4771c5ce03448f07ae83826979c5088736bbecfbba896f04801950f87afd5bbc

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 3.1MB
Sample260813-14e1qsdf78
SHA256 4771c5ce03448f07ae83826979c5088736bbecfbba896f04801950f87afd5bbc
MD5 d52da2be950c9b822e0f07ef8f2b75d5
SHA1 a56eab6e0b35d4c24bffa70be73d977ba774b6ed
SHA512 c6c2f62efe4d47a9c047346fc4d5f05169b5a1bf19d8f4bdb97b5bb2d775d7a9478f609e22b43630b33b5384a8e6316ee183eadf7691d589c9196d3641e23611
SSDEEP 49152:snU2B/B3XY0Fcn2yBxSxkXtY0GVJ8lo5Y5PrA4r3:0NXm2vWbGVlOPrA4r3
TLSH
T17BE5BF307B55C86EC86262357C1F7B364AAA9BA0673512F397CD3F6A07307D05936B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5048	elevation_service.exe
2016	elevation_service.exe
1612	maintenanceservice.exe
2692	OSE.EXE
5252	PerceptionSimulationService.exe
4704	perfhost.exe
264	ReFsDedupSvc.exe
4792	SensorDataService.exe
1144	ssh-agent.exe
4640	AgentService.exe
4340	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7e508621e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054017717712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016b2e816712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbb46e16712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a980d17712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ebade17712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b0b4e16712bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{53BEDF0B-4E5B-4183-8DC9-B844344FA104}\AppId = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4640	AgentService.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: 33	4340	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4340	SearchIndexer.exe
Token: SeDebugPrivilege	2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	2956	2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	5048	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2756	4340	SearchIndexer.exe	100
PID 4340 wrote to memory of 5724	4340	SearchIndexer.exe	101
PID 4340 wrote to memory of 1324	4340	SearchIndexer.exe	102
PID 4340 wrote to memory of 2504	4340	SearchIndexer.exe	103
PID 4340 wrote to memory of 6116	4340	SearchIndexer.exe	105
PID 4340 wrote to memory of 4284	4340	SearchIndexer.exe	106
PID 4340 wrote to memory of 3300	4340	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d52da2be950c9b822e0f07ef8f2b75d5_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2016

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4792

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 915bc987abbf6b10ad9a9e3f990134617965c80e01d4f5199b196ed27833fd90
MD5 65ca7f1417113590ef421933dd6b9825
SHA1 7b173e978d7134dffb98a8261e85741a3e7b13fa
SHA512 8de9489ee0ad27ad867ca8bae15c3e026d1698769500604214f41217bfef77a62d02a18a663ff726d58b577fe1f119d23ffd8fbb6c94ed102ee3015460c53b04
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Y5PrA4r3:q3q6HjBHOPrA4r3
TLSH
T16ED59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B6552F7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3ce2c888a38a02722bb53bfd48dc33a2f03892ddc71a4dcd9718e7952f60ffe3
MD5 b01152771bf56b47d7c06cff5df4876a
SHA1 6c891d9f52cfd88160782a147e5fe5e580768616
SHA512 e2f44e1b40b68e748368f8403ad15556ff9587c9172f2c7ef665bdfcffeaf55cdfbe969be47e4219a97a86978ba20613ca1c113e3e5d4aed870cb474571c5007
SSDEEP 12288:T1XLsswWkxy2lRq2czAi1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSG:JXYfDtczAzY59oarA4r3Dqm
TLSH
T14F85F128B7E508F9DCAB813CC9A18505EA33B8564760E7DB03E099291F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fa243547f2b92079896e105d96e115345fb1004118ab1ca5a582c56c447a8625
MD5 f90fe5348012b1cbcf7e006ef41d99c7
SHA1 47e2a48c3f7d37e505b73ecb1829abb4497bc73d
SHA512 e4f8834ee981589102c70b914f08e584ecc67685b7d94875f3df8a6fc154d629258292cb2f0e6ec22bbd0cae4ba066f0b8d07c654bb8743493522bec97b19786
SSDEEP 12288:QXZNYVLeyUji0h90ZD0wxpGZIVuFrHsX1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtw:w0Le5ji0hmxirM+Y59oarA4r3Dqm
TLSH
T122A59E66F6744375D073C0B9C5D2A68EED7230865B308ACB0286D77C2F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a60d3f5021fdd013aea19bb0530d6ac8da87648e563f5151fa8e2fc1099ddfb2
MD5 7b7e332b084b51e91d31be63e5984287
SHA1 596aa637b974b3e2006cca7c117fa9c6608ea7d4
SHA512 4635f360b84a26780543fceee7f631a9cbb556f636407b4c4cb0e6f5ef44ea2c1e552bbe6d9f983df6a21a7417b6f0b59d4ba582eda4acc910ba213e4d3320ba
