3430d25de94170a1c8758178f13659b0efd474773be90434da75542da0fca862

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260809-w89npatdrd
SHA256 3430d25de94170a1c8758178f13659b0efd474773be90434da75542da0fca862
MD5 4f4bd1062c05951c0101dc3617f46e28
SHA1 69239778ca68b079d9c36ef6dcc24f9cbc6b657e
SHA512 a621a3bf3ae06a9399fa60feab88e904ed91f4fc75a7dc1ccf5f0a3005f880908f7b42ce04cc8de6b30249ed186e991c41210c62843c8ddac3153228b617054c
SSDEEP 49152:NskrQfcFAgozdfsFyNqRign2RMwoBcfaa++Ywb4Hw19TpIzUe/VXzaHY6Q/lFTjG:jrQfcFIADntcf8+YwbT1Ezl/dLm
TLSH
T1D706B013EB81C071E993013E85BAABFA9D7DAD105325D6C396943D148D732E2E73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3600	elevation_service.exe
2512	elevation_service.exe
2988	maintenanceservice.exe
2816	OSE.EXE
4484	PerceptionSimulationService.exe
3028	perfhost.exe
1544	ReFsDedupSvc.exe
3920	SensorDataService.exe
5416	ssh-agent.exe
3064	AgentService.exe
4088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43db7280209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000543fc2172e28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076e570192e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff37fa572e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a240d4572e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067f16f172e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800006b00000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c701610f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeAssignPrimaryTokenPrivilege	3064	AgentService.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1544	ReFsDedupSvc.exe
Token: 33	4088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeDebugPrivilege	5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	5788	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3600	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4424	4088	SearchIndexer.exe	100
PID 4088 wrote to memory of 4888	4088	SearchIndexer.exe	101
PID 4088 wrote to memory of 4224	4088	SearchIndexer.exe	102
PID 4088 wrote to memory of 124	4088	SearchIndexer.exe	103
PID 4088 wrote to memory of 744	4088	SearchIndexer.exe	107
PID 4088 wrote to memory of 1516	4088	SearchIndexer.exe	108
PID 4088 wrote to memory of 5852	4088	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 945d14779e780a0e768276403b8bf88b0f32205b34b9af82127c8a9b8fe4654b
MD5 74f0a7684c2056d40637e4101aec2f9d
SHA1 be299662fcabab6a1d66266478279c2e754ccd26
SHA512 c40e315c4d868bce19f230dc74ee6c5cd7f775d7c1be838dac9eeab808a48d8034313b5354e9b9ea7ec3cfe0b16a99990eb0437316f96967644e3b2b02b79a6d
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwQ/lFTjN4:l3q6HjB4Lm
TLSH
T1DDD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 860cc2d085b978bd30b23470fbaba33e01474329c2ba3992b34875f262c6f00b
MD5 01c4141dd9c6516cee3f92d7ba670339
SHA1 918c9951f7bad1ffa8b08b9fca1eeedba416fc23
SHA512 3ae16a94570b7ac3220017133dba94c6e93b3c83e2ee45e11d81617affbdba56a106735ce41845e87518bce4e0b0dc0289a3696b005db04edee5bda5100903dd
SSDEEP 12288:a1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:wXYfDtczAnnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1C165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 55d11c6ab6b0d90b95be3a45b72f3c732a72619b57007a534296b821cdeffd42
MD5 4f7fdcdd38b15e3cb69ee7703e740216
SHA1 09e842a8aeed7a70266660595f362f5ef4cdb047
SHA512 434aab5ae48dfd5c1545adaa82b83137782b0d51759caf5a196320aba178560609d0ebe821c4562acb1f8280e778ed9575045bec563fb26785852d8c1cb53fe4
SSDEEP 24576:m0Le5ji0hmxLrMonQ/tbw/2Mkjy6Fr7g0oQ:mPji0AlVQ/lFTjN4
TLSH
T1CA859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1db9ebc9d8a25b108b87a7548df98a6c6f05226344571439548884f58e6689d
MD5 5e3254e0db8df5747395c4670085625c
SHA1 dccedf62a3b39ad87b31fcdf9f4ae498b17f2361
SHA512 1720e8a07d690e75059eebf66524a1e85631511bbd2feca7b479304446629422acb408c387633b94251370e855e91d3b0ee750288c079a574fc6fec3cbeef9db
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuanQ/tbw/2Mkjy6Fr7g0ox:E/ezSC6vUzPvxHjy5Q/lFTjN4
TLSH
T1B9755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d48fe651f6b961b6bc2915502c28065d036e51a034d70e2360cf8f83e4e1bd0
