7ecb10d464015e980cfa58db70dc3f62331c6c4762c68bbca0737f2556557a86

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260815-e1bcgsyfkb
SHA256 7ecb10d464015e980cfa58db70dc3f62331c6c4762c68bbca0737f2556557a86
MD5 0ec666cd295bc31e7d4fa768fa4d4752
SHA1 f0b310431fcc84b36af5a6d11a982700fc28d627
SHA512 c1aaa987d1928a4a897b482b487282e1868458fc289b850ac2ba9b416232b9c3be47ff1d952a22b40081f452c7fc3cfd8c6905eb72737e57bd80bfe36137df00
SSDEEP 98304:crQfcFIADntcff+YwbT1Ezl/y7wRGpj3:VcFIAztxTizluF9
TLSH
T1D106B013EB81C071E992013E85BAABBA9D7DAD105335D6C392943D148D736E2E73A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4152	elevation_service.exe
5172	elevation_service.exe
3708	maintenanceservice.exe
3804	OSE.EXE
1692	PerceptionSimulationService.exe
4676	perfhost.exe
4596	ReFsDedupSvc.exe
2984	SensorDataService.exe
1924	ssh-agent.exe
3420	AgentService.exe
1788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\21238187957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007be678f16d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000984661f16d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5b195326e2cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000811981f26d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b44e70f36d2cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d1df85f26d2cdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3420	AgentService.exe
Token: 33	1788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1788	SearchIndexer.exe
Token: SeDebugPrivilege	4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	4960	2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	4152	elevation_service.exe
Token: SeDebugPrivilege	5172	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4608	1788	SearchIndexer.exe	101
PID 1788 wrote to memory of 4444	1788	SearchIndexer.exe	102
PID 1788 wrote to memory of 3728	1788	SearchIndexer.exe	103
PID 1788 wrote to memory of 2732	1788	SearchIndexer.exe	104
PID 1788 wrote to memory of 3188	1788	SearchIndexer.exe	106
PID 1788 wrote to memory of 6344	1788	SearchIndexer.exe	107
PID 1788 wrote to memory of 3796	1788	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ec666cd295bc31e7d4fa768fa4d4752_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 662fb70455aa78e81927828fb2d20de935adb8a1b07c5988c1bf8d0c575e0cfa
MD5 960a552f176b49faa44d62765057488b
SHA1 02eca49d986dea1505cb6e50506ec32377bf222b
SHA512 d81ef6fe768588c723fa4f09cc2f87f91bd882bf1fa01006ee1b3b04bb920f64216ca3f19246d50f8da313711de8c735db4fcf51ba0489e94c988317d3fea033
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnfLNiXicJFFRGNzj3:R3q6sjBw7wRGpj3
TLSH
T1E7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b3e7056d97ef4e0d53e7e3ad0fd4e8ddeefb8357ccc8229e1f4e6806604ddd74
MD5 2a60cadab67ace4198a5d36192f597cb
SHA1 69d5d0ef19062e9b75a0d0b8360a7fc8b858c006
SHA512 b6f265b200d8689d9e99ea2e7097a6c04599b7af7bb77215b5571d1a1b6bbb22cd7e333494a06ba01ef88fc275d6c454943df820fa72cce4c9571c8ba5c85d18
SSDEEP 24576:BXYfDtczA0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EtclLNiXicJFFRGNzj3
TLSH
T1E675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 78cc5f957410af4b0ab39e14d3fb0ce21b50ecfba5910474af6f8b49ace2a9ca
MD5 3f40503cdfaf845ddc5b8bd68341a2c5
SHA1 23fe60ea4c6a203ef52ef1312bb2fcc29a7af10a
SHA512 540a67767ee4c60171d275e04e4452002d374f3265b5c45877a58c15f825c047b5100efa920b44f33a4d8eca653b9eb4be7274405888351d02a97289a2ac5782
SSDEEP 24576:p0Le5ji0hmxxrMX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0AjeLNiXicJFFRGNzj3
TLSH
T187959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 42c40305bee4bd175679ec44ee0dc4b52d21c34ca487d50807ee12d90634f76c
MD5 e14897335b48b90115ff5e92213f32cc
SHA1 4d3762fbf3b75dc040606d1d1c5a916e40b67132
SHA512 64588858c12f23cac5c58df10482cc65163e8e2f0fb2b8649944de690b2c52fb0ba1798fda353db46c19736532130bfcce66e5f7698699e0613cf828ba76c048
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J/ezSC6vUzPveHjySLNiXicJFFRGNzj3
TLSH
T136756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 23e1304da966c6b439c9ca16029ba95f863e9d510677974cbce8ac584925dcf8