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuYY59oarA4r3Dqm:P/ezSC6vUzPvxHjyVY5PrA4r3
TLSH
T105755B25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cc262076b74b3f17ea5bbc7908ea8ceb484cf9e01f6eb94841794012f03d9e6a
MD5 2c0192871e1badcef20f4c1bc544b4d3
SHA1 1bc9742f646d16c72eea9ae6e3b8fb1a9dde2f8d
SHA512 e15661ff13978413e08d536335a7bf6338c55ce9a8d8e6bbacd0ba9c503ea0fcb17efbcebde152e1689fd11d69eeb94dd6b7cfb951f6b0344e8afdf4a97eb7da
SSDEEP 12288:TVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98+1gZBcfB0zGoaZ0Rd53AA4C+aWs:TVbqPb88hv/l+6XY59oarA4r3Dqm
TLSH
T1CC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2F677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 26cf16ec92f7b4e5ca2b5616fabe720c582c211070e0bc1a84e5ef081291d6fd
MD5 ef449192a24618ec9367a071f149bcd2
SHA1 0f42d958a9c58308fa12548d7759e1ca47fd6596
SHA512 11aa1729a6f10f57b9c5baadfe6073966b5760ccb71a403dfb69ce2a7c3123af7b39c72dc2365d92f6865b2954ba6945e4b3b8db3162d06b95db94bb8d2b7e5a
SSDEEP 12288:zRz1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS9:zRSY59oarA4r3Dqm
TLSH
T1C37523E9DDBF19D6C2ED6934B1B039483C2FAF778D201B520192EA1C173DAA5CC62476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 c91905127d3840b31d08b30c64305177be832c20bac6cb242f6abe6e9ff96dab
MD5 994db53aa675abab7f4f2ed60727a8f4
SHA1 c5a4e8e117505d2d7e019fc0312d4f3b00bc2801
SHA512 f9f9d2238081725365fe19c09f73cf7bd0f3a9cf7ded280f3c96167f434c6b2100e37fe0b771e0b73ccab3249a7ca402562aabbc6996a6184491565db6225570
SSDEEP 12288:EeBNUbTVO86UW1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSB:EJIUfY59oarA4r3Dqm
TLSH
T17B85CF7BEE38FCD2C27E8DB856918600A77278314F21A3CBD165C20E9E275E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 93988a983b54b89deceb381606ef1b5bd9e2ab0472d3adcb63cf1113eaa4fd54
MD5 14604e2f11965d12ada34c44eef27195
SHA1 b3b8f154ab502d18e897271d1eba38612fe8c145
SHA512 ad7ef4167444849e0ddd05132d0f8ee79181a2d1924b1b4c943ec5e4d25be951f3b520bab4e2fce131e3fb5a14fb7fe5aca6bc238e0e09346f3fc6ad98a9f376
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:bQvGAdlCEL8c/yRNw5CoOPrA4r3
TLSH
T142266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e1e4f6d266ab857e43951078a7c3651e7701d8b3fb1e3787c9e59537fa72bed4
MD5 2c1b120dd09aa54a85a398a5a2bfb908
SHA1 fa3ed37e414088217a69139768a46db93174f38d
SHA512 ba2b73125423fbc8db978dc1924637aa51e7b42e5168f5b028dbd42d254e97249a9d1841895a20f3dbef42fded150b1ec2091c6794d801fb2443b910bf68d18a
SSDEEP 12288:JAwSfxL/2Dc34DLLmt0LDQewsAjo1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSj:6dewsAjpY59oarA4r3Dqm
TLSH
T16F95E031FE75E436C2BF0DB21B35D706182D7A204F611AC3E3A88D9D5A342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 30f3d5cf15c4ac39a3dbc0e893c974e2a6e78fd2a3b6a586e8f8891580109634
MD5 235842f4177102a9887b234036d29b49
SHA1 1fb39b25e09e842411e4781fbe40716b28403ff1
SHA512 4b7a459044d9a5abe36254dec7e453e4dc9b27ebd158b277b3d594cebdafb9102c4f349d86446a95d4e8cab1a654bcefc1bb3115f6cdae8189ef88264513d6bb
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8r:oUEtQevvqc2W1cpV2EI328r
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed0d9ab7878e3ebfd9866a6f4c96024b7e4208b9385afdd02157da235d5c5cfc
MD5 1c6502c5ad23564211b23f297e532e94
SHA1 81721f95e9641fd1a0461194e7f39eea13f66699
SHA512 4f2021556a3aaf878897e65f3fe2e7b8d0a10520cb4a7420b756febf1ba7932925d0db1e89982abbe7a2479bdffd01b6a57a18a5ffecadd7a3abb8ee0dedf3a4
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zJY5PrA4r3:xoqtVjnmkOPrA4r3
TLSH
T148D58D1976B881E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5534d90d238af64d6d9e81db880d9a35bdd58f71999cf834eb864fb11d40fcb3
MD5 75f8c5f12c868abd04253f16b98fc3b9
SHA1 826d5366e03e6ff48331479551f4a99ef3035fcd
SHA512 1bf2307afee5b64d43cd2c386685ae9a064ce129aad1a60b92b6f7f85c0f411b8b5a0f2eec0aa704eed6f3a44af2f42a8983d1d1ab3f7a941102d492124a638a
SSDEEP 24576:AAhGLJIFoiwtA5l7S53EY59oarA4r3Dqm:AAMyFoiq50Y5PrA4r3
TLSH
T17B359D81EBF915D4F5B3AA78A9B69170EA76BCA65E30C20F1160D11F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 cdd5b28fc615a95ba6709ea69cbe606107ec43dd4ad0795fca5523b5dafc203f
MD5 6a929c118b88c1989200fa5303a270b1
SHA1 b9137d6384d2f82e33a8d7cd8a9748eee512ad95
SHA512 b47227f0430f74ca6f091c2a5b18e6a5c1efd8e44242741bf878c5a9076e29fbfc1401c516e05b77d0d617cf96e005ee12ec11ca55c2de011c1c3c3047557c86
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CR1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSW:2wuoOW1Y59oarA4r3Dqm
