SHA256 5825b7cca12411bf2ba7dd9f23b1ab70ba0f994089da749eea4f24b5adc507d0
MD5 fefb45d325d42517f9303a2009b17cfe
SHA1 4dce2c60ef040c9575b0dacbb96734ca1ccde810
SHA512 228118a467338452680d58c470a3a1ec3539f51f0cbd06511432da43f257a393847526124224e8668129244d2a8f1de8765814fe0a7a02746db20a6bccd4114f
SSDEEP 98304:1enyzZLvyUP6ZVYsPHpIPIIwy5AG8H4TWr9XKitMQi5SSDntdDpbRZy:1enyzZL6UykYpIQIZBBUYfSintdDFRo
TLSH
T18D568E227603C532D9920170967DAFBB985C9D304B1A99D3F3C07F5EACB11C25A36F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
560	elevation_service.exe
3400	elevation_service.exe
5184	maintenanceservice.exe
4556	OSE.EXE
4600	PerceptionSimulationService.exe
1240	perfhost.exe
4724	ReFsDedupSvc.exe
5880	SensorDataService.exe
2676	ssh-agent.exe
3868	AgentService.exe
6056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\400e0290e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008fc5fe40128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9581de40128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009490fae30128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce4976e40128dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d75b84e40128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008379fe240228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
560	elevation_service.exe
560	elevation_service.exe
560	elevation_service.exe
560	elevation_service.exe
560	elevation_service.exe
560	elevation_service.exe
560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeIncreaseQuotaPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSecurityPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeTakeOwnershipPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeLoadDriverPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemProfilePrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemtimePrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeProfSingleProcessPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeIncBasePriorityPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeCreatePagefilePrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeBackupPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeRestorePrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeShutdownPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemEnvironmentPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeRemoteShutdownPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeUndockPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeManageVolumePrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 33	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 34	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 35	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 36	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3868	AgentService.exe
Token: 33	6056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeDebugPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4676	2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 2416	6056	SearchIndexer.exe	101
PID 6056 wrote to memory of 1092	6056	SearchIndexer.exe	103
PID 6056 wrote to memory of 4888	6056	SearchIndexer.exe	104
PID 6056 wrote to memory of 4364	6056	SearchIndexer.exe	105
PID 6056 wrote to memory of 5432	6056	SearchIndexer.exe	107
PID 6056 wrote to memory of 4384	6056	SearchIndexer.exe	108
PID 6056 wrote to memory of 5584	6056	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_fefb45d325d42517f9303a2009b17cfe_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5714dca2fa749338d1bcfc16331be49b074a850194ab2e323fae312a6d2db4ab
MD5 48ec094bffb0e57b5049175b71797aaf
SHA1 2a5132f6c392dc3f524f022d4df4789c2a43bfae
SHA512 7ebe66f8aaa6588d47a24a94d4bfbfd2926c0d3d03ac199b055ac54ed71bd8e0be8d351b013de2c61fd75ecf61b6402f0ba64fdf4f12098465892ef2e18b4cf3
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnx5SW6H8DS52tdDpbRZy:s3q6HjBo5SSDntdDpbRZy
TLSH
T1CBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1fd311806c043a8630b12e6acf789837546329cce353113a5c5f6622ce83ae1a
MD5 8948d18c9ffcd9161b818d0187d546fd
SHA1 9d8864a3c87a98ffcd41ffdebdaf19e3c76ed973
SHA512 f7846a8d75edda8a7963feb7b1a2e29be5127d4d19f6ccc9e3bbb150845f1f017f731d9add04d96c6ace9be4be02346b4b40da7cad04045536460154707423db
SSDEEP 24576:IXYfDtczAM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ftcX5SW6H8DS52tdDpbRZy
TLSH