MD5 b9cbcd3ce1c133c0f3a7461518ea8663
SHA1 8b76e6b1cfac8d206ea8feb7e61e81be128869e8
SHA512 43a74244c27cdae73c78b1e6879fd1a054a9c362021e644c0b015f0c704ef9218e63b152b67e66dcafebe829da09b3df5c7e61bb88b34ab63df7df7aad438ac8
SSDEEP 24576:qVbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0o7:qVO88hXl+8Q/lFTjN4
TLSH
T1C0559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4de25de5d7996d98c26c86b1a89bc424171d62afb1a37659a6d51e01700afc97
MD5 ff5f0f69a7bab79edc133f8687dae2ea
SHA1 6b5787697c3560ca4d3fbbd9bf608b5e084304cf
SHA512 ea6e23400327dc4e809d5cd701fc28e5ce9307f076ebc71db6b2fbd937b4648c7f73c60f06ea1689481c2d3cecb70b65054830e811c495a85fe5b9c06b0331ab
SSDEEP 12288:yzEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:yzknQ/tbw/2Mkjy6Fr7g0os
TLSH
T17F5523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9cd1f28d9338ad0d06b4c75a2bfa1f191557d50e050baedfda3690397177262f
MD5 0f447f7bbde59ded515c777158e1f3cd
SHA1 022287996169fe25c7530b7aa42c8a56135c44eb
SHA512 f4cdaa4cdde2f67dd8db905c3a4aee0f837b00f62b6c11429cf290c97f1a2623a8d259efbb49d2a7542a882bd288b906ff50e1e24a220f9f2d478dc4fdded895
SSDEEP 12288:7eBNUbTVO86UrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:7JIUbnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T11575CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3fe65c96b9a0ad5e86bf636949859c4851934668905dc4d196a946e37a80dc57
MD5 ce5afd9cb55dbc3906f1cd50149afefa
SHA1 0241899a1a385bf581643c4b85c05eed5ba954e9
SHA512 513b1db8f5d6f372324836c8ccdc3f659b7b91b385e7115d5ac2422debe8392ec153375e077e34fe15668ee0435d65176706d87843c5fbe0fa674c1ae17f3a94
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:6QvGAdlCEL8c/yRNw5ClLm
TLSH
T173267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 03dc422686fd920bba35474462ba04471a2af2be60c3fd94cff16f141f5c9103
MD5 68b1468b5105602e45fe68c45396a896
SHA1 3eb78d6fdcc689f3bf797ac3f2bf41889bd20edc
SHA512 30995b35a1f5b1288b42d70305872f1c2c8a8e77ef4e3213cdfcb9afe9725e238747f13bc06b188f45c889c23799181844e401e4dbf480e408dbe34b170345af
SSDEEP 12288:XAwSfxL/2Dc39DLLmt0LDQewsAjFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:wQewsAjlnQ/tbw/2Mkjy6Fr7g0or
TLSH
T11B75E031FE74E436C77F0DB21B26C706183D6A604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 629d2b145b9307f6d545e90cb4b2bbf1f973af1f26617ae846ed549b796794fc
MD5 1ca1915347965d3d7ed84b24dd9c7cdb
SHA1 831b8eb8764a2f4116123b8dc12de669a3b2bbeb
SHA512 ba13a689e74e383a5ae7159dc1abff2a007278269c84b5a3be16f8fb55d619d0e5f775687d2823b69f407d367791acbf3da5a6e51d638cf5ac2c8ef35d649187
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCL:bUEtQevvqc2W1cpV2EI32
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e4cd6a92ee7ba51ec4a93dffaf102defe54efee82b759a80ef49f12ac60f3b4f
MD5 4158f2fe2ee78416cd88efa13cca5b7f
SHA1 096e4e99a52261c16614cc34de5e5f06c7ed49bf
SHA512 c6c19eda74b4804f1788156da5c0b8a611127283bea3648e74eb2ef1ac6e5d166b889f3678cb31552ed48745191eee2651504085a4eaf458f321bfd18df6d659
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zFQ/lFTjN4:1oqtVjnm5Lm
TLSH
T19ED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a95322831027fcd9b447512c373fd4c4bed72bd1039b628d28bde1177d91c3e9
MD5 1b77507c339c6bf8d397e489a48a257b
SHA1 d9f8791714602796c66bfb1bdcbe24f67f1dfed6
SHA512 03cd95bce5d8ab16f1e472a4d12abe091ee192e8b0449cf7dedc7b929cd4d7f0e4b4b927e7ae5568b3eb56dd449ab8f832f41d61c1965d5e43896c79542429ec
SSDEEP 24576:2AhGLJIFoiwtA5l7S53+nQ/tbw/2Mkjy6Fr7g0oX:2AMyFoiq5uQ/lFTjN4
TLSH
T1BF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1e7899f81acc0b47e8c79620f498112ece7520257311c0c45381833daf31ab68
MD5 5c4d12432df8b59661d12e7239ea23f1
SHA1 10711d3218d7119f23a86c42fe0dce834c07b8a8
SHA512 4584165e55d36e64fb282c0a3188b20ae959659c16e6098d27557d2912ac4b375eb31e13310062395657bbb48c4d3564a5c8bcf7dbf40303e5a578f12f54e831
SSDEEP 12288:vmw5HEjsChN2BFgl0WDm+C6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMg:OwuHOWZnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19265F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6dd845d288cbf414c7a91cea36dea9f104c91be64731b4e0e6a1f1c571a59ec1
MD5 43ca83fd2e009dc24d4fc44481218f6d