MD5 e2fd1d25f35644b95f11a624b65be905
SHA1 cc27d3332103d44b33ac3bdc0b57b3afff5497d4
SHA512 ad2f1b0f991f3ef6ab5e484d37b4e23cd3f18da1dc96e9be301e79de4df2c46a3bab30ada097b3551ee7e36a1548b6a15b4aaeb86aef73091eff4ae113ef69b6
SSDEEP 24576:GVbqPb88hv/l+YA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GVO88hXl+9LNiXicJFFRGNzj3
TLSH
T1BF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 01923ff1840308ea844e278b09adb32f4581af5dd2dbd912ecf9447b52e5588c
MD5 bc1f48453c56d4d3d71bcd2b4c36c58f
SHA1 77008ad2b8a729501405367374c97b2a0086dfa8
SHA512 8be0560399d15aecaf0a745d85cde96b651a3eb6014126aa287fa822ee6335d41ce2a4341bd288597b40853936b42eedf6cfdd49d5adbd273f9b6347caeb4cc6
SSDEEP 24576:eLj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wLNiXicJFFRGNzj3
TLSH
T1F35523D3468854B1FBFD003A867A5828F5845E2C9A555DE2D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a2193e4627cfe6972149bb858188951b7066e9a967df5bbfb41572fec6a1ac9c
MD5 3d149e0f61584bf6df08c97036bbeb72
SHA1 4ec5d5c2e52e0caa66add95239150c831234f20a
SHA512 ece9290eb738fcbcb0076a73fbbcf9bd7d46a1af8f6a948caa306a4331cd623345f0b7e031e187430ca29924bbff02525f01648aa04a405103c83e39d7b31548
SSDEEP 24576:VJIUY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VJIUYLNiXicJFFRGNzj3
TLSH
T17E75CF7BAE28FCE2C27E4C7957918600E76278304F6293CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8efd842888b89ded32a79f23c9b4eebfd1cc9137135a06bdd2fdf533ecc24116
MD5 a21ff7e8ca5af2ec408801f2ae3b6d90
SHA1 9436593e91127e029deeccb4bc42fa79e8558958
SHA512 af16f0a5e622068a227631e31c50696d1994e2aaabfd5d8e0904b320356250a9fc36fab762de58b90746a465221a55aeac9219a3ab4614699138553eed4384c5
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:mQvGAdlCEL8c/DRNw5CF7wRGpj3
TLSH
T1FF266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 824ef9f040fc135e6ed0e135bd158f9fa78a1f3864b8719fa8db04743cb363f1
MD5 3a4240950cc20d43bc3f1d0e3bd60ef1
SHA1 31b013adf396fe7f0d36aeff46e1e229936d2615
SHA512 4d115436c568ad9050cc8c3f72200b0d566d1829496c36b07f91273b0369627a64da9d11fccd12111decb197d3456a5d78bf4ba551c1a62db3496becfd2b218e
SSDEEP 24576:d0ewsAju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GljuLNiXicJFFRGNzj3
TLSH
T13275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed2bdbd9508b0567c37549a279439c92908367dd9664c9c6ab5dd6d5b31cb377
MD5 80c28c50dd36d2ba86f32005a7068a71
SHA1 b81ac214d8fe37609626cc4d4798c35732bed951
SHA512 f9f8975488430cb0bc94d318f347f8ba9b9bfd8a0fe2c6bf8caf0f7f6d792d31973eb77250318e1774407cbb6155cc09ba5c1bf582040d217726c7cba2524b44
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6F9:tUEtQevvqc2W1cpV2tI32+9
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebe2be6ae07e5288a7f75ae094b765c93bd3d6229b1745371154dbd51c25d63e
MD5 ef2105125eed2e887dfa6f89f8bcb323
SHA1 e5fe00949c968cd1960d6036b8567b76a4688c76
SHA512 dfd120339f9de3c6df79e628ec905d640bac73185d3a317492e6fbabba9c028493dbd6dce647c67462899f9ca3d545ce2766daea2b9d4e5f4b72f58160cc7a55
SSDEEP 49152:yCbRquA/m2yL5zifFiV+XenmE3/zOLNiXicJFFRGNzj3:XoqHVjnmZ7wRGpj3
TLSH
T1A3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 598136b6d537c9d01f800e8fdd1bfa283f9692ad6daeafa182d0206bad30b22a
MD5 4a783e3ccf93acd493c2de7b5897f38b
SHA1 df77aa8cbb5ddf3a889709f13a183fed910664a2
SHA512 4488b6a86bdea1daf298ca9b692768f2a2ffe6106bf002b361bbeeb7cda4709f3b8c85aebcb241b7dc84a3df59bd7066bdd67797ca466f0afbf378eab11b13e4
SSDEEP 24576:0AhGL3IFoiwtA5l7S535/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0AMUFoiq5pLNiXicJFFRGNzj3
TLSH
T10D359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5ba5af94d793468685242edc9bcfac6c0ebfa0181409416d3610e9ad5ef13dad
MD5 350cffad69ee388e492b552af81807f1
SHA1 c3417b0d3d1a1b53758bf39dcaba40ade7d2e4e7
SHA512 1501dedc37857bfb2914807594084aa57516e070f3d48c1c26876027755f3e1a4f09402a89c38429a3b2ecbee80ccf0bb05d60b3c01993eba75453be48f088d1
SSDEEP 24576:Vwu4OWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VwvOtLNiXicJFFRGNzj3
TLSH
T17775F08632940CF9EABB41398657C035F7F2BC152A21DB5B5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 28a23e590287ac420d76c315ac5f50a1db676c43aa85a8636430e452dc116ede