T1B305022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5289c58cd82fd5d74cbfe1594e2ee5840a7a6e94a0f06cf605c7609c8326fa0a
MD5 09e8bccfc0a57c184caac0141b2bafb1
SHA1 54ada50ab7dc2e04ebd6eb69d419fa66f83c4978
SHA512 a390dce849a2d900220e03fcab6e9975fca0c87c116e56e3c9552dbb8cbd3af6267cbe22b6db73cbe50c4b2cca8e2401e49b7a177718fdb355b0552195427919
SSDEEP 24576:10Le5ji0hmxirMZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:1Pji0AcG5SW6H8DS52tdDpbRZy
TLSH
T168359E55F6748332D073C0B9C5D2A69EED7130865B308ACB4286D77C6F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8cfa18e9c2cef0b3258c5cd507f2f29d54b16ef00a6d1283710015028babf389
MD5 6500e332627adf25c9f492f9747ed041
SHA1 fd2cb8c7107cf2ca75e7ac06a89bc02130122924
SHA512 e7fd2bee0a13159abd5f0a7c9a32beeca81d4a2d01ce6c20067e0a3a99b5405c55217de274177b346a54e20bcb01fa678f292ab5c70d96fac5d07fc34e1b82e5
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:B/ezSC6vUzPvxHjyq5SW6H8DS52tdDpO
TLSH
T1C5755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a17dce1c17bbe5ed3162ed80f8032f096f81a20972950acfdb867a586f64a243
MD5 9719c54730619e13adc666463309a39b
SHA1 77e97db7a721e1f5f8861f5c01f46974afa94c91
SHA512 ec53d37535a6e0ca2e01bc32f87c0e1386e039aeaddb5d46559d93df6f9fbade3f9ffdaad35bbd3f054693b650700c92fe92fea7f214d487ed1a49aa72068d80
SSDEEP 24576:fVbqPb88hv/l+6Y5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:fVO88hXl+t5SW6H8DS52tdDpbRZy
TLSH
T10B559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ea77375355d64b2e0ce88434ec21282a01c20917177c50e21f2c2f0bb9c362fe
MD5 52057c26b1a15425223b88120e5567af
SHA1 4aeb8926562e6d882a4a8fbcdd395fb340335af1
SHA512 e2dc8b0f8973d52ec09beacac64e5197181ead03fc5d86684b11bcb0737bc6740dc17ab364a1eac8c732da02b5a7a1519b0bab17a932b85a5009553c969d5a23
SSDEEP 12288:mRF5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6g:mRF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C8C423C4479020A7E31F0AF3F1FA96D4DA18EDED8408663B4E717687CA3998BC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f6518399aa4a1b94c88684383919d5a80c45e8ae2cb7d9dc3eabef9c444074cf
MD5 4ef2b7e9e060541c69b8d66cb495f2b6
SHA1 d0968a48c0ff5c3438075bd6af5768d74d4192e3
SHA512 fb9a2c27a4612ea40bb33c2e1367966db3244e7813fda4d9ca5a49ef919ff59599193310025c168f7f17541dd78dff5ce34770a807fb12a311d4500677793da4
SSDEEP 24576:bJIUg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:bJIUg5SW6H8DS52tdDpbRZy
TLSH
T16505DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a4a161041b9ff8a429e559361841ffcae2c7ae53ff24e7c6a803d9de52324a5f
MD5 3836f049e691ddfea893d6caaeb98a14
SHA1 583b3513326ad3bc809adbe7a812997ca8fec4a7
SHA512 926e553102c085b561d14fa4f7464e1cb7072b1bf4f1f6cc91576206c89e27fd77a30b49329c3c44106e126b957a64c8dd29672ddf98590cacab0936447416a4
SSDEEP 98304:IQvGAdlCEL8c/yRNw5C35SSDntdDpbRZy:tvyEYc/y3w8JSintdDFRo
TLSH
T1AA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c476fb803a7b02c0ebd5875f42cff1c0fe3303b09eaf0d83291ebd27bbd8e534
MD5 d56f70a2769297b03cf272d512d78e69
SHA1 713ce68c1081bf0a0969657c6b5cce4c998eafa4
SHA512 376a83e2ca72c993b716d2c8dc1bb148c67f6253d4fc4745e4f77ae357601516a342f157ce70f1c3d73bf66e31af2a41ac42f60ad68af58fc18d4b9af0d63540
SSDEEP 24576:JdewsAj25SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Xlj25SW6H8DS52tdDpbRZy
TLSH
T1B915E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 daa9763d1372d6ece92163fef883c3a13a611b320673d86f8e40fc75ea2bf7a3
MD5 f518cb86f7ed922bc72b06021f059bdb
SHA1 8871cf5ce7d1787ba84aec35e31a516e3504b9c3
SHA512 ad6e05a943adb394973302d30d9b59c1ef9b33b529025069f9b33bafcbe1844aab69fd1229dab6d4600d3dd16570c7f3614fc913b20992c00893af17d1849807
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkSintdDFRo:eUEtQevvqc2W1cpV2EI32xedDFRo
TLSH
T149474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0aa3fdac58385d4c99b3c9863c4a1e15593f3d43e35ec1289c813a3b1ec61e1a
MD5 48d08351596784cf73d90621efdf0722
SHA1 dc3f517158b9418c1c25c6f955b4bf3a8cc42cf7
SHA512 f9eb974a888f9bc3fc61af2ec1598c06b520a781906afb3df94faa500f3e95a046f3860da3358ab24c35c0795d64f4c4ed802a2d1481ee3cae590e2e3c73feb5
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zW5SW6H8DS52tdDpbRZy:voq2Vjnmr5SSDntdDpbRZy
TLSH
T1D6D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 22a20d16e8bbcc95799f7bce86ec3eaba610b2571333906936c1fd7d4f55a39b
MD5 9841a8850e883aa248caddc208e6542f
SHA1 b141c0eabdad5bf6731fd9963823a059123f64cc
SHA512 3566dc1844e030283ec68584b9ce98b6e3c694451f788921720028028dc165f838929471037e05096fd301ce4bc06c0acde5da8df0152a0319846844e07740f7