TLSH
T16885F14A76E90CF9D5A79138C5979535FBB3BC122A21DB1F0360C61B1F37361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 b2168b35cba8af7847c03e9500a601893d9401e4242e764958704df9af99e467
MD5 723df63ef1368dbae8f0dc6222915850
SHA1 098ee5e544f21194e4b0017b7a907448166d9d3b
SHA512 7823e948062800cfc0db7d242b32e54b1e4f5fd09d855f9c368481740f3b1010c02210e4c3641ae85b2a0a67329111471f9cbc9850688591dfa09d68c17d9fd2
SSDEEP 12288:tBZ1IyY1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS9:LZuGY59oarA4r3Dqm
TLSH
T18B7512A92AF920FAC1E7513CD9F02A48EB767867473103CF016186691F3BAD59D36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c80ea2b0dab39e6d93165659a475999ca9cd6ffda19f8434e896d20bd94d54aa
MD5 cf7b779e5c715f3cd7025db02ced69e7
SHA1 e4464335e6fae91599989cffbb96eb660947ed30
SHA512 7206e75d3066e7fd8b26960678702ded18d8566b0f283c41cb98756dfbf2894e613bf91954d467eeb7e54c35730328e0114e87dc1299b0786ccb4979d1c8b108
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3bOPrA4r3:dQyiKayX+PN6r
TLSH
T196667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f5490999429c5d8cdb5f9e0fed11b7cedd45e98788f0f51b6d24abb56b3a0d27
MD5 e0a4425c4bf0bbae08069788352cdfbe
SHA1 eda07c51622ac279ef71572cfb41831535072074
SHA512 9cd0bb7de816da61d15d229fb55e4687d0ef3f2a73d2a7d9fd7745872222d2a70ad8b2c2b11c7e686796ec4ffb794df276cdbaa09e94b0ba1753179b389f19c2
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN3bOPrA4r3:CQyiKayX+PN6r
TLSH
T177667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 03f5c6737db6f9c108bf76184e2d0c4e614638b5dcae5ccfc83d3596ada90c4c
MD5 e3416e47f6c01759691fb9b802c4eae9
SHA1 9a9210858dc3d1a9ae6d6f01859c89ce61cd8fb8
SHA512 32ecf6a6be442aabde815a0202a3f76909da68e9673c539fd1c0873916bf39b0bfc7cb4447881cbb07cd8ea0c3eac29123a17941084fced379cf546aba51fe9d
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02Y59oarA4r3Dqm:d68Qg55nhheWu7PNU3/ZY5PrA4r3
TLSH
T1E9B55A33B2F600A9C44DE1769F46972196D27C75CFE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 095f24224927d23d7f504f13317e9efd02ab73ae3a63616e3dd7cb9ebd3bb4a9
MD5 e4b0f2803bafc94a696854eb24d4c0df
SHA1 69c6c209626b170d1873439d33ad04dbdf0caa7e
SHA512 18ae474be41c02f3abc863616b00a7dd9b2b5e565bf6d192b82404f10deed609b74ca25da8f46a6f717204cc195e31803b714882c6d892fa1fd3f2ed5f313056
SSDEEP 98304:3y5112gYy5azzVvL69nLKnhZSOPrA4r3:KLIHmWhrr
TLSH
T177167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d59dcb458911d9d273a82d73bc1521d0fda9d4d1a9a7ce1924540236a947163d
MD5 d5cafc4cb6e3ed12cf6ad8b538b1ff4e
SHA1 ca7411d8da0f2f4b3e334c44b6aac16c4d72740b
SHA512 d916f6a627b40d0169b245c6cad94c56ca6721d2ca75cf31d6a4264ec628c07ba9e3e03e470b7ec3120f8fb6ffddb9da62f50e191aac2d680f838b60b98325e5
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljY5PrA4r3:tu6JmVxd2djOPrA4r3
TLSH
T143D59D13F1DA01E8D06ED478974A9232F962BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8f0c28261a3f34ae7a3a957e006022d3efe0979dbcbec9007f731a18690a9436
MD5 7a7a54f2e29f48e4a84418532e462749
SHA1 15f5c7b736846664c80a14891c49b91b04ec9b5d
SHA512 e34c2a1a91ec93b5effcd26f6dc718be8315857d7a9c69e6e622945f9c9dbe99f19a54e82838688bb272a23d7faa08bb561559a06721b44e46483b9b7ae68fe0
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4x/Y5PrA4r3:qmifPbRkOPrA4r3
TLSH
T12EB5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 507729532bb6e53319956bff077ce0a1235f72452643e216c8d8a6012acc4e79
MD5 d968e6865fa14edcb785bc56dfda33d5
SHA1 c2bc27e0de323dc10a03b523421e6bd374ab069b
SHA512 471f424826f67d400988311128c086b336eb7820a8e373997988e8733bba9ebbe849e9c88317b995d7fdabb7a179754ab5551582ebdedccd587a05feccc07e82
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqGY5PrA4r3:w5dKTi61GOPrA4r3
TLSH
T1FBC5BE13F2E901E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6739f7994dbb4be643b1a71553411ef59644c8ef1c4f3c423e482d59afb6dd8e
MD5 3d96ba27f3aa020a0234c767c49f9aa7
SHA1 36381ac59fc3403c7ce8d9785e3ddcb0bcf80de4
SHA512 bc85851319016269d9e6a5943eb88de11a38b33ff01149dd3ef732b198b353b93c971f753a2c0e3d4811d74be08c8dc58e616e8ade0e97df8a961e19f411bf5f
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wzY5PrA4r3:VX2iyphAOPrA4r3
TLSH
T18095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 3816208d8102a9dba2fc4ee28d0831662ada53df6b1cb25f557c70a32fff5582
MD5 5faefdb13872a4d4c12d5234b8121a1e
SHA1 530ee4bfd788716570509f5492d63333fdb231fb