SHA1 1c772217d5c86aca83d438a658687601bb4fd080
SHA512 7721be64a95e81de2be404579f362919253f0355bdba650b3e4a0350b7bc6147b3c3e0a79e4b6b4be95d6ffc6fcb2e55e0b803512376e64a3642932ba96e8baa
SSDEEP 12288:pXZ1IyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:xZuAnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1DC55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 223bf649fc1d60ac0fd0f8ab8924412939d2f27b8c67a64c225ba35e3d4dac42
MD5 e1ad8a7dd8209c703e8709f2fa63f8c2
SHA1 bc71a5d161558dd2960fbe5a259ddd13fe7aca4c
SHA512 b68020b3db01d3a59241ce0d0bcf843cd823a78a793092321e374988857737a886f16f54701aae165d0573f0ffa39579844a70c89b15b1c30650625b7c1bc6ed
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:IQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T123666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 17fbd0241748073ca61f1a898e2e3f886d41d0129fb98e827d833f2282149a76
MD5 2f60e9d94e08b098983a0419b599a3a7
SHA1 9f90d63244f3f22112d70b15ccfb56e9cb292c69
SHA512 c40ba3b33fe37c1e5ade8e12c65f12588aa3cd14c1003ca27e689260ec5fd63232a71a937d877d42396fff0f5070c3643a64a591338362b1476244039c6bb8d8
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:iQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T141666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3beea0313fce5a6792ed4dc4eb386696293f4378fa40ba9aad731896ff5f366c
MD5 28545798cfc0710240657d15af816079
SHA1 55a0c74ff91ed31d2934808d392bad3cb14ab308
SHA512 083ace64361a733cdae1451fefc2b2074ab753c2d38276f6d568b263ee9ec16dca665a761a3f239f65547f2608b00c239bcb9939542f8711e2221b9ba202463d
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0wnQ/tbw/2Mkjy6l:C68Qg55nhheWu7PNU3/VQ/lFTjN4Z
TLSH
T15DB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c914dd7b295ddb0c217bf38b69fa6a1965943403f4f1df9038c7187f3de50d1a
MD5 27122e88f5ce48f687815ed9da40a380
SHA1 ca138dde352d24415af7b5c178e96b3985ffbdc7
SHA512 f17c8ec0ba375262427063e247d137cddcf0f77d20ee2393cb9ad4546db0b91c9401168415489c82ac36a18f6d6ae837298e3f32bd8c7e5f20d4c6fdc1be30b1
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:By5112gYy5azzVvL69nLKnhZXLm
TLSH
T1ED167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 58a302d5990255b6d0fafa72bdac456ab9eb3b1cdde849e8872b132658759b30
MD5 4cc54b422ad075ef75bc5069c0c73880
SHA1 3fec494f58c1dfe6e8a44996632e906c77004ced
SHA512 9a26a538b2e92fb149a407108f294d2acc47d15eebec11e0c0c66c8a8fa57c992575ed82de50527f40260cc863e53792186761f0cbaf54a3eaef93fb7fe081e4
SSDEEP 49152:XB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXQ/lFTjN4:5u6JmVxd2d8Lm
TLSH
T1CAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d0621d2676055b9e3f9ce3fdef26486a7e28a0bf6fb205cb6bec802c96136615
MD5 3e6c0f4ca5bc637c752fdcdd7391bda9
SHA1 f4e9011090b6a62f124221b1a3902919b41d07b7
SHA512 f47942d72b6aef78e3647bbf51b92b189ca62a25f853c6519a54c3aeafa29c2d490405146ec66ab9dcb7386b9ab0099ada97217f6166ba73291670c03b8831cd
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4x7Q/lFTjN4:0mifPbR5Lm
TLSH
T147B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d40ac41e76c55e972634bf2afa716ad0ac31a652d49c4ff109c931cbc3a2d37f
MD5 3a3912c1f5ecedaa7cc02740a6ab17ac
SHA1 e6d13aa3c748a4594f8ae0e829dd6e7a8055363d
SHA512 340c3b99f84ce9c60815f04fe33a896c24e6e23f64fbe82e646a6b5478cdf1ae04fd8f1cc12d512a44fdc5edf4c6897bd064ac3c0c9379d8534b9d5f6752c146
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqAQ/lFTjN4:z5dKTi61TLm
TLSH
T136C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bc5f8cc07ef69302eafff730926d5a1f636bd3adf049b378a015b254c11d1d1c
MD5 0bfe5907361e1c4d6b1129e3b947655f
SHA1 39959cfbbf481b8ec469f0baf325d8dd61312134
SHA512 c112f5cc07f625b8027f59ca2372ea44e6992372cd5c227c13a2865402121faa5ac37506fb5fb2c39a3e02a03ec8eb343234a55e73f70e2a0dd6e320181c4e03
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5wnQ/lFTjN4:5X2iyph9Lm
TLSH
T14095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a7272852f07219a39caeab789cbb235b2aff52b1ca5b35e87cdd54cb39eba768
MD5 31774ef1819659dd3e5c987540c943dc
SHA1 9c682bfa6386c4a1121528393c2b754228ceb469
SHA512 d0e83638d9cd8897f1b154a80ae4e300ac3637e2f4d682fb19d11e78042f7ed29c69551cce10a60925387e9518544ce840b11031abe24a71d5672a9a6383ce84