MD5 bfcc2a2e68ebe64b790248aad730180c
SHA1 c7393e5ddde560b445ffb4d8c0217b12cfa50347
SHA512 961b662bee7bd361f87652839397052b8026ea441be112a13b25943b8335f15aa2e3df670b463126d5ea2cc7cd7c65e48c72a1736f8d33b9673f38fa2185e5f5
SSDEEP 24576:7Zuv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
TLSH
T12765129622C420F5E2BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a8fc252096e4728a8d1d259270bdb929f55d9ca1c8443b83382b3576ec40533d
MD5 36b620a6a3b7f78b9fddbf9bd80a6a1d
SHA1 3891ab4f1d63b54ba1b7f3f9f148b2ff4f2ab504
SHA512 ad0ed9f2c8dddc645d39b6a217aae18b78c04ac9e848a082164d04d4985fb4e045ab09585037393d33aeace390c8fedd21fe79a32a0e8d6d6beb56616975a816
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3M7wRGpj3:mQyiKa/X+PNYF9
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d97bf84956fe56cee8f715b7bcfa6127f584286d3fb06c530a5b5ac2d13d480
MD5 6f898a6f8641ee66fab7e9fa79c12db7
SHA1 68a3e3991e6f2ec9bf33e500ddb94e13aa95974f
SHA512 29da9cbf0264fdf2042e363f000e6e08f489b4dab3c86107b035b3e258eba870a3b8845b29778b7da2b6127086feb34dcc073cfdadc873201a027774ee184fbd
SSDEEP 98304:XQRQyi36YOcPbLvw2gAf+PN3M7wRGpj3:GQyiKa/X+PNYF9
TLSH
T17E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b49046602d7ffa219ab209f9f15364a8fae14af7ca9e67af0f80b81729216ce5
MD5 23e21ec037e386c3726e25aee5aed5ed
SHA1 b3cae8f22b2b8d980f708d4f5fdc381f7626cfeb
SHA512 da66a91799c652eeb78c054c855bb1e35f799e3717c9da4b8e90d3eaaa7c756e8acd49b76429e8b9b274ae0c42593584c486df7a5b1f94c866d69d60df974022
SSDEEP 49152:g68Qg55nhceWu7PNU3/eLNiXicJFFRGNzj3:athLRc/e7wRGpj3
TLSH
T1E6B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be3faaf57102355bea5ca1730605d6a51c70ce82cea9470bb6411febce775d09
MD5 4d81709ef46e2a15b2d964c10b7aa217
SHA1 18d38ded2c21c72f71f0a81fa87eb3fa1440d4ec
SHA512 40835b716b2d99e44261898ed7bbad9c810b3f74e59110088140542a7cdee62be06573d50c42277f844d195b8d1cbfdb1c1432d3c779545765380b505aceff5e
SSDEEP 98304:4y5112gYy5azzVvt69nLKnhZj7wRGpj3:RLIHEWhlF9
TLSH
T17D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea4d3d9d90eaf16c3384be1ac6f2bb41ebd6e23bcfc6d54f4e3a467eb5e181bf
MD5 e5346799728f682d637f9eb3b6aa501f
SHA1 2ee1d6c1e4b53e498482265868886862fa4532bf
SHA512 6ce41e70e543ad1022cedeb2e8b93bc6015d0228610adc48388fed0a9f618b7f912ad57b6ae3d3448df9523917a65d66593c2ab8d354d3e1aa94c6db21266fd2
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glkLNiXicJFFRGNzj3:Ru6Jmdxd2dk7wRGpj3
TLSH
T109D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d658a1cd4785e000f6f52702ef8f9a64d9f6d8942b6325625160e2d2bf5808da
MD5 af3386bca30f54f06debd2ff338ff241
SHA1 cf9a07b8b9d44d5bdf9e122e46789bcb620c31dd
SHA512 3293c904a71b586958789430f56cde69b48dd007540a22984802ab85bc09777d3d08c5e12344fa26a23f7c812c5aac5c20d642b3fa7961dd25f1f9586dff736e
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4x4LNiXicJFFRGNzj3:WmifPWRZ7wRGpj3
TLSH
T171B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dde6722a3a3c1c48091b03e3b7bfc2e24f093b0ababd83998bf284bf03b9ea81
MD5 55c32abc05b3307dafe70e5b2ba38a09
SHA1 334c0ebb973f8be3a9c16ddc485f89972cf8e46b
SHA512 8c9f9de5330a72b1c522558648fd1008f9a25bacd9481b229312e7d54fd596f9306088450f402534cb4b356d94b1450a942ee80c43ef97b97be1d134ce906958
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqvLNiXicJFFRGNzj3:25dKii61v7wRGpj3
TLSH
T119C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac0c8ae71639e13586254f7929071821fe80bb56be26ba8e4a08f4ba62d76d4e
MD5 2c46f3a4f9ed4eb70313b320df96e28b
SHA1 ef7ba94cbdb9b7d46c42a1660cc7df2ed995c6f9
SHA512 08cf0756273563a6665f53f91f044f15dfd7ab3917eaf03d560aa8fa9b425be199b9d96dde065f22c619742f1b0e0f52304912012abb0c75e49e1383cde95512
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5w0LNiXicJFFRGNzj3:KX2imphN7wRGpj3
TLSH
T1C895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 72bb33e596cc36029e93fec4720c3c02eafa394c821cd09310214ad00516b429
MD5 f2a39103cfedfb1366f2c801fc8405f5
SHA1 9a62a8aaabd42358582e3902aeccd322b41ae5db
SHA512 284d910462f50783fdacce48338302b20e6d81dd45aaea523c2cb2466a8959f98291e19af6127f41d612dfbfef17c8eaf653bd0b0108ed38226514b84737cc6d