SSDEEP 24576:QAhGLJIFoiwtA5l7S53L5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:QAMyFoiq5b5SW6H8DS52tdDpbRZy
TLSH
T10E35AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e289ce43f12e465e5360e5da693bf999a6188dc3bd61e0e1e6c2b1e1bfa18cf8
MD5 3858e24c8c4bfa006ec9edc509aa6bd9
SHA1 09ad145f3c4e44fb5c980be6a9ab889e414f1ad7
SHA512 540aef6be64feb5a2df4f279449f3a28364b8641adf8e12c544f28830d2e5c33ae4bb0301d0ce5c1410c6c7ebcc39a0cb6af46be89b8333fc3fef6c816ff434d
SSDEEP 24576:XwuoOWK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:XwDOP5SW6H8DS52tdDpbRZy
TLSH
T19D05F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d0295fd151403eb63c62383c33fb7816204f81e79f73febf26ee2f823b158d02
MD5 7066fe3dbdf6ea0513a9f3eb8e036020
SHA1 b7ff94e56d3ae4963979b3af24beea4e85a0fe27
SHA512 e8428798a2d938bde98208c815e02c7583aa94dab971a447e806343506fe0882e17a47eb5c403745f2e1d750972be94ca1e20aaab747dbd4dc0b0220b857bad8
SSDEEP 12288:XBZ1Iym5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6l:xZuh5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1C9E4128923E430FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6192ddc7d43341810b6c5e96be110a43f043c6b505cdbd4f0fc6d31d11a0db8d
MD5 73303e8d7f331514613e725820fa4ebd
SHA1 2a07809866c237d8bb7692a515910495f82c924c
SHA512 7ad181af8bf18414071fbb4dda51e4bdbb7ac4ed1ca440392469a24b9df2820cb01596ea199e276fed04882895c12ac0d7b3b560383b2c08032ec6ea03b0f087
SSDEEP 98304:ZQRQyi36YOcPQLvw2gAf+PN3U5SSDntdDpbRZy:QQyiKayX+PNqSintdDFRo
TLSH
T16B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 01681b3d7f4e6e2026b9c2408a3d0be8bfc1b594a9389ff5b844e373d9c23c44
MD5 773a57baca3e15e4dc3ced51f152b249
SHA1 83321d40b96e8facc1857cdf936bfce109883956
SHA512 1e8492125e35dec504d3da4485df196d8452f4edeb241745d4d4646788d7f247313c9c32ebae30acdc8ce2c7dd631f2c314c9b67d5ccc113a78cf896e3c22a93
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3U5SSDntdDpbRZy:HQyiKayX+PNqSintdDFRo
TLSH
T173667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5f937d12d1028625fdfd6e7951ce50035dd25e98e9c763f30d68c19608ae604d
MD5 b528ab378cf86f5d02d1b2f448c5f6f4
SHA1 7d547db4cb2b5c75d0a10968f91fa93a9fe91a1e
SHA512 bc89503167907b9090123c8d3bf9ba5c7ccdd20c4fc4e73ff762a882f52b02a00fd6c9ea1c63fbfcf630cfabf4a538559a69584cd190d4248bf80c5874232df1
SSDEEP 49152:868Qg55nhheWu7PNU3/G5SW6H8DS52tdDpbRZy:2thWRc/G5SSDntdDpbRZy
TLSH
T1D9B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db2c233197c28dabc25a446380be9552cbe6674615eb873fb210ec13722a73fa
MD5 3ff7291c251f48b9663eb1534e0f494b
SHA1 34394a12847ea75add61b5c81b8b7d3ac65cbce1
SHA512 49818160003ee096c86942be2eb780e68c8b4d3e47bbb033e8c63711de5b126612b06be61a5f9211b0d0fe0f2208ca832ebcd972df60b3a5250a9a3e1bb75ed2
SSDEEP 98304:+y5112gYy5azzVvL69nLKnhZF5SSDntdDpbRZy:vLIHmWhVSintdDFRo
TLSH
T1D6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc33cb3a809d3eecee7b1bce4e49899f8ce658739e90188ba32eb99c4fc09573
MD5 d0497e4ab075b7c4c35c4795a3093606
SHA1 271ac138f3650a1f4654612f5f0de7f94c6ffbdf
SHA512 139ac53756869dccc0250674469a8ad3cfea7d14a0681bf9bd2aaed0bf6f1d2643455d24be26ed540574e545fa1cc6812b7c32097972ee6a55f00d2ee16279c5
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glc5SW6H8DS52tdDpbRZy:Gu6JmVxd2dc5SSDntdDpbRZy
TLSH
T13FD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9827610490e9b64534606ee55c66e616175675b3f63bbd4019f047f3b93b24eb
MD5 a5aeaa8e7b77d340ae1fec0da609395f
SHA1 f202b5cbb8286da3077ba5835630aa707b54e206
SHA512 71fe92824658a952a91997c8685e5ef52978e0e04c15293c2a9b9042a4dd5e7ae7acf413aafb7ac78c6121c16a600d8a037f31dfd1bc624ff5cff1431ee9bc69
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4xA5SW6H8DS52tdDpbRZy:KmifPbRr5SSDntdDpbRZy
TLSH
T101B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 09a70617336d40f3ce394569d65d7cf75e6b850ccda0033e03f66c02c61b7c6a
MD5 b6a5b95a358c52ca4643c3a2bd5b624e
SHA1 896c47633fe68bfa80a459c602fdb388ed9ddd71
SHA512 57562f4da5f6036b9e02a28a233419d06f7879f2a9696bd15b893ce17f725090236e14dacf67df36ca2cec406f35e77fe51f6ee3734ba883ff2ede7ed3417aab
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqh5SW6H8DS52tdDpbRZy:a5dKTi61h5SSDntdDpbRZy
TLSH
T113C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8c2c6f49b5637f0cbea1e6e1f310b6ea436c315c76ca07ee627f31826d971b4c
MD5 3c0a8e37de6e0caa19323ac9eb2d7666
SHA1 04d074ded6124665289b9d4012aef295c2ab9008