SSDEEP 12288:H8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:H8nQ/tbw/2Mkjy6Fr7g0os
TLSH
T13C5523697964F98BFB1706F18C828182977F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bf218c8c3c01266dd173ca506f97ca39e4bd0e19b0a8ce7103ecc65b81486af9
MD5 2915eeb3c5fbfb7707668c6c8654f42f
SHA1 f8074c1fbfad20e4c5c657bb67cb014907ee0e9f
SHA512 c3c3566be337d88606f3b0febe06f27c19ba41c95daf0403b21b162a979d2614c430a6ceb07d1b680e1eacae48edd03c1de702e2b88ef6c3dd15f577810c6062
SSDEEP 12288:bRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:bhnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T11B5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8aea2e8b8920ac261d84b91556d2180babd7d7cef43614742521f57c8aca36e9
MD5 9559a7b121138616bc0293214cfb6e2f
SHA1 6c8984ceb4e03de6d9cd5b8ec8c2ab22db2b9149
SHA512 488488c2deaadee40b742a3ec63b9418defc7812d91be79097dc87c3bf505df43cbf2b62c88765fbd4dced56235b1fa1d06eb4a910451235a0f65d49fd9da46b
SSDEEP 12288:LjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:LTnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1FB5523697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 097271fa6880121f06510edb09c6368c66b5b33e6cda27b16bb2b3e649a09481
MD5 bd0916d2ea077d304cb6d85b851ebd6d
SHA1 de95fb603577dabaa1b468e1105edf992f08adf2
SHA512 f39c1c7235b07e96c2db59f855bae8a171ee0a743cacc2090d62495097c051620c371036e723dc3bd027e401f303f9f85f5a6cc970c5ab1ccb35c84066357b4d
SSDEEP 12288:dVeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:2nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1F75523693B69F4C7FE2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 73e16e8855fd81effae54e3fa55dc9093bc15ad03835d6b5a217cf9ea66d9937
MD5 9e13d5fca2a4dbb80107c70f2b36a6f1
SHA1 e22388ee0c4ba47dbfb469993d506e0c383533f7
SHA512 ab1a048b831584d740c2bc92aa060e520bcf746c6d1a9fbb5122ac4e745b059964fbb8ae54da801d10997b419951b42f0409af383ec079e76cf5295a4934dfe7
SSDEEP 12288:MGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:MmnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F65523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e4aee27ce0529dc63bca0079073d31ebf7b027388f703a84cd580e1993c8d8fa
MD5 0e9f077a6f707cddc3448b12e07c255e
SHA1 2dd0e62d9ae9ed170d627e0d16b7e93674ae534c
SHA512 70ebaf3305e3dca1d3530fe659a325d02c4e1cf446b056afa69cb4f8941a5fd8075433048fed8433e488f01b250f892a66b7a49d85805130aab0c03521650200
SSDEEP 12288:x9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:xdnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F35523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec8b3636e281e916e7e1af99df7c451d8f3f9ee202027aa3513ab7307ec983f4
MD5 71ce10367501bafb61add6e8fe8e7804
SHA1 46cd8c0ae5cdccfea304bbca6b24507e17a11621
SHA512 2fbc471235582590d3dee83cba8843638b1d55f03e0b6cce373efb63e0c4bfa28c3e857477f8a4ac6d86d5cc7422a72e1c6a9498b6190aa79340c4996ce8d917
SSDEEP 12288:75GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:7JnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1A65523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 39ee2d511657c0e22e1f82f8ad14b49269df9fbdce7679bbc6d96208653af941
MD5 07c7c5405f1599df2bee7c99a06ffa21
SHA1 de1185fd0e4fddda13d50a030e48553c4d91b844
SHA512 d80da79405c82c54c666f0875fbccd915aaecc7e0aa1dc3237928c3faad6eb58e3043d01d2b6c5bf876f469138ba7984dda450bc215469f1cb53800ec7cfec93
SSDEEP 12288:QiZwbDzzFEoS2cPvyxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:TZM3zFVSOBnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1147501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5d11bfa35d74bf74a2ac75794d1bb0b735782ee23c3c1bfd1e805767541a2f07
MD5 1786eaaae9ffbe4d0c3fc6b9d8dcb7b1
SHA1 2524a11ae3bd933708a0f6eb7468bd8693f1138e
SHA512 dfb0e9891e2fe4dc828a1d3296411638700806b66bd982c3dc09fe080952bb08b3509a9a0a1b33e0e816a20a0cf0b156f57dde2a7febd4c53f06aa4e0dcdb87e
SSDEEP 12288:AwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:AQnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T15A5523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 abf6329ed3b71ca3ab7008ec19523bdd608ae57cff745669ca419795c71637c9