SSDEEP 12288:GPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B1F6BC003AC6754428F5882E1DEB5658E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 1daa0f106e3f10ad24831a6dee6b4c392ff3f2926ea65fa02fa30be6b464ba2a
MD5 e64d80d4878ac783eec9e3485a0a346a
SHA1 e844bfaf9cae1809b9ff8bf64cacdf66c92b6c3c
SHA512 63ef0e002a81329f4132cea9dbdd7f05368707ff2ca2d7bfa51dac27fb6729c1baf8bd89ff454853777bc374946e34b38542d4e4e062d18f58bfb4390f944526
SSDEEP 12288:6IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:66/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3548955B1F6BC003A86754428F5882E2DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 6d6bd1dbc66fdb0604642d1b8e60c0f3c947bee53b50e286ffdb00cf8cc05a3d
MD5 288d316c7877d5f6dd1c5bc7d41ae878
SHA1 f5ab1f57458415540f03fd697c303c6a82af83c8
SHA512 736f98ea5d00649e8be651bde31cfc7d2c3b1be741e9905cdd103e5dbf1f93e171e564081ab87abad79f53a64c36cd5b75807a1ff74bd3d71cea852ab6215f38
SSDEEP 12288:gGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1F6FC003A86764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 95fdf9debc9c4729a8a6db3732ef24581fcd25ca6620f6ab6281e104387f35c0
MD5 433abf1b5952642667b61bc95ad24c92
SHA1 65e85516bd391a562e0875bc7e7b5a5de61552ce
SHA512 3ba7be5a9204bd1307cc879fcc74f593e7588a678c6c455a50bfa9ec77bf6d8fcb99c4cf94799bf910fe6725843deaa5f7d718e0646ca3efb845dfe4ac72a83e
SSDEEP 12288:wV1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B552392168901F1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6e29588632f09e1e99c0e7b343897707321b34cf4a6d2d761ef4c7ef0f0b1a66
MD5 18183f398557e99c8e957c83ef3adafe
SHA1 85691b5f362a96ce824211845c985a1b9f2fcb62
SHA512 65bd4e0337887bcd99d95e67f50195f2768d45b2c7263c7e45b1dfd923ac7ceb574f812fdd34072be11654efa16c54e2fa3ef5cbeae4feadd9bed816adb8e832
SSDEEP 12288:1diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1F6BC003AC6764428F5881E2DEB5658E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 aa16e055be509884e44fc537e8009316b8cad673a6426a0c5c089250e143ab97
MD5 954466ecf293901da258efe8a0a33040
SHA1 e4cf6a81d9f9df40dc358765d2ac6d360a54a7a7
SHA512 430f85aabeb6881eed3c9c0f9514a6ffcdb3a6dffe4ae6add82c5a0b160bc6ae98dc349eed2180d8474953be688652c6e0f182a2af5ea524018a31622b013d6a
SSDEEP 12288:k8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548955B1F6BD003AC6754428F5882E2DEB5658E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 6d81aa2c630afa758c8ba261528dffd157a63daba01887346171841bf1bb6c1a
MD5 d0c43d0a20ede49ada2e4d7a5328eba7
SHA1 e961d9ce4120bd25aa5538344098318fc35410c4
SHA512 2c919f272f4a3c0f2e6dab056860da139cd9cc574411330d887ec59539abd31f865e5bdf12b5386070176d33ea9bed2b460d235225d7ebcad1260db178771697
SSDEEP 12288:mwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D3548955B1F6BD003A86354428F5882E2DEB5658E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e71b8e6a0fc69ed272b6c1f451634047042ee128d54392908570ef1dadc6a0bc
MD5 b603ea6f34107cc8add393d1123e4442
SHA1 315c585631fc55ede3d5859150e2df16fb686478
SHA512 e544207a92830e6ed8665572298698c66a9b4919a9abe3890619d0d9cbe20843c97a03933003a2d12bf002b55fb32a5827e1114cb361678f040a280b1b2ea235
SSDEEP 24576:sZMRzFVSOa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sZMRzfWLNiXicJFFRGNzj3
TLSH
T16B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 30d39d7e763bcdcd17fd3dd46a91c5c5633e8fa5a8d57638c708eef58b08fedb
MD5 232ec175c7d67a5a441e41cb758a9b88
SHA1 b27528cfea697134e2930ee82e454dbcd8a54720
SHA512 fc7b899c1a3e42972a1fa3a7b3ace4370f24b1b369a6f2a0219b4fba36ae121eebc0b498c098155e002271be3bc18b74870f853386adc507f18ffddb607454e6
SSDEEP 12288:SriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3548955B1FABC003986754428F5886E2DEB5658E3E2483D1EE23CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1907a6de5e922acdb17fbb91fafa831278415607fc8ec170f73b2bd3e04ad4ec
MD5 afbe7e9143bfac386b9930628576ad15
SHA1 877ab62b2698451de8b00d93d00a68e3765ce02e
SHA512 3369b883e9a6faa364139e1b5b06bed5737d5e36575bd01e891200b6ef63048250481169c6317ad88206f009c5cf5c374fb1fe87b1a5267b31ac33ce7544b61e