SHA512 e300a12d08374d02eca5ffacfab4b4cb85d96c947052cd5cf0e1f271e72535e1debd901ddfd2d4fe579c79e0e49ea3047366b84f6eb546f4940b8aa5bcf2ebd8
SSDEEP 12288:dL1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSH:d6Y59oarA4r3Dqm
TLSH
T12D7523EDDCBF19DBC1986574F2B035883C2E6F6B8D20179201939518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 7440478558d7fe4990e53bbbe76d5026cd1c1b0f4ff929c79c40c368794c49a0
MD5 67332e6aab803b7a2b95cac55380fba3
SHA1 7c0fae1fff20739688f14d7b1479ecff540792aa
SHA512 8553a64b7463e3bbbde76d25637a2224857ffcc2a1da4fc58361fcb39587d5681992f3894a8d0beb287023085cbcb825b838bde78401a1bba2a07ef379e8d29f
SSDEEP 12288:wU1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSH:wtY59oarA4r3Dqm
TLSH
T1F37523EDDCBF19DBC1986574F2B035883C2EAF6B8D2017A20193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f2d072c97ade4d74e88ad1a184e371b515f67643480e77babb1a0b685beb3057
MD5 8954b9697f4dff42cdc405aa2b093ea2
SHA1 cacf23614866abbd393b5a0fbda0eaa463d1f988
SHA512 4470113f76415780cb70358a3cdceee95bbccb3a3caf03ab1f438e363db1e371cc39260e8fb8511297281ff2e76c34320b728172e0dea94803fdb6b5975df3dc
SSDEEP 12288:gO1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSA:gHY59oarA4r3Dqm
TLSH
T1517523EDDCBF19DBC1986974F2B035883C2EAF6B8D2017920193D518173EAE5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ee6d43da368a092797cffe2eb5dd01774680518ab544a8e2d9f75bbe7f3236c4
MD5 cb166c5ffb775eba3f508cc6504f7e5c
SHA1 6dfd021409f1216317ab3dcc1c469ccc27ba8752
SHA512 32895390e358e4ca726a74b7f08de1ea5fde424c0356b95e3a99b801f5f76d2a17928b8ab227adfb0a99a87fd507adaad248489cb943a62e06409fe7201e7ba4
SSDEEP 12288:RVV1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSJ:4Y59oarA4r3Dqm
TLSH
T1D87523A9AEBF15D6C0A9E534E5B03548BD3EBEA78A3017DB024249190F3E7E4DC31971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 2f2298aed73b201a5b838eb9ae000a9acae8cf6a9fc0432a93cca11254f8a5c9
MD5 25e5371fd29ef630ebe23e0b73dd4241
SHA1 6bfb5dde078ba2d3d8365148b2f2c256e6109275
SHA512 d4fac06354f82e69ba638347b1da329a68141311293f8204c4ee47c994daab4ec040f101267af3e0a638efa8f296b2f6157d0ace8fee583e031c1d758c09e574
SSDEEP 12288:8d1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS8:8cY59oarA4r3Dqm
TLSH
T18C7523E9DCBF19DBC19C6574F2B035883C2E6FAB8D2017A20193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 0aa8cf2dd5cd809e1db47405151525c8442dba9e379bf4b01dc91ef467f06e30
MD5 935fff08e0fc9a7b8c200a5eca360805
SHA1 8fefa74f442141822250cdaf47fa804f3c499de2
SHA512 c77b05e2084ca275c86312d8ac9d6736eb7ace4f4991ea9b0c58de8254d4cfbd678d3daeaf9ce2ff846b6bdfea0fd645f2c78e80ca4870e935b045590e77cbed
SSDEEP 12288:Ig1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS8:IRY59oarA4r3Dqm
TLSH
T1407523E9DCBF19DBC19C6574F2B035883C2EAF7B8D2017A20193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 a6005bc99a33d17097c80560a1054b92524e68a43aa1d54d29a294aa89829d0f
MD5 ca3d4d123d811c472f8b27f7cafa7c7f
SHA1 bb4c0f193e0abe8dcdb0b80f3e82e4117514f0a4
SHA512 da239460f274a08e519997985dc367118359f46e68ed72778ad24b9542cadca341ed0c04d58636b403dbd1f51ef65b34afb8f61b4bb09e7bc4b682c1383b4228
SSDEEP 12288:nc1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSp:nlY59oarA4r3Dqm
TLSH
T1897523EDDCBF19DBC1986574F2B035882C2E6F7B8D2017920153D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 b73ce46f9fedb93e649e7e077d9e9e6775c62a235e2e3ce99235b9a3c60d2c5b
MD5 1426f0dbbc98f6e76b5b1957f084e3c3
SHA1 ad436d9b5779acc21d1c3848e24d02faac5ae007
SHA512 c2a3931061d24728a1db18a5ad63a653854eb0408b3703580777e73c061a202f37a4c0f36122c1c0ce94a03f52b8c6a9a64e61ae8e6fcdedd1c80c92632cea0d
SSDEEP 12288:TiZwb6zzFEoS2cPvy01gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSe:+ZMSzFVSONY59oarA4r3Dqm
TLSH
T1A08502A5B7A118F8DCA7813EC9615905D6B27C6A0B70C71F03E4362A1F373A15C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 572062a37a784cd2674933aa555dc026a43dbfae5c52af8655bd0657262b9bab
MD5 3d98d151dd3869eedd800757dfe20a02
SHA1 748449042c8a004097cf5df06095a5cdf97393b7
SHA512 dce748506886802c5db092de502bda4fbfb45044c6dde729efd74159ab053b3728302eb1b195f2d6b86c8c442150c5fa6d7c56f6e650f1fc848ca7ed2e48c569
SSDEEP 12288:o/1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS3:oWY59oarA4r3Dqm
TLSH
T1CF7523EDDCBF19DBC19C6574F2B035882C2EAFBB8D2017920193D518173EAA5CC668B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 826f59b92719596c0da8ccbdf8536c3d1b7e5ef50b208fe527c21e0fc694af03