MD5 bb48d21a2915985b3162eb359b9aeb4f
SHA1 8427ca021f4298c45b77c5281366ec53f2025b09
SHA512 670742039c88f382ef48f645ec297beeaa8e5e0379cc96ffcfdc182dcf32b21c9cfceb8660e65f5586e5f5f13552aec942a1119796f638d82663bef2707ec98f
SSDEEP 12288:0UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:00nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1815523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2269354114490090b1aa67b6ae8dd0ef473fa672774197395f6c303bab1fe420
MD5 22c16e5c3d65099ff450c27f36f5ce22
SHA1 b48d51e9971af749b71295ea550254d89abb1bf4
SHA512 f68706500a2191a42e9dc4b4edbec26f8fcb0e76a2189f5940cc1d30a26e9158fba10789eaa40c61c08b4e18a6c1df36d803c4bfe9f380a6950bfbd965f439a8
SSDEEP 12288:3yPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:6zy1nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1AE65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 37619b3760bfc49263c708e00fb8faee6334b8db7144ca94610c353dd30c3d98
MD5 f525b091f86ff49a5bffd89715bb69c9
SHA1 62197af0be9f9944335b598805a6dee29d78c457
SHA512 dd7d112c1a1cc160cc47a50fb5339517a3e0e6e1bd3f467b9c2989fc14888936452eb7030685c55436b42b1135c4b03f98c2d63050329962f1183d043faf581a
SSDEEP 12288:swGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:sQnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T11B5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b9e453eeb176166225bb843b22ee672dc1c66351e68d63ea6e0bc87c2e6aefad
MD5 3266300224ebd26095483faebd418c7b
SHA1 4d42201ff558b3070cf85979676ab88785e6b321
SHA512 cdb4785668f641f05f1aad0207ee1dfe84beed075c5b2ca944d50321b5751e9d3ac316fe627a35fec2633bd69a498a0c4ac041a53fd98b4724ef60137c74bd8c
SSDEEP 12288:9wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:9QnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1925523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 53a77633335b608fcf1a212c10b4e12a88b73fb4321544acab183026ff3f634b
MD5 7ea41129b9ef3b1b1e9a1e251e3d1904
SHA1 f563c1fb7cd3b2449ff3566d3d0b4c34eb1bbf69
SHA512 b49c271a0a1e3f6b75acedf4797fef422e3a5f86ee0debc7caffaae0bc034dfdb99e600bfbb10de267307274392668dafd49e68d08aa3d997d77152613c1ad9c
SSDEEP 12288:cyPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:Fzy1nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T19F65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2affadb3c20024737934079653b25babeb06e1eb405a337066051fda752f2d1b
MD5 ba5e73a7034bd14e1b1c12246657c884
SHA1 11d10587022a3350730640fe5a58b85a81f5655b
SHA512 0aa168bbaa6dc5663d3130fd6e92e990e4f9857ac6e5309b41024d67cef691903bb341e9afa753d7127ce1201b1fdbe6fb91cf19c71b3074fbd6470c05e867bf
SSDEEP 24576:lT0aLl3z0zDDnQ/tbw/2Mkjy6Fr7g0ox:lTDLljaQ/lFTjN4
TLSH
T19E7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3ccad49ecf949e185e7625fd386ba46ef1888fa9b11c3a24c6aca2d953d0a03c
MD5 9d19653a940fa22e4de3ea0c9ada9de9
SHA1 7b25e987c8513041fd9fe52a6b15b598cb0761af
SHA512 d686e6adcbd964e7f44232bb5bed19f5fd1411ec8ebaf8fd16572d71bc2012baac9b9cb8aaad707ef78eb7bfec9e1affd0b252776d019eeca9ff5c1f173b7dec
SSDEEP 24576:x31d9CHKy7GZ/nQ/tbw/2Mkjy6Fr7g0oI:h1d9CHKyatQ/lFTjN4
TLSH
T19685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f291efead71589c1225f4bac54e0c3abe0a317ab3b890b5651aabd6931e98bb2
MD5 625e0ede40fda60eb4d37bdad55fa415
SHA1 e5e9665e324204d82f0653eef823965742de1033
SHA512 75056184ac4244e04d56500dc02176f29ee04c668c00227d8ccd974b17dc5d5727c9b76880b1368470c9241c9ae1605fdc3ff19bfba2b6a4d578be677221f563
SSDEEP 12288:zDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:zznQ/tbw/2Mkjy6Fr7g0oW
TLSH
T11E5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 27e1a535434395e8d734a057b88c626545ffb0a203c51fb08268c6606cffd27f
MD5 22a1c8aacf9dd367ba82d59cf17b0e12
SHA1 6200bc91ee2c0cbddc9ba39b21e23bb7922c020f
SHA512 bd4f477d935a0dc79e51ae537219099461858858d0c56b80f9d1ee828ec47115a492b94e8cb90ed1b30370afb925ad30cb996bd6713a5ada1d0c9425d8339224
SSDEEP 12288:w1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:wVnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1CA5523797964F99BFA2B06F14C8381829B7B0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b476076faa57a51bdae2172b7fe054a0c023fb85626e97dff320456224ea052c