SSDEEP 12288:4HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1FABC003986754428F5886E2DEB5659E3E2083D1EA23CFEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c0112c8a5904b221b48b70d0fcafe3d72c75aea1d36fb1a399e89755fc966bd1
MD5 f7e7ca3b7986c24a9f7df82af29cb91d
SHA1 a0be93b6d8aa188e8e470c30d908484dab17942f
SHA512 9fad2e1a461cee6c89f176af432f86f7a7ce534abc20528b379c5b68375e86e23f405055d23b3789f146df0745dd9c9a7dc8efebfba06d542b73d04532791a96
SSDEEP 24576:rzy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rNLNiXicJFFRGNzj3
TLSH
T19F650147729530F9E17A8139C9620911F3717C3647208AEF53641A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 fd35369efc99850fa7f5dcfc4e54b4ac5e796802de70ee766348d594b20dbc88
MD5 9d907ad2c869127627c6f14193a952d1
SHA1 089fe0bbd8ef3d1e8499271f192f2c128654da8b
SHA512 190078093fbf343414446f1aab8408fd408a7c423101136ae8c7cf571012dc86c641dbc5d2489464078b5a5297f59c1f8e51be914a3fbaa1e483e0cfbe5680dc
SSDEEP 12288:hriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1FABC003986754428F5886E2DEB5658E3E2483D1EE23CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 3450fe1e32c71b2f5f76b93a314dceb3d0a2e7a4805fedcbd2180a7110f2b8dd
MD5 79e1712d6df33b83b53b3a4119e949af
SHA1 518127b0bab49cf2bd5ba9cada94f9ee3ad0306e
SHA512 93aa390ad86da041e5b8b95189174f886a54060b837a110af031902696ae88dc1f87cfab551077ad26d456115182311935593da74ad51dd335b4086079d4fd37
SSDEEP 12288:vriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1FABC003986754428F5886E2DEB5658E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f64d9335e969a7a51659e40d50429cdb125a7aa2b2af395c597a3c830d765a17
MD5 dfbc828eb3d310600cf15cc5d83d45fe
SHA1 9f3f8fae7c62846a3a0568b1295ad173c6eb0aed
SHA512 b96b30938d317a60dff0914b6917e27ba2174b4e6b18743bfe8b33439747fdcc478d8b0c06a8a67847f7c9aa6fb8cc7305a289d63f77305ce4105909d033b57d
SSDEEP 24576:izy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iNLNiXicJFFRGNzj3
TLSH
T18B650147729530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0b08a474d981e749453509834bcccfeafe182bb5a0eb41f9bb14f6c1ce1b2740
MD5 22f288966cb1fd1fc9165dd14e727d53
SHA1 b3c0603016b9607dda588598e334e59702b7235d
SHA512 1f0ba5908e658f08715c1fd8a41bc76a334f25854760f65dc7f205a5be8bfc17564be5a49664c77dfd210f0e07962b81113b4d2405663ad81464bda0aa63f74e
SSDEEP 24576:3TDaLl3z0zDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3TuLlj1LNiXicJFFRGNzj3
TLSH
T13B7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2c414d006dd406753bc74cca7d7905e70e85a57a98537080a629fbcbf0c086db
MD5 253a739fe86d67bc0bfa66007e733394
SHA1 13f1aa96467db5333252dd3c6e210453662fa715
SHA512 3105cfc06cefba7e61fb60350bb676e7f8c9541e786a175323cf9ad1231d69ed56de2cb896d162fb87439fdd450469ae61bde68e53f3a41a4b60aa5b669b9691
SSDEEP 24576:L3vd9CHKy7GZs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rvd9CHKyaWLNiXicJFFRGNzj3
TLSH
T14C85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 47ca710a84553373ee0e98c485d1cb0b9723e3a2e98b1f78f867cc4486ed9902
MD5 b14f0cb808492eee41b563d063cd65c0
SHA1 1bd9cf8e4ed81a0fb550b4bbab925edf9da1f314
SHA512 09c8b4254be98f60a06f05322b9291903606158cade6208ea45d4ed6a049b945a547f138a43d0a92b81688ca2643225a2078238b1969506bca2ae72b40e939b3
SSDEEP 12288:omiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B1FAFC0039C6364428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 802dff7ce4d06d02dc89a9177f2499d75bb7765d61a874362697065ffde1e3d7
MD5 6bd381e1a545e104224380cf9a30aa32
SHA1 63d19e82341a6e5f289fa603b528c444cb12e959
SHA512 282cd06ecadc6e9a821e3bfd153b763f729490b59014e0dd9e817dd2f6d01ab3e306d6fd80d130f3cca2e8416e7f099155f322473fbfb865a9bbfbf6e3502e0c
SSDEEP 12288:v0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ve/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D2558955B1F6BC003A86764424F5882E2DEB6658E3E3443D1EA23CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2f414437002ce0ef33e271fe90e0943619c07d1f86013c9975a5acf60532c0a4
MD5 95dedcd7dff75be3db7a0c185921764f
SHA1 5e9e22fe805be99b1bff928bae3bebb71eb783e7
SHA512 56a81714b29d2f4fc7454ca45ab3d5d9359e7b590b3bb5943240e29d9026910ca4f9d06f70e6ed552e99d9d80c72558eeba736cc5774b521103d67f9e9fae00b