MD5 323c04aed65a233a88b2c44863b4041d
SHA1 4d9382972be54f6fdbeb7823532df104e5b30831
SHA512 105270149aaf2204908468fe969cd3a5ada6e11c9dcfc82cadbfc4a7e3798895298d91a49120029d3618e70f410ca6d8789460866f3d7dd89c38484cca9976d7
SSDEEP 12288:fj1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSJ:fiY59oarA4r3Dqm
TLSH
T1B57523EDDCBF19DBC1986574F2B039883C2EAF7B8D2017920193D518173EAA5CC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 29b32faff371cda1ec6cb2a24f57be9b51859f4a3684baf6f6883320d10789f5
MD5 c5ce085816044e28771c95dc2f77c16d
SHA1 92901d3617a934d69ac6c10f0d70e42a27dd706c
SHA512 5d4e0b9d482ed75247bbeada1da6521495ab449ec918e94102d5a410e0b4d1aaf1cad985b571416da2bc10fd42b418c644accd272d94d5ead8a4c635b74b4c1a
SSDEEP 12288:kyPz5L8Y1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSu:9zy5Y59oarA4r3Dqm
TLSH
T1D685025776A630F9C1769138C9A11A05F776B8374B204BAF03A0477A1F3B6E19D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 d6ca6d377bab7d2e1aca055f9d09753bb9ef447296b06650c57c18e1ec695fbb
MD5 c57fd8279a8bc5f2674f46b175754a65
SHA1 4711bbc5305d7edc77be73169a727d4cc02f6d41
SHA512 2027dc7ddbcc556d84c8d12e7dcc185776b37bb3d1fe917f9e2790a7ca37d9079760f2dc806f69cba2e5d6b5adcfdb2a6faf53c8bc5fa036b01e7a587a149556
SSDEEP 12288:4/1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSY:4WY59oarA4r3Dqm
TLSH
T1707523EDDCBF19DBC19C6574F2B035882C2EAFBB8D2017920193D518173EAA5CC668B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 1449ed0829be26e5af32513bcad5f1bcc6117718602281ad513e2a94ee1dcbf5
MD5 966d7ef7e938e6a435e4772f27c7cf20
SHA1 0dc80eda7f6454935784f8e598ece974a83723c9
SHA512 6460f06262d884c37e2aad3b4fa9c4db67966ccbe47f046075e2e441673d168b067136c2f409cfe51b88d7dd677329846096d571ed1ca4fc8c133b8b51aa2064
SSDEEP 12288:F/1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSY:FWY59oarA4r3Dqm
TLSH
T1517523EDDCBF19DBC19C6574F2B039883C2EAFBB8920179201939518173EAA5CC664B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 81ac0f3f357b48150a6acb3a34cb5fa77b463c60d0c8f12cea9c5b11b45c8a45
MD5 d3b3a0b036cac13eee1aae67362c384a
SHA1 1e57f398c463e8084dd58c37708e9dcdc5e3fb16
SHA512 9cb33409c595856015bd6b74828269c68ea2699ca245efd2e3c48829e39b774e6b1f1e72cdb21a07dfe7b23cadac13ec65aa0040cb9a97fc48949cf82fd357e6
SSDEEP 12288:/yPz5L8Y1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSL:yzy5Y59oarA4r3Dqm
TLSH
T1CF85025776A630F9C1769138C9A11A05F776B8374B204BAF03A0477A1F3B6E19D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 93dce151a312e51d3c0bb82fdf95b11b592b4869ea2ec64e2c4f73ca6972e643
MD5 444ad9937bcc62b677a4f0c3d38e3153
SHA1 6ea6bd7f108d98ea5233abe9eb1e1eace4aff234
SHA512 5a0d38ebd2d6cc7484f9512a61d6f419f180f3b360044f7f4be91ffa58f394a6e880e16288b70a72a4c638fb1ceafba1af7d73e0e05f112a136091d1f8af5382
SSDEEP 12288:tCd9eWYoaLHF3z0z04PDvhe1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS2:4THaLl3z0zD3Y59oarA4r3Dqm
TLSH
T1E18502A8B3A118F9DC67813EC9615905D6B27C6A0B70C75F03E4362A1F373A15C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 0db0f214c2893633bae7cf1b26b959c74624f0ac31b84bd1d49b49fa6ab30f7a
MD5 3c9f8a90714cdd4a49b73e9a515c9b1e
SHA1 7bf399bffc69bca5bc363d671fca896499b00ee7
SHA512 aa80f8f0d088a735f07a87fe7e4c63f7717c78a739ddf6af0572818b1af4ff9e6f0ca58f6bd261e11f1f276a678bbc51c539954724bf0520088c94de10fe4d12
SSDEEP 12288:Mi4e7+RdTfgwCHKy7GLbbdIvZ1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSK:M37d9CHKy7GZ7Y59oarA4r3Dqm
TLSH
T12695CF90F7E814E8F0B79A35C9725501DA767C6A1B31DA8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 619db392586cbdda1306b10b849605bfeadd570d5717a6d1266a3685d62b1179
MD5 5e1885ae5537c7644878f8abcd2fe183
SHA1 6a3999bf5005c0605b46ab0ad37bc6d091f5c8a3
SHA512 834684a2d496e31cd349b5f9980c7d0d3274e64d7aef8d086efa9b9a4682646ef05419d4f6d8b23dc64fbfa4bf26b00c8de4ac7258c895acdd34ff1e40d458f3
SSDEEP 12288:Pu1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSSZ:PnY59oarA4r3DqmS
TLSH
T15C7523EDDCBF19DBC19C6974F2B035883C2E6FBB8D20179201939518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 456c056a332e0a29014ccb3684730060353885384db822e714248ff313482af5
MD5 8adad9e8a1f41549225e36900d679e27
SHA1 fd467fa614632e190211ed4fea94ea431c0c885b
SHA512 8da5abd7da9f2cec3bb7b00567a2d2e55e867ca297b32dcc450aa2bdb1ec576eebdbb687f709521932c73e09106fb148bdaac23767aa4497b1ad3af0694be34f