MD5 f2d93dd545a4a96f25c1a855814a6ac8
SHA1 db825d1e2a2361036f520b90c5fa685c1f51a98b
SHA512 01d3e6be6d2e8bf886e06d22ae86ca291fb8e7cd2f994863b4a0d36ac27436f87cf5c95200f9c6cfbb0a42eb30e33788f25958bdcf911e54edfceb94e3c51937
SSDEEP 12288:RCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:RCnQ/tbw/2Mkjy6Fr7g0om
TLSH
T11C5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cb7d56eaffb6a985b777d21cb759234d07b778e991d6ad1ced74b0dcd3b66b32
MD5 63fdcb081ab29a0d5ab00f9795fd3990
SHA1 c88077063736ea950f89aea8b430773d991708fe
SHA512 259792b1b4fd4c5366b2c9dbccb6f30bd833c820abb434c7ad338b3c09fa0e5ea05eb163ff9ae7bc07fcfe98c7cef4ab4b864ee5376a835a3498427b6d49d5da
SSDEEP 12288:6wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:6QnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1935523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 084d1ef91fcaf58fd58eb8d2b5e616acc65ca13cf7285ca0472e96d323e1d702
MD5 0f326365f1db98c44e76fc723347b628
SHA1 cf8436d36058e4fd08104d4ec65edd0a354d92c4
SHA512 274de8e476399a45b5b90dfd51deeb1f0850699102cdbb9a92a2dc4833cb6615c587b908ecbe81bcf002ad752636e907002ef75e4ed7738e2ecc1c11d97901df
SSDEEP 12288:wDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:wznQ/tbw/2Mkjy6Fr7g0on
TLSH
T1F45523697965F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e6848f293a440ef2d38edaef696ac8abacd74d4e0c557d3b2ee4f4da82ee486f
MD5 d623eaecf0908e081eb88ce52d8fff08
SHA1 53e4847e3113b34b504daba01a485e619192a40d
SHA512 375493f170559f9e9ef16eac2ba9babf2904fff575e6a7951347a8d4bbc3d759aa9bfe2159c9abd4db4cf5a25e367bbbe71a4d1ebbbb85e3c55f5da609854131
SSDEEP 12288:IYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:IYnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1215523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481229967D39405CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f71c8c7b9363eb3b5121ac75d75402ea3f26c57cad6060687ac17261f4b3c797
MD5 17820ce4173347352dbc9da708df0a7e
SHA1 d1b22405066346b398261aab699cd88621ccf9e4
SHA512 e9e665de901838d122c5bb11bd4d10f52c27236bfbdfcf9f80fc2dde2fdb026becb0beaf707018ed7a6f21c3775fc9a2318264e91889a488857d290dde6b2c38
SSDEEP 12288:EGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:EmnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1E75523697964F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1738f90c23b4d3497b537ffb8977cbae65e0abece8ca319c1e1effbd6ca87573
MD5 bb115fa0f539c8b1a48cc918d192d3ed
SHA1 729bbe85a2c9550dfcb74858a35a5f2698022e0e
SHA512 0afc3d3ae6277a5ff7abb60ca1e643315eb227fceae434fc6393773c202a076f5885fff8989ec6a55702997ed32c9a894a103d74927aefe275de1bb6276942eb
SSDEEP 24576:mfwv/k9RX6wkyAIEnQ/tbw/2Mkjy6Fr7g0o/:9MnYIEQ/lFTjN4
TLSH
T19D85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e424812684425d1b7640dbef693cd047b69ca26aa80382b4b254ad30acd8ae1a
MD5 0850f864bdfc03dcc16f97994b20d93e
SHA1 87d6a445516f4a4db57d88c3d2d047aca6a177b6
SHA512 5a80a7f088ad59b7ee82cb1afc6a9a675155cf2d9fc08378ba26012f0695c5053ad9e22e5ca4c534a2159a51c07b5cd226813c2f7a84dfb4b7ccaf521915a677
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HQ/lFTjN4:CySzP0Lm
TLSH
T110066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 553c23fc824848983218575995a959f19b7c20af45b3d4c13e9fab8e85fc7325
MD5 8955945d42294e8b3d4ac7ea67eb4547
SHA1 a8cf2e0eda42a2e27430f2121d1a0792d6f2cafa
SHA512 180caa08c4eaf837b76defcd45d7a60585852cf0d49c55fbb9110d92df9f83dd7800bb23f366e71fc436176b467fcb896c4d2f14f4826684ec36480b2053d0f9
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYRnQ/tbw/2Mkjy6Fr7g0oD:Z47JUQj1irIhCnDHUPfF/XQ/lFTjN4
TLSH
T16665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a42d7744c242a63ae5eee04592c2256eda8d3a2693ca479efdaf3bb113a8c115
MD5 e959d169907627bb56a41bed544deffc
SHA1 6b2358b18544186dc2171179c9df2bde636b30d1
SHA512 fc926e5c65102a9c20601466d612944bae2d4261d2f33bc195569e2dce3a1d68caa2062a567dd323d485d054fc408a84a314cc8fbdb1fb2c6ae98e69074b935c
SSDEEP 12288:VssfgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:1AnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0212c5425875b71d3463150837ac2194a362edaf511e795f3f2ef47057f215a0