SHA512 2b21d24905157925737bfc5f3c39198c12b32a72eed7e235da777b2cffa83e82b30bc1e3688c91ba7d9b0535c26cd50ac21e19562553438565e3718f804f791e
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wM5SW6H8DS52tdDpbRZy:fX2iyphv5SSDntdDpbRZy
TLSH
T1FE95BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f6db2a15dfca97bd83389286aebee11f62c606b777ad95f52068ee612e424eb8
MD5 026c1478b554420e79e7247e35046b15
SHA1 683dd64fd959aa928c916536fe19ab322591decb
SHA512 524b4c51a8e9d0b7fa3901c19171419fcb55c39e795366972b4eeb4afc082f9d5d410f98a064f04f70cfbf7bb0f92131af82e2eed4d2ca4e15ebb01b8b3af786
SSDEEP 12288:Ct5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:Ct5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T162C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7d4be532e1e229c401d2b0e37787890c69f1307a36aa69f1de94dd2cc3991a27
MD5 79d6a5bbec5bead629acbb2e8e4c3383
SHA1 9e0ccfeacc1a94001f8fbeefc8bb6ba3a1eac1f6
SHA512 bb7a086c2943c4a70dc405191b355309bccf46aaa9cdaf2f85e23c24ba409d1894d92c4a809b32022e596467ecf62431dbc58b13f3ad587b6becc6e39ad67f08
SSDEEP 12288:sC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6G:sC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T164C423C457A121E7E30E0AF3E2F686D4D90CA6EFD408623B5E71A147CB35D8F4676829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8e907b7e4760fbc69c6b12ee7d134ad250e5b03dfc649b850dd5305940945b3d
MD5 25ec44dff6c804a9640250ffbe1a0c6a
SHA1 82ac08bb01e8d7e825067c1031077ccf497e9aa9
SHA512 a1d03a48cb925e26c01c70fa1a0babb3fa8f30e8fb4c2845abf8abd1d572b5210ff39a990a14f474b5015384b855c3f5547ddf16f83ff1e9dca2a2557c385c9a
SSDEEP 12288:do5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6G:do5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15BC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a771d430dfd8d3508b93cee3f0e612ab65896abefb973789e81c6456b8b7ee71
MD5 84a4b19d787b6f4d2e3143a39b956473
SHA1 87d4f41ce0dd71eeb4d8ce26a3f984979ed7e247
SHA512 30cd7777502c891c7f94d0c7eb730444164d94c579547e0ae48a1c3de5a0de698ab6f2e87efd35d231fbdbad2da95063d28a671a5a2437d73d25e8206980de77
SSDEEP 12288:eVr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6y:G5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A2D4238417A121E7E61E86F3D1F682D4E628F8EED524637F4F20054B8F31BCB9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 801b5b348cf40842bedeb31d07ea2943e4b762a517878c034f173152d012f63b
MD5 12f7d27acb1bcdd319e8424c3cf35ba9
SHA1 6bb51a4077ebd87912340d96664330fac3b4a638
SHA512 56cdec4bf76d5b1e0dcb8a00cefe20e3216ae2f4f0de61fc976559b251fd96719700425f04015c4df42c7aa6f67ec7ff7b7e0a9838dce56139431cbd01922e7a
SSDEEP 12288:2j5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:2j5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16AC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB39D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7f2b34a80a0f5a5ef7050ca8a9e69bd99e832fe23b57aecbef32ebdcd9fba338
MD5 1b5c2cc72b2444d9eaac4c7d6afa1bcd
SHA1 c92b1bd46f309798f4bb1b1cecceefdbcc4509cf
SHA512 a2b535c633b62427625a56efb4a57c9957a44c60cdf2176faa294617fc9bf95accc908f5bf767d4b1036ac59bb917f01df7d9ff0ac732b0040f5f85384d15360
SSDEEP 12288:Ue5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:Ue5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B6C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E719147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 29a2214e26d710d2ef01ea39bb8fd45c0f80a9d5b2edbfd5b7c4b090d82f324c
MD5 dbd33568f4c320fbaca374d79fb06f67
SHA1 55b795e4216fe7c12287c0daf04de93d175e55bb
SHA512 23fa3b8067deacd7e92df2d55f2ca32c077f927416052e7027d54051773993eb2370e95c01b4ac655be5a64ba6cc1f39f2328d39c594fbb0f18cd0b795cbe3cc
SSDEEP 12288:Xa5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:Xa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T155C423C457A121EBE30E0AF3E2F686E4C90CA6EFD408623B5F719147DB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b208c0d6c26afa712eb2cd3f5e8b85f55cbae6360a7de7958d949d636aa26cb8
MD5 1b83110c2c3bcce4528405447a498766
SHA1 3e7d0e3d198fdf0eeaffd91325ec046abac0b1c1
SHA512 ffa07d6ab01adddca04548836eff7705f85f6cf34b407f20f1e966147520bf1e1d48002ec57f66c0982b48c883c8ee9591beb9120385ed0c369eaa9dba1cd2a5
SSDEEP 24576:2ZMSzFVSOi5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:2ZMSzfO5SW6H8DS52tdDpbRZy
TLSH
T157050294B39018FAEC67823EC9658945D6B2BC5A0760C62F07B436675F333920D3EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a831e691bac46b59c6f0ba800dd6de176f2472584f2da79e6a39b822346a4b44