SSDEEP 12288:n41gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSSR:nZY59oarA4r3DqmS
TLSH
T1547523FD9CBF19EBC19C6574F2B039483C2E6F7B8D20179202939918173EAA5DC624B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 3724c5f078b2ffbc79e7057778d64a77c9c2e51b5ff0973d199f3bf241dce0c3
MD5 9e0fc6c47a5a1e92a703fe162d411ea7
SHA1 3cf75f206154c7011ca54f5d8a82e4f89344efd9
SHA512 02eda62ced38534b5974b7b8399fe2abba8d3863936d949664100ed430db012c876e5d23538565ced130373a9e0420a9048afbdd905c806bc7153d82619aba13
SSDEEP 12288:6Z1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSK:6QY59oarA4r3Dqm
TLSH
T1077523EDDCBF19DBC19C6534F2B035883C2EAFAB8D2017920193D518173EAA5DC664B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6835701605ac2668af11220643cbd03d50679fa233dd3f2191c9a4c9e7bd7568
MD5 a9080182641c4a4a08d38ea0b15b47f4
SHA1 99fe1a13f9b28c9631779ebc7b72de0840a34540
SHA512 9af8de996750eb4d0e6022ad0870c0bf130bcc9146f968591f142d095297229dca9075e4b71ccc018da8ae0b6cd26925f9a98eb4c486dc6f624255faa32260fd
SSDEEP 12288:u/1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSi:uWY59oarA4r3Dqm
TLSH
T1E77523FDDCBF19DBC1986574F2B039882C2EAF7B8D2017920193D518173EAA5CC664B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 b0449be55c7bab9656bd75fc0af35ad910128be9089169962a046e335158d55f
MD5 bbec170d383f3a4dbb66919acc3ad85d
SHA1 71918d45142126c6577f585fa04fba8470b22a20
SHA512 0192cc1b36f88a4407c095964821b25399f5d12edae94951d71e29a3f49e1320c1d27d03ff6139ff9b5b24711be48169cd2ba9a9466459cfef7693cfbb8b6e5c
SSDEEP 12288:Uu1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSi:UnY59oarA4r3Dqm
TLSH
T1657523E9DCBF19DBC19C6974F2B035883C2E6FBB8D2017920193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 ed47bcedb466888daa021388bf06283050a1e905e0a33b4fe1b86a1f44190ce1
MD5 eb60fc602474bacea830f98ee4725ff8
SHA1 47de6d6ac34e2bb4b68f888ca1c0c6ca50cf0af2
SHA512 330d912c35669a939f1af2a732bc2985766f65143a3f14de91412868f882dbd01613a5d1c2e0319f10fdc85b20d5e8f9f219bd2d9f5e302796c9ebe51d05f116
SSDEEP 12288:Nn1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSG:NuY59oarA4r3Dqm
TLSH
T1E47523EDDCBF19DBC19C6574F2B039482C2EAFBB8D2117920193D518173EAA5CC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 3a5b102c5ec10d343edacd7fc1f100ba73b7822bf469a91b395856bff689fe5e
MD5 b5e231e4395cdc2080a524f95db88bea
SHA1 6cbf2187badf7f37ff9930a53c0fb69946bef207
SHA512 99495574c9b935a8cec10dca47109d1e6d9d0de0e7f25106e84e062ec9236ba42c17d8dbcd3bcb69c230bed78933b79765b318bff930f8793c48395fc9246ea6
SSDEEP 12288:td1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSF:tcY59oarA4r3Dqm
TLSH
T1987523E9DCBF19DBC19C6574F2B035883C2E6FBB8D2017920193D518173EAA5DC628B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 73577ba509fa6b5fdb5c902a396484cc228a13de7d40e86763fe2506f4bd44c8
MD5 960bb90b4066258a843b47897e7ceb9f
SHA1 9cfb708e17d50861302d1bd2216cf6f85d2cfff9
SHA512 30abfca724c748568beb9eb6ec980caeaddf7892c549617f837f7b722725c99b0c8bfefdbec311f4282fbf389b0c46a898cf4459a39b244bd47e0132787423a2
SSDEEP 12288:ofwvD5uX64Lk3tRX69qkyAI5h1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSr:ofwvok9RX6wkyAIyY59oarA4r3Dqm
TLSH
T1FA95CF29EBDC04E5E1B7923C99B3460AF6B178691B31C6CF0296536D0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 932c04e82e6dcb2eac57f3b29d27c71424a60542a23e3b222fb034b12f66e569
MD5 483829e28b0c911e2a388ccd76fa4698
SHA1 99b443714e3206f9be5e95bb1e67e1a20ad3e3b2
SHA512 e6180422e02f51ea588e63ee5361a85e492b379c015cebedd778ff83610e542847ad11c8fda1d804e4584dbda185a65a47a330723fa5fca10b7e3537909fdd72
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TY5PrA4r3:yySzP7OPrA4r3
TLSH
T1A6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b2e450d905bf6df55c96bfe4d88cfcd7d69e1d4a4e5a2828bd64c487719aee9d
MD5 f1656099cca8b6c7ffc2c14231f30ae2
SHA1 8e2be250e06aa4331a50f2e0a15e5fd92e90ecdd
SHA512 9704202ce27f096d0ad67a08d3e0bd663a323ff8948e49529b23c633b671d3212661a07d8af3b581366fbd63db901b70c1c82d17f7124e3baef1ef6d4479f5f0
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYdY59oarA4r3Dqm:o47JUQj1irIhCnDHUPfF/jY5PrA4r3
TLSH
T18F65AE1EA3EC01E5D1BA927885154A5AEA71742E1F31CACF1270837D6F27ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f2ab8b6f35dd76d467c4c12d69e3f3e04c8bece7959a83ea7706ad60f5ff56de
MD5 1dce0768340c430f9be058017a8cd422
SHA1 9d9f37e643ee80aef27f162f46d71d2e047aa003