MD5 9d61ea2f3b85987d46f833de16527ceb
SHA1 027b08895fd75137e7c433f9523ab0bf66be9c46
SHA512 0075b9e1990034f809455d330dd110dc5123e42b17bad6108d7a220e742f861248dfb242716a609f01d97e3f8b4966f94ea1d03d28ab43120b61a653ab171d2b
SSDEEP 12288:T3wkGU3f5xJepLZRTO3YgNR1PuXRaRivD+MBNXnBgsUJ6:DwPUP9ek3YgNTERaRiL+MBNX
TLSH
T1FA351841762AC75FC6AD40325E32D6CCA7707D11EE056F0373C98B3F8576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 dafd816c558b8465e5c954b21f1bdddf7976c0151e22440743b6418f550e4dff
MD5 95a15a8e6756c3f7632f9fc0f7b6ebb8
SHA1 aeedd09296a463e4be79d0bda02909ba81e544c0
SHA512 7370a926609ee6b40e7675148091cf1b936eb7523cee074ba09981fc3cf4b86dc2491bb179cf208adb990d684bc7b315a0ae250af9856c93361d02264b71aec9
SSDEEP 12288:6bGDoq99Qa8NoWCFEqUl1pVWYcabjsgh+9VS4s4eR2O7D6tmbbH4P4KZ/WYhr/qI:Ln9+4z/qi2
TLSH
T11365E9816037A38FD1FB6032032A5F4CA768DC16B7096F267389453AD866B65B0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 49ba3b50af7050c695b17d68b69fa72eacc058a3e35a85a461dd40bfa0cd9055
MD5 4ace11250383ca8ab20568173de62986
SHA1 363c0769c82f4053a76c8062b3715571f1d5a748
SHA512 fd30be54394afcc1e41f7db1c252886e58dcd196f3c7c0b2a02f851e60401d2e63ad9f37a0b58e7233657be08a02313cac9a2cd9a5e71ca9066a1b2d4f592cf7
SSDEEP 12288:Y67IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:TInQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1E95523696668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a94658b8a8de50c4d0920f38563b81ccc4d647d3f1856646a4cd6fba368276e3
MD5 c0dadefb89795ec474899e3086be8ba4
SHA1 678e79b5525ca39380330c425b30eb498deefb9c
SHA512 45822abea9f4a5dbf616ccb7bd0b6afcee5c564520833e26ec721072b508e02a516ee13898cf8e8332ebbf4854aa04ee6a11c1f562c35a4fb2e662bec323bea4
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYanQ/tbw/2Mkjy6Fr7g0oa:ugb4mBIBhGFRQ/lFTjN4
TLSH
T16065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5226fd773c13b106ac33125b00e250f0bab730c8a131060a3eb928d27c2c92a5
MD5 293b74349d7a2586ab7ea1a3e29923f4
SHA1 cd2c7be430b3fa2385163bc550fe534d05241f3f
SHA512 7eba808996546fa3c41f2f0e107a330a16c8f20fad40ad846d78f6e6e22cc5acc60109708698fb8ba266a07e41957aa9c5e9092bcb8e8d07d7945de977da1951
SSDEEP 24576:lG88u8FpJqH1Qzria7/mBnQ/tbw/2Mkjy6Fr7g0om:I7ZFPqVva7/iQ/lFTjN4
TLSH
T12C85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 20fd11621b328bea66313dde64cd697a3344748d351a835d718f4f1cc830b461
MD5 d4bac35cfe30c9c9bf62836da79a78a8
SHA1 e3998e3968545417d86f410c2abb7e587c5eebfa
SHA512 5922bb6aa196fc74156c09e4d819a925e4066c990ef4bbc73089665ef5435d89e5f1d3d4451ba87cffcb0aa08c0d3c2361f7a8fd22e97de2281e8b381e84df79
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdQ/lFTjN4:GG05lO43bvLm
TLSH
T165D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0f3871fce64f594cf731b11463d37b8a93014a436dd26d6c6f651a53bbeb1000
MD5 4cbf5a00497955a93e7cb63e18946b0c
SHA1 c07d55266a1604c4492ec7d386052092570fd0fe
SHA512 cc1a50f4368975f9cf981f8b390a38f3c72be24effaf40922b20da32194d7339a58da7e6c263777aeca90bcca81e4f3f2a64fa1824306ab3311a6537f9608527
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHnQ/tbw/2Mkjy6Fr7g0oX:Va5POZ3+Jt2pasx2+mVQ/lFTjN4
TLSH
T17665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3eb8f26a0270f003f7e8267204f48ce75cb3e2f700c8547da990cef51ce1dc24
MD5 ead5adfcfeffd0c87a22077301311323
SHA1 f36ebed66bcbff09ffec277ce3082cb403723b66
SHA512 72a2fd619da5de5dc1166eac45c87ffeaf7c079bc6d479edafce91832e618ab90169c18df949c2bb2090850e8b4d29b8e613789327c1814bc5278f42edd245a6
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk5nQ/tbw/2Mkjy6Fr7g0oB:HNc/zEOVHFCQ/lFTjN4
TLSH
T15C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cb03de53208741fd5a2ff68fc42ad70706ba773018e98c9e225747804dacf869
MD5 ec98915708077aa430b9cc5959c5d83d
SHA1 5add278ff9e3c43c6ad99e23475dc7fd304e515e
SHA512 9b3a59b4345402cc041589a226f5c3ab9ae988e7c0243280fbef2ac0ec625962dc16160358cb050a75010a4dc7a5a1a1451092c54cd8a9e499470dde879bbb52
SSDEEP 24576:X8kNvNnaFeYhJNtmZBmrnQ/tbw/2Mkjy6Fr7g0oO:X8MwBtOmrQ/lFTjN4
TLSH
T12F55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 db41d2629bcb96d96c086c06bedd973c2c57a3aafc919f4789b4dec63d5141cd
MD5 a155718e6daa949ea73e70f4f6082335