MD5 85d9c831cc80f168437252232b4fd5aa
SHA1 9c432d0d87e12391c093db4ef6c8a22455aef0c4
SHA512 1fa45162c4d1976c5742bd2850dd25346294ca073523829d0b557cf4973353d17ae8c564e5eecb00251c486ccbb3bb651b1d7fb478c60e92a54c09225db953db
SSDEEP 12288:1R5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:1R5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F6C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c3d927c6719fd85822f4e0c72101f0dc959957a867240cf4eea4488c79c8c885
MD5 3c050aad93169e42ea9175e8fe4f41eb
SHA1 51574fd039cc2fe4703b0baca7009f3fab6df9ff
SHA512 6d49a23dc6e9e8602c289a5b593781fb746e17bc0c15b44c0f377479d42f1dcd0f6c30a3441cc38308c5b02165cbd0099cd923c9c08486cd6171b09d2f7f9bc2
SSDEEP 12288:c15OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow66:c15SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T160C423C457A121EBE30E0AF3E2F686D4C90CE6EFD408623B5E719147DB3998F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a75c725317295cd5694949a6d7842c78aa35147a42fb1006e34f1db7d88c95e6
MD5 aa10dac3ec93ce9a3aebcebdb81e3bae
SHA1 437752866e654754befcfdd0dff15cda5ecf4e4d
SHA512 c9fb9d92c891b6d729c79ac790435f60af9e7535d29f240156754412c8d459072132f08c6d077091f83592022d9f470a3be6f03e88b5f5604dccebd3f326c6ae
SSDEEP 12288:DyPz5L8m5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow68:uzym5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T185F4024773A130FAD12B8275C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c01796353a18aceac381e5749fb462f55cdf4cad81f0b0a8b3f7d56919ba1517
MD5 ae121a811dfb58e9a6da8b5ece560a6e
SHA1 1e587824328021fab54e6d635eb69bf59115db6c
SHA512 b16d34c1fe8ceb5e91dcdfdd27c389307fc996b2d9149a7317fc1471884dcefc0b44a23825d62711671a755d0d94b54576993f78fd30ba87dc71b4d39f2d1870
SSDEEP 12288:wR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6C:wR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19EC423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E715147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 182c1c6dd2a3223ed6220fc18bee937bbf6dedc03d9ca0302a3722bb65666aa9
MD5 2aca5094c5955afdeb11862bb24bd9a0
SHA1 c35a3f947a147fa4dfa9a89cf4469cf628042295
SHA512 b14ab48cd070cc2d33585fb8d97d2b6c156da3d0a82d712d503ce42283a1add8dfc27fdc1ea3051550ddc87ed576dba20b968cd9fe285cfce566e3db314d18fe
SSDEEP 12288:IR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:IR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1DEC423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E715147CB39D8F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 25786f13ea7fe5c1cf28d8924271f972876d27d6cd59916f64d71f0048566421
MD5 5f3095ad8c5047eb695361b0799d69f8
SHA1 9c374bf7d49bbe9d9be91a664915dcac62b524f8
SHA512 ceb3b49c230274c904f78df1d117cc55632be99c9fd66b0bc6bfe913a7699296541bc5adc7835c3c917fa5f6110b2c7ba40a198deebb2df723b8feeec9317024
SSDEEP 12288:iyPz5L8m5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6/:/zym5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1ADF4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0f84e2c3108b342d99c165e51b8a0fcca4332e36be6a6be14fe3ee752ef9d99b
MD5 1b2ec153a265006e893585c61ff1c23c
SHA1 9827ad0bf69bad336c42fa55ea5a18d9826064c4
SHA512 8ff35b3d79457b8378a9ad35f928f0a0f9dd80b5ac09be53d11af32742656ba6aed6bce1f2b1458811138a6cd1284c54081fce15c9599f3f34509a0c5ed3639c
SSDEEP 24576:dTHaLl3z0zD45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dT6LljH5SW6H8DS52tdDpbRZy
TLSH
T150050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f9d8b5d01b9d00fcd7b579d55800f25dd62fbd22db38096bb0641bf1c44dfde3
MD5 931a9e627439a94f40a0869ef819f84e
SHA1 856cd78e15302996dee2a9a54db468854ef71cbc
SHA512 bb81f4a3fb2545bbf42da569b0ecf152c7bf9870094d292bf3d4b37c626b5a90a769686e4c13db2a941ba68a7dc446073a2d3d4aaa3cf9a1d41e352d518d676e
SSDEEP 24576:S37d9CHKy7GZ05SSiVw6uAX8DS52tpz9ZRzbPmSZyo:07d9CHKyaO5SW6H8DS52tdDpbRZy
TLSH
T14D25CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0bd47f599022e87be554af7e3af746877736d766a16f9ce484fe4325302f8f26
MD5 e484bb602fe5b1979b4a64b4030e6d4f
SHA1 18402c979cbe87aaff7715d428b12b81301e988d
SHA512 a6f5de1007d7c845cc3798af41cae907f51415b04e792aeb0db8c3054c123d1e8b7f56ca365fba9569baaca1a2ccb6f97c0e5b62a9eac4d202c5994b5bb7cae9
SSDEEP 12288:MI5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow63:MI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T185C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 d43339f09493292663156040f6b853a863b6883f7f71c8fb709cb4fb24bdf89f