SSDEEP 12288:CRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3548955B1EAFC003A86754428F5882E1DEB5658E3E2443D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 58fe2bcc278af977848699607a8ca324ba1366ff738062d15e879cd84a643eb5
MD5 c432bf81199e967ff6e6e585fdbc2e79
SHA1 297f194629c0fcc3e41d135a9a836cc59d6d0d6c
SHA512 a284a20cf8d42fa8f6bbf9d0c8f00bd851b38cddb849ed2ee7f8458821c3ca675380f30d5c6b8c0155b3eafd1e99eb9e69bdeb7536ff4ef963a917076d051ef9
SSDEEP 12288:priJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B1FABC003A86754428F5882E1DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 61f54da8927a26b14358b69e5e3344bf26f42ffc812d289953a2bcaa9b426737
MD5 c02756e9aa275b0389e605691ac9ef44
SHA1 650f8a05ce7b2a31dc0d81aabf8e098749ac1d18
SHA512 24c222938cfbcad7a6b4ea4a9138f8622649d283ef06faec4e0ff26f97f060ff7ab83a844c00561e48065bf44825a06348b4cfa9804449ceb7fd0893d542907e
SSDEEP 12288:imiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3548955B1F6BC003AC6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 331786d7dc731655542e6d73918b0ba4d5483d5a5f32219d3728d7f866407518
MD5 e3982e19029ecd3f3c989f50cbd6d7b5
SHA1 b53be58187fc5cd5ec4f97d485fcb9d005786cf8
SHA512 2ccd9ddbb33104d58affc8718e881b793fa45c7cddedab3a48845a04369730959ed21c2dcb2d5c3c20ae3027841e8da03a1863abc6c35f1adc3f4cd172e3b84c
SSDEEP 12288:4ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F35523D3548955B1EABC003AC6764424F5882E2DEB5659E3E3043D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 649401c782c1c0a3ee2dac9b668133ef7843a268b7194dd8b12475021e4d1ca3
MD5 00aefcedc26e5f34c84e36e3da4ab500
SHA1 90a186ef695c5ee7be62d3e2ce1e7d4fb6d412fc
SHA512 4f4075d08f2086edabac6a3b37a494188df203ff2aedaa4f5eece87a063d0950e6e5127c131e9814d6d7a810fb877e75784e644181e562e4e223dee6b320f073
SSDEEP 12288:1diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3548955B1F6BC003986764428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 0cdda235c3b0fc74c581e69010b4322626e36c70e932fecd0808c454d7c19551
MD5 af33628eef5865e201072b37ae03e4aa
SHA1 c4afe31e23a71a7040e9512848e88128aee613b4
SHA512 40b3be19393f9c520b1cdefee00440974b624dfc2e887189257f0eacfa5993e038d8d3bd5f13bf32b765fac33c46a732b88b6d7d10bdea9265e220e93d2f23de
SSDEEP 12288:ReiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ro/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D2548955B1EBBC003AC6754428F5882E2DEB5659E3E3043D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ceb53e0dc5bb7023f79d25c5a8470be9d65ed8ce01616463fc5da79310d02144
MD5 3430d2f4b14a97a0678202c624509a0f
SHA1 2a43ef25ce48221dd6b5cc9ce72785ceac660956
SHA512 53e0491a0781d14d395c0a03b34035bc6fc6cc87820ed938f18715754cf0eebd5f7c2ba5c8a8212b5baf371bcf355117ba3561614c4abc9e9708f1ccfe52dd41
SSDEEP 24576:JfwvUk9RX6wkyAID/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DMnYIDLNiXicJFFRGNzj3
TLSH
T18E85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1392f0a49244bee41ac7989d934bd14aaad2d40b8fde60f83e2890563db05a81
MD5 68a9142ff982e9579e7a4b83bc05906a
SHA1 e123f3c918596ed4a62ec8ecedc396f3bffb3e65
SHA512 08f58e99eb0cbe35ab46d245aebc469417df544040829e1be8d724782f847920cf8e7c35fc075bf3c3314fb589256906778960370be19cbb65c8fc2e3dbaa031
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ULNiXicJFFRGN:zySzPs7wRGpj3
TLSH
T1FF066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d30519214a14013bcf241c1b3c9d57cf5af7a2a88908192e428e2cd6e61b2411
MD5 a6cd8480cc0edba6b94bb00b11cdaad9
SHA1 600b403d43a812f126b4f781be1882d876f4b3b0
SHA512 4efce3e1af459fe24791c2a19863820cb63cfc2ea3722404b5eb3445fa8f2e75defb8b974a427b80fa2b994fbc2baec734e424425f769ba6e9e93010f189ee10
SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q47JUQjTirIhCnDHUPfF/kLNiXicJFFS
TLSH
T1E065AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dc95c2189e2ffcd661d334953bc850d59b7be97d3a29e96b36d90f401ee4ab2e
MD5 1e94748c188f89ce8ccfb2c92ce732d3
SHA1 b3f14765f25436b7da3a3c6d938b5f0092473621
SHA512 5e9828e554eec161df29cb93b60aa37debff903e63e7f1db5de0feab6cba88ed7e1c78d94dc12b08ff375b26a892bd4ca58b3afae5ee4b06f4a5c94f10205b30