SHA1 96e61261b5445e1ca57332e35cdb287865e7c581
SHA512 8d35b21a7eef1f6bee9bee2287fa0b4055ba92074ce69e8dc3fce2571763649e220ac1a4c7bd1b7859fd3c65fe64d1bd7920a3ef772df4a32e22ea069f48c499
SSDEEP 12288:cHvUrBFrEjwaQNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:cPUr+NQtnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1F765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fa58841e5f03bb22900c92a7601fef322350d054e368c6563157ef437d69ac16
MD5 89d092ab8e98334581ae57497631d5bd
SHA1 b75f7ec50f6ffb5be55c4d9ad692ea7e1c4803d0
SHA512 9fadda2304d3c8ef7f5b65c57640370270781743aed8ad8d86c3f84773ca745f3ca2577c3bb85cea3255f7568c5843ba2ec76b4de170280b48d280fe7d5c3cf2
SSDEEP 24576:UD3FHshBIYQgAcnQ/tbw/2Mkjy6Fr7g0oJ:UDVHeBIAAcQ/lFTjN4
TLSH
T19E75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-454-0x000001C9EA770000-0x000001C9EADF0000-memory.dmp

Download

memory/124-336-0x000001C9EA770000-0x000001C9EADF0000-memory.dmp

Download

memory/1544-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1544-86-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1544-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1544-337-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1544-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1544-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2512-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2512-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2512-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2512-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2816-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2816-245-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2816-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2816-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2988-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2988-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2988-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2988-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2988-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3028-76-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/3028-81-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/3028-75-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3028-294-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3064-131-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3064-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3064-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3064-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3600-22-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3600-15-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3600-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3920-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3920-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3920-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3920-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3920-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3920-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4088-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4088-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4088-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4088-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4484-278-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4484-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4484-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4484-65-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5416-119-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5416-118-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5416-112-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5416-310-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5788-0-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/5788-391-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/5788-85-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/5788-1-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/5788-8-0x00000000027A0000-0x0000000002806000-memory.dmp

Download