MD5 30002be756193971d91469164c92b557
SHA1 efdad5e2f5685c243df1920f30fc3aa07c65b41f
SHA512 54a84896cee8a791fd25ab5b9ecf08f301c1fa986a68c3cfff8bac94e395ae83e6228c1d12b02153c8520480badba4f79941c53059eaad361b59a53c438c4e4a
SSDEEP 12288:OG5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6+:OG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T123C423C457A121EBE30E06F3E2F686D4DA0CA6EFD408623B5F715147CB39D8B8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4d4f99c1c9024118dd5d20804ce3d8cd0abcaa458e167e36e1d4b734234ccae6
MD5 5b7e8907362bcce93ca582d76dd3a5cb
SHA1 f815716ac0a16a0d17ecb0bede8469dedc076040
SHA512 0ede7fe6d191a2429fbcd1aa806c5e3ea0d8ff8069cda96dcb005e6422ce20c7ae7f3a3e8697846b53a865cfa2e14edb35f60838d0eb9beb73c7d107e74b305c
SSDEEP 12288:Af5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:Af5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13AC423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E715147CB39D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 e4e4c4a3a2305b6cce75b60def4172ac14569ad04997a261dc988bc9adc41001
MD5 461b367926143f921f72f8176fca0213
SHA1 2c2bc0115b74e9af44299a2a81e6ea3e8a76ba3f
SHA512 c98c610247ecc82116c5157b63734caf3ffc986fce4c523598b8d515745a6662822adb172bc4a58bea158bca38b582ccc5a1aa8ff8b3dca6c06726f724e6293f
SSDEEP 12288:YR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:YR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14EC423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E715147CB39D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4ae83db3372f815398af1b65ff8d975744ed7d670ad5596c46244e0560ffd957
MD5 aa44043529433d365ab51779374e74de
SHA1 af54ac5ff3cb305f96ca5e121e584be71e2c32dd
SHA512 daa98e135a3b5c80b7313730f040c727a3274894fea3fc6c239c99194ec47fda20bd66a175487e5a5ed0c3c0f691f53fd4c4733b2d6c802508631d4e02b87ec9
SSDEEP 12288:xI5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:xI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E4C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 56a3fb1e0b4a76526958739b0b78f16f2a5cd62aac9f25fd49fc790a99d5d8de
MD5 a7940a4850e6c6254415fbe86e8a540d
SHA1 022c01bdefb0d144626a80f4aafcd79faeddbaa1
SHA512 2444b44ac3c86dad49d009116bcfb61a2bb4eab8a29dcad0e05b3d75a1d735b6a557881c36a48bf9cc9023537fe7f8a17d72340bc875f8b36bfc02eff8296393
SSDEEP 12288:Op5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6l:Op5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BCC423C457A121EBE30E0AF3E2F686E4D90CE6EFD408623B5E715147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d60ec432490f4a4474c4d646716f3d68ac02bea53230067d35941b02c5d0e2ba
MD5 cbcacbd3d3b60898249ba87bb27c1282
SHA1 febefd9d2fd9b5f399aa3a7d9d8f756a232e51f0
SHA512 e422b24b8ed8594a205bbcc7d815d86e2ba9cb2d26cca2071a8c347c5afe84b4f54f9ee73ab9ec845e5d9c8ec96602af95d361c4357f7c6a611281f8fc4227ff
SSDEEP 12288:Xj5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6x:Xj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D4C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f17333426f56dd207ad5c13ca737b4c715dc97de6826ce1a239fb03beab73a89
MD5 9efdfd4271ca95a672a13b314a6ed51c
SHA1 016e4dfbe16fbb8eae1f4bccf7f859427afbc277
SHA512 ea702e1ee4e022d8d17d0618d15207ee611fe1ecaf7e59020b953e7c1ae64230e264fc5d537e2e9d9fcae396d112cac8a736aceae69204a1d53cc101ffb632c6
SSDEEP 24576:zfwvok9RX6wkyAIl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:VMnYIl5SW6H8DS52tdDpbRZy
TLSH
T1D335D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0437c3f869a28b4715621cdc1f0e0b00f129bf83426d10dddd608e7aee71fc3b
MD5 47b3b463cfd7ce8d67935b381a344644
SHA1 ecf7b621348e930c2b02c5f87e045155aea6eef3
SHA512 8554309df30c04fea1df7122dd4ca0243df6ed08fcb4497374ea56d8e5647cdf98c524dc23e2ee6310a2b309a51a8a1a5e960d108da6c070d5da6443d1310b76
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0s5SW6H8DS52tK:HySzP05SSDntdDpbRZy
TLSH
T112066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e26a6a69332b3def8044dfa7680573cc29ac681587ae6f01d9c66b020337d7c1
MD5 b8ab2aa01e05af9a32fb94a946033bdb
SHA1 72ced2c2bf4d8fb1cf381bcaa58f3769eb2d0b89
SHA512 224724b5fc7ba7338ff38d2baa0ff6f7356a90d67c503e5c8e0d70ca9011c2d0a4e7c78cc608d772af20a220a11493b042062605f5cf8c082e62dde19db9f781
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:147JUQj1irIhCnDHUPfF/c5SW6H8DS5X
TLSH