SHA512 57d5a5785aabc5f5e37e45e86a453a647d25efb242fef478383f42e590b2cf12a8ac681b7cef6054d0c5ca39427b2612c164869f6661b1e6fa12b694d095502e
SSDEEP 12288:nNsfP1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSI:kGY59oarA4r3Dqm
TLSH
T1A4750159D6A902E9C0AE6139D7611A40B7377C6687F193CB03D0F53E1F3A6D09CEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 964KB
SHA256 7d51535abacefef34cb1f6cdb8af0857a67d7afcccbcc9b01ae5698019b76d10
MD5 32b7af2c99f6d859edac647c9393fc87
SHA1 386fb8e0e1d71067dbbd6f621cb02b60d2824314
SHA512 bb37cb6f1af7f3b6e5c58e9f5b66e0ae841e0ef8fff305c253d5fb6f27ac7881a426c7b473cb0e0f2988926319be517c2276dde4dc1e82fc8959672ff4fcafc5
SSDEEP 6144:FXsBC2naqSgvV9D7EUAELp2CotMxLnMcU3ftkhce1gMHudgIu5IwuyG0DpRKI/vL:Fodq+nU3fUx14dsOwRFRK5RQGXUVzggn
TLSH
T12B250750766BD75FC6AD40321E32C1CCAB707D41EE459B1372C88B2FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f87737214d8d06f47d73157bf11c5b2e1bf12cbd8744a34c75133811c20863d8
MD5 dd1ebfd7a0ad625b4018a2ae19b4acee
SHA1 1b737739f7c881ac6b576008414862f8f63217da
SHA512 0de58bc8a9fd14343e72344ddd7b052975ebecc7990d68f6a9957166d7113b88505952a5455b2ae36bc6ca04300d809076ee6b4f9c3bf3be126940264169bb1c
SSDEEP 12288:f9LjupsY/YHf/jhZc7nS1T8eF3vA+8jT2JhDUut+GUeZ5dKCL:VLjup1yd67nS1T8eF3vA+8jCJ/djL
TLSH
T10455A6816437A3CBD1F76032072A5B4CA764EC47B7496F26B3C4453AD82AB25B0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 7719c944e2938b2365742596c9cd176dc81401c31ee495c5f83837628d6740c8
MD5 8af25829f0be3e3b036f3f7dc275c438
SHA1 dd159c0e4b168a3121a339b01e033f81334efa88
SHA512 c9dce342c294c6ef79127ff375f076698dcbe8c6d307ebd66c53198208e99e52abdcbc05a6bcdb8d993f0693f928cd7f59b3ab9b504516d7b447d0a48ccb5297
SSDEEP 12288:AM731gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOS8:heY59oarA4r3Dqm
TLSH
T11A7523B9DEBF19DAC0BC6934A1B575083C2FBA7B8F2016D311429618273DAD5CC72876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b62f7c3c5189a73c31ba389f71ecb3b92a93bc368fb4e0010a26f3df25cfca38
MD5 7573411471d529984b866d788cdd81b5
SHA1 327e9abf9ee457d57dbd776cec26b8d8840fa344
SHA512 3ed763239e31391553bcc0db6369589b73ba2109326ea585db17c653850f8dd9110a7902171f7e80f0e2bfd9dd54ba9947d64033a80e2cfc741914e76899cc16
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYYY59oarA4r3Dqm:/gb4mBIBhGFdY5PrA4r3
TLSH
T171659E1E22EC02F5E0F9E2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 bddc4ed85d047338b63bd052929ccbfb917577402874ddbade14338f07125752
MD5 4781c515045fd0aee0f38bd41a94c635
SHA1 89df13ac3f69123c06e06ac7b55d3f839c13cea8
SHA512 88360b07e439c92e133c7bd7f5d1680156d12db32a01b74b1422d5b6a30d2fa71e6d6f90dad96b209347398c4b229d2b21885a341bc33c1e0aa7b34f08c836d3
SSDEEP 24576:+G88u8FpJqH1bzria7/mNY59oarA4r3Dqm:V7ZFPqVea7/wY5PrA4r3
TLSH
T15DA5F16576E501F1C47BD13889924663F6B2B8260320EFDF07A88B551F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 472b112ae16e61d1d005171b006d9b23e5b3fc87709b8e72df823cefe14f23e6
MD5 2814f3242962ed0de4b7ea9cc89a49fd
SHA1 ada421f928b71923767e92b1fa5f782a8928b0ae
SHA512 1f11cead32e0cb029e78702eb066ab4c5f4b08c10f7eb1568ac0e25a6c70040479706875ebcc7d22823bbd7fce01bdc3ed50a7d1683e575cb3bfcb386ca8a3f8
SSDEEP 12288:bHvUrBFrEjwaQQ1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSM:bPUr+NQhY59oarA4r3Dqm
TLSH
T16785E16F66ED18E5D67AE17C85925609F772B462071192CF02E1817E0F37EE8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d10b75f3d0e6ff304a1fd833ae56448775e385516827cc30779a0163a6c7acb9
MD5 ec900f2aa7f6fb2995e1efd26693b729
SHA1 9bd2b0c70be41ddc2384f71b5d27edb4aef294e4
SHA512 ffa17dbb0b0cc62296a6df80737699f26d25115ef5f894d1f585b461d286853a64825d6c5b432ec91038e63a575b2bc4565432eba715d9e7dd7a96c47a9df664
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRY5PrA4r3:9G05lO43bKOPrA4r3
TLSH
T1F7D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f55c41f8c65dffb7e4115131ef34de281af585c3137442e94d19603621823a70
MD5 987b6f860e2e6ab6abcf78583933b83d
SHA1 083a31d0aaed41fbb30aaffe4e8ea72eebade46b
SHA512 b9c739e7062b283bf25854478c23ca3e6316174914910b2944c16c168f6fa9ac8ac787694c1565b1728ecedb7331300331cd09055a11d7d83818f594539b9f23
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTY59oarA4r3Dqm:Ra5POZ3+Jt2pasx2+mZY5PrA4r3
TLSH
T15665BF5EA6FC01D5D1B9D17DC583461AF5B2342653319BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99ea31af3e4af4138c9bb8fbbea190a09e11a1064308708db97734777c155196