SSDEEP 12288:Kbsf7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB53C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 9256cb03f964b26d62b779735c733cc3d38b8f899f9f3e7fda6718c02995b161
MD5 5a1a6060fa250847e60c6a0165bfc45c
SHA1 17189dd9307fd25a52181bfbc71f1309a2956127
SHA512 c7ecf7459db7ad0cfff61bb35ec52ed1d507596da51e82d5613dee89ce26de2e3dcaefe7d22ca793249e1fafd0bb188edad01200a51165277a817151a87b1672
SSDEEP 12288:3DLWB2pU3fN6Oi/CccBr+Rqy4j/bV2Nnj5lPX0xLLJXpDIJ6yc5:3DCApUPtkzcBXyaz4NdkxLLJXpDyc5
TLSH
T1B1452841766AC74FC6A940325E32D1CCAB707D51EE056F0773C88B3FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 880a5927d809ec902c3a06ea68858a195069ba6c732eb66a763d8a967ed71587
MD5 e767d6e3c362952277446c4586f90ee3
SHA1 384ffd8340e01fd2aa6bf53711e696a2dc88322a
SHA512 fb86cde9468087b936c1bf7365803f5aa3294e0ec251ccc99e02a31a09323870f2b40e7cb6da4b6dfbfafb8f524966605bf8bcbb214adca89b7cb87206606a42
SSDEEP 12288:D664s63pvu9Ai7ONvM4Vrww+Q4ksJ7FaloQY:D664s63TNoQXc7rQY
TLSH
T10665E8815537E38FD1FB603207295B4CB7A4EC46B7096F26B388453AD826B25A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 6d6e044426367fb29fe299a07d0718a0c16c8fdc9876e229c9bd478e906e1b1f
MD5 2f59d305ddfd42fab2db3fdf772c2a80
SHA1 f139ecd6bd7f3718eb088a17489c80f613e15190
SHA512 548fdeb92512880e898564965477bc724844467838b75b2f44c4fccb048b3b9838528419e90460de1ef342f817fcb30e3627f5787c5dc21e7f57f9982edd480e
SSDEEP 12288:iz7DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T187552393528959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0b66b815cf0da2ab9866676cd949c1c657f7a5771a34793ae7b045df96282dd
MD5 5e6a4a709e3c514a091ff5b439a63f77
SHA1 3e67bb88ee1613161f44069ae6f474c865b422d1
SHA512 9fc2f8177c384427e7948e7c4d9715e299366c06dd5089ef8399b9d944ed345431447b9d0cee425c65f46de47bab149ed9977d78a373a5081701bfd76e7970ee
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7gb4mBIBhGFqLNiXicJFFRGNzj3
TLSH
T1EC65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 16f305685090a3287b5eae6e9c9d1438cac2dfdc73dc8f7f3f74f657dfd86a24
MD5 abed18d83b86ad5d278eaa75385c5ea8
SHA1 32be7679e639a7d6b6fac04dada851c374a7b997
SHA512 565e6c7056db19da33c6dc107b60dcb31eae897f851936c5805255008f81e447ab660b7eb1fc9cf08348278c4f05055dbd35ce8b5faefd8f094beaefff2442aa
SSDEEP 24576:MG88u8FpJqH1bzria7/ma/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v7ZFPqVea7/9LNiXicJFFRGNzj3
TLSH
T1DA95F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 42306fe3a88845ee0c48bb624e26ca250ce79f4b2fa38d6aeec0b2c558babc7d
MD5 316aea2538cd94fa56d9eb81e2894e33
SHA1 8532b98a7cd426dd3a3b5a8bed96065fe35f0acf
SHA512 39378c36965b11b0a25d6d4165c5e696b555441042e654c4b4bc2f776581a243cdeff59951b0e22b0351c6914f91c9ff331fdf631f0e33658faae67ffc44d072
SSDEEP 24576:APUr+NQW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJQWLNiXicJFFRGNzj3
TLSH
T11B75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 246dda1c1d0712396c6a7eba100a70a61b30f5d826600055b048f46c9039ba3a
MD5 f812e477397d85b316e855af7835dee3
SHA1 743c41f316e55de484a8f805e6268bcf792ae101
SHA512 83a926dfe20e96368c4f583fde16f88eba91eba3032cfa4ef910221fc49c0c34b6817e046e017ca7d09cb4bd9b8b3197b6d2e51a5e91cefb254ec47a1e15bf8a
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGLNiXicJFFRGNzj3:SG05lO43bL7wRGpj3
TLSH
T13ED5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2d381f033f30b9b4b76c27e3a833e117b8fc55746a2d1599eb3d1e3c527a421d
MD5 6a7ae30f2138bceddd700035d28580d0
SHA1 3441676c9485a0b49e8e1159ab45bb40d74fdccd
SHA512 5d8f5baaeb9166dd94109d9e82d20f8162094306fc60837cb0593bd3dd1c4694b382c1ac2d039accbb100eda453fde398e9ffc8583300dbb1106a703f1e2fc7b
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnU/TwSfVcYG3K/cJHlnFR+IGNe8jg:5a5POZ3BJt2pasx2+meLNiXicJFFRGNf
TLSH
T13665BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 805dae22510c137b80ec4b6389ee1e9a08503d24fe6c096c6b61c77dfc7e0d8d
MD5 e4f3536b10e00cd45f8b27d80c00dc5d
SHA1 f53b3a93cd74b9f99cf7e154e717c9587b3423e1
SHA512 3dc1f0a9349b0d31b508337e6add4ec7310244586204593d5b800343367bcb2aed7cb71e7a4ae890517277fc698c3d5323b16063453dd6067bf5f2d6e755e836
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LNc/zEOVHFdLNiXicJFFRGNzj3
TLSH