T10165AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 4e7852e7e72515cb6004ce520b6f75edfe55afe97f8adb4700bc356237530bcb
MD5 4b281fb4539ff39c5968c04752287127
SHA1 d5495b677b5e6c5d4ab3023c1d11299d8a2060eb
SHA512 b05fd122dba5576959c2c2832a3d313c6c3e83efb6162cdc0a34a5b6b604070fb8a705b03f7ce872e879eb1b04f2a5513b0bdd90416bff22dce0a2077de853ed
SSDEEP 12288:8Nsfh5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:th5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13EE4F149D39412EAC02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 01e0e5b887014fbdb7c1c8f499183ed772c01e75240ad36d1a2a7bd5137a62b1
MD5 e80a16ebd535b17e599a027ce3f6f6e2
SHA1 b0cd57cd31a8e4d46a1fa0b5116114dc40a20d30
SHA512 1413da93848ad0470c058035a071d992bfc7f74392cda3819018330d92aa113f2c98a4c48a6b6532a9628682f9d7585847582993ad6fb483ea2dbd6c6463af79
SSDEEP 12288:UyfJ+LU3f7lHsKOrBkU535FvzvibqW+F:UyBAUPcriU5JFvTWqv
TLSH
T147352840766AC75FC6A940321E72C1CCA7707D41EE05AB0373C89B3FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 506c8ca5a30785597487894da5d01c0ed1206043bc47e6062a759708e932968d
MD5 af248d155635d8d043702dc121375c5e
SHA1 d9d049dc9a3ccbdf926007a102b43243a8c3938a
SHA512 6defa442a3c1f4b721c8858ed3365c5d1703800771a9b6bed93b867054271e098558c9be60b728152be5500920950e064839195d9a94b43667a6cc18a2db8203
SSDEEP 12288:ROmY93jEG2BgBhSI8yNZNhrZV7VhVt+J0VDa4:YRdXj
TLSH
T14D65C8815437A3CFD1FA6031076A5B4CB7A4EC06B7096F2673C8553AD82AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 051bb445114ce8d6e30b86315cc19f536690a1f055fb2ff65ccf61b82457205e
MD5 b4dcc8831fbf68be16bb3011e43e7099
SHA1 8f3c9e40b7f7806525d69fad32ef899a9a9e328a
SHA512 ff5abed1b90ffd57a3c2bc7dd1d34601e10d517f7a20e9322bd11dcf061b85fefbdf92c0242b74a0335c76531d5b839cf8db68e55c7b159ce1892cbeaade2dc6
SSDEEP 12288:qF755OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:m55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19AD4238043942597F22E06F3A1FAC2B4D60CF5BE8B0491FB9D216287D735DCB8E7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 570a62b8c8bebbc0ba3ab16aceee32a854d27a331e38ec33bd50f6055624ad7d
MD5 161e000cc931a65cdbc8728ef433b339
SHA1 f0d1045dee683d655a36176cb28e75df5f6f56b9
SHA512 23ce3775d088a4ab4d0151afaa096d9f5d19e2adaaecc32c78c1b2412fb0e4d8917f1fd603f05274e261607b806cbde4cc15acc0b06268fcb9eac53cbf2dd885
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:9gb4mBIBhGFS5SW6H8DS52tdDpbRZy
TLSH
T14E65AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5da4da7f3cfb65a635a6372dc2dd4c1ebfd9fe59cb87edecddbb44a59ef7f8e2
MD5 5347e3ae03b831de57bf4fc81a5cbe14
SHA1 8bbec9842633644901961c2736e1c811457f99dd
SHA512 b90dc1fdce810623821d8e6f26ea98a5dda8b58803d7b09f50a85e5031c60f536107cb1af0b41731c12e8a17152a5c794187b6cd4cf0345c88ffd0bdef6e8e4b
SSDEEP 24576:KG88u8FpJqH1bzria7/mi5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:x7ZFPqVea7//5SW6H8DS52tdDpbRZy
TLSH
T1F735F16577E101F1D47BD138898646A3F6B1B4250324EBEF0BA88B521F23AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ac453c9c03d82d5abf439989511a098ca7a1e05cde4e4a47e0cfc1eb6c45a6e4
MD5 d93b8a9c040720cf86375fe52b6fdcce
SHA1 c02232dc25d62c330d301fd402abf1d08e5d4ab4
SHA512 9df0860e90b601bbe9dd6a7f7e21c06c09025b112825b08155153b1577edee45f24699ab827ebe32ac8e085b40371dc3cfd4c28aeab85d0ef6230b2cafaf0899
SSDEEP 24576:vPUr+NQO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:vJQO5SW6H8DS52tdDpbRZy
TLSH
T1D905F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a6a8373abd339b8facefbd936160b9c0ccc2442bb5c18e0afccdcdcc98839f1
MD5 1797d12a5f922e8480130c6c5e66df73
SHA1 d447169e9b65a002ac6668e4e87325797f2cafdc
SHA512 c1a358f4b483a58b3f2562f5e59bac1d90fd42c023113ae4c8fae51bf97768228521f1f1cce1e962669a702419edc76b6dd7c7d25f0684bd166e0b0de4dc6ca1
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAje5SW6H8DS52tdDpbK:NG05lO43bd5SSDntdDpbRZy
TLSH
T17BD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c40e376f5a158ef476a49e05f4d3ee7665003940bd999928cc27805a6683a39
MD5 4fa06d159b38ca4a8968eed014fe5d35
SHA1 93e80a43c15ad20d1f6c9d723e871fb19b812812
SHA512 2e7f882b8d5b41d87dfe454a63df74cffbd4797340b74553bea3893a9b45a83760298251c0dfa866ca8c4828e7bc6f09c3fdea5e35a31f2ce2b24ba3b9b9f475
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidns5SSiVw6uAX8DS52tpz9ZRzbPmS1:Xa5POZ3+Jt2pasx2+mG5SW6H8DS52td
TLSH
T13365AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 765a0337993bf046377bcd41401405b24854cb9baad6ed0693a0ce47a1cf87b2