MD5 272ddbc8e32cebcb78fa252f40540124
SHA1 39f0cdf1270a3e949fe461f1510745bc47f9d411
SHA512 5950dbacd760289b8643c07c0687f0c0f6fbdf843a8fc5fb880f50672ddea4d97c0cffe4f138148d57aacc28c2a49598b6e2ae819967a9da0dcf590877d03d0f
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkVY59oarA4r3Dqm:ANc/zEOVHFQY5PrA4r3
TLSH
T1E5858B6622E901E4E1BBE1BE89779546FA71786513308ACF0291851F1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e1009da693717fff212d8eafdea0b0114694c543fd8710dd991523547804a5b2
MD5 1cf94209e8bee6bb9af8e5f3f6ac3d7e
SHA1 bfa8e80991d48c0104c98f17ef04d440b7966454
SHA512 6b6b81a8f47239b1c1a5b1ae268732e83fccb701f1cac7d93d012f40f1ff0d5507fda233c2b4225755c310522ab951742ae45e54b3bdd473e40614fe7f18d31b
SSDEEP 24576:a8kNvNnaFeYhJNtmZBmvY59oarA4r3Dqm:a8MwBtOmvY5PrA4r3
TLSH
T10A55AF6EBAB806E4D1FEC6B4DD238512FA727461073253CB5290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 940e3a7459bc3e1ae1d6d86c27bf612487e1f8bb7dbaaea38bd6bc4496af5523
MD5 08111fae23b1be4e25c8542c0fdfa083
SHA1 436d3f912d921588cfd74f473df0b3269b684bba
SHA512 da311b9a0fa61778856d09be5e4ac84a3e3a152c5bee1a6fb15850b1698e295aff4adebc9bf73c93897c73016d02c22176c5af353365aa504aff4be0190f2c10
SSDEEP 12288:OQcMxWDXN1Dp/fshBItT1IQgAr1gZBcfB0zGoaZ0Rd53AA4C+aWDqPFjtGlOSD:UD3FHshBIYQgAaY59oarA4r3Dqm
TLSH
T1D895E17DEAAD04E4D57AD1BCD6634A06E77238A9033166DB02D0C1B91F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/264-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/264-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/264-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/264-328-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/264-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1144-314-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/1144-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1144-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1144-112-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/1612-51-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/1612-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1612-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1612-38-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/1612-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2016-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2016-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2016-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2016-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2692-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2692-53-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2692-276-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/2692-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2956-86-0x0000000000400000-0x0000000000753000-memory.dmp

Download

memory/2956-0-0x0000000000400000-0x0000000000753000-memory.dmp

Download

memory/2956-1-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/2956-8-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/4340-315-0x0000000003050000-0x00000000032EE000-memory.dmp

Download

memory/4340-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4340-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4640-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4640-132-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4640-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4640-126-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4640-137-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4704-76-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/4704-77-0x0000000000B20000-0x0000000000B86000-memory.dmp

Download

memory/4704-82-0x0000000000B20000-0x0000000000B86000-memory.dmp

Download

memory/4704-297-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/4792-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-312-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5048-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-20-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5048-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5048-14-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5048-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5252-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5252-291-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/5252-64-0x0000000140000000-0x00000001402A8000-memory.dmp

Download