T15E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0e3007222f2fb4f59d4b86bbd458af1414976a21604d1450f38a9b481a12962c
MD5 50ea48defb323b8064aa1887e2f3b92d
SHA1 bdc1348ee8e7f2d4897f618a908f86cb3bfccd0d
SHA512 20a7d441eb2e9d0e7125801379d67f01a21d15953f10407816e6b3fc885a9368b997c1c952247eabbca2bbbfd42be748fb47545576191a72afc8bda1cc6f4063
SSDEEP 24576:cTkNvNnaFeYhJNtmZBmo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cTMwBtOmoLNiXicJFFRGNzj3
TLSH
T12755AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 28e40ad26db5c812cc2294e2fed4e20f768238073d60ffcaaa86a5b93e0dc79a
MD5 cb50b0275e93ef9b7fdb2f9a47e19f27
SHA1 b67f630ec99559fc92c646696f361bf3c02be0f4
SHA512 d9eca8892343d5f23184d72750c8a5aaea7019c808f51af48e73f6df19df464f8094d6384e90caf54ac218a2eb918dda5fe6b695d9973e4c5649379999e554a5
SSDEEP 24576:+D3FHshBIYQgAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+DVHeBIAAbLNiXicJFFRGNzj3
TLSH
T11785E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-67-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/1692-68-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1692-74-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1692-261-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/1788-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1788-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1924-122-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1924-313-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1924-115-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1924-116-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2984-109-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2984-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2984-315-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2984-103-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2984-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2984-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3420-134-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3420-128-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3420-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3420-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3420-139-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3708-41-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3708-40-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3708-47-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3708-50-0x00000000015F0000-0x0000000001650000-memory.dmp

Download

memory/3708-52-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3804-55-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3804-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3804-198-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3804-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4152-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4152-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4152-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4596-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4596-432-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-430-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4596-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4676-79-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/4676-84-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/4676-78-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/4676-288-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/4960-381-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/4960-0-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/4960-1-0x0000000002640000-0x00000000026A6000-memory.dmp

Download

memory/4960-8-0x0000000002640000-0x00000000026A6000-memory.dmp

Download

memory/4960-88-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/5172-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5172-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5172-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5172-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5172-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download