MD5 91d4696764bebf08052f2f3a8eadc7fe
SHA1 25927cf016a7f378cf1db4f468ffa580d1278546
SHA512 0e057251a0a5e93699517922ddbfeb8df4fb813133bbe418cf1d72dba6b16cf1b29ef4889942b122745c0ec383befefda6cb3c675b0951f1e733fac29adf8e64
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fkq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eNc/zEOVHFf5SW6H8DS52tdDpbRZy
TLSH
T182857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b9db131ed62782cb793ec2bd4e6624fa80136971aa41451037f199fb6e88836d
MD5 a61f33b92451515b36b06cba212b432b
SHA1 d89b1760b76dc9ea0d7e7d86e0f412a1dee9c6eb
SHA512 d2c7117a0486ced3bfec2d919f0012aa4851ce8cd1640bfa0d3057446947022913256077ba4e08222ae435bf22c37a2348494794c2545304d25847b7e31e95cb
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:R8MwBtOmQ5SW6H8DS52tdDpbRZy
TLSH
T1FC55AF6EB6B806E4D1FEC6B5CD238512EA727461073293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 59acf84094e3e98afb99125ab2b7bd2e259eeeabb49c6d42c9ee409184bc64a7
MD5 026f6faa8edf2d05e10d2d3c4a6fe0d4
SHA1 7f7edb6c00fe28fffe17e5c658e86a9d3e57335a
SHA512 11d1609879081a1c794bb18f7c3c1cbd884e4b6167fd3fd6e1ebca627b45d78e781882c71b5213c76097cb05f69e321ed8c384ad0b27c4d46df1592be5f2039b
SSDEEP 24576:ND3FHshBIYQgAN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:NDVHeBIAAN5SW6H8DS52tdDpbRZy
TLSH
T10725E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-19-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/560-26-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/560-25-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/560-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/560-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1240-83-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/1240-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1240-87-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/1240-320-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2676-125-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2676-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2676-119-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2676-323-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3400-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3868-138-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3868-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3868-136-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3868-130-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3868-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4364-338-0x00000217686B0000-0x000002176893B000-memory.dmp

Download

memory/4556-284-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4556-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4556-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4556-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4600-299-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4600-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4600-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4600-77-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4676-0-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/4676-1-0x0000000002750000-0x00000000027B7000-memory.dmp

Download

memory/4676-6-0x0000000002750000-0x00000000027B7000-memory.dmp

Download

memory/4676-97-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/4724-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4724-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4724-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4724-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4724-339-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4724-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-54-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5184-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5184-50-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5184-44-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5184-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5880-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5880-325-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5880-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6056-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6056-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6056-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6056-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download