d62a1f9739fb949d218ffa59cdb60255446ff5358f0d68b7e492e5140e3eb9fb

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260820-se4c2aea93
SHA256 d62a1f9739fb949d218ffa59cdb60255446ff5358f0d68b7e492e5140e3eb9fb
MD5 9399a0cbfed90ee4824e207dfb1fc7f2
SHA1 55dfa1cd6789000292afad77d26cdc37c2121139
SHA512 48e8bdc912bd3d71d2a67c6026205ebbf24bf5a2b5e57622bd8df7ca8cbca0011007d860d8defb731d09ede72606ea11c3c74b78c52839cfcbf97b49fa51f574
SSDEEP 49152:wKABc3HsllZqMFTbT296BT5bVMvdTsP5NEobui2GBE2pIzTGHniK3HDQ/lFTjN4:kBc3Hs0+bWsPsobuYB+zqkLm
TLSH
T1F506B003EF81C071E592163E82BAA7BA8E7DAD106325D6C3D6943C148D775D2E63A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4640	elevation_service.exe
712	elevation_service.exe
240	maintenanceservice.exe
1432	OSE.EXE
1168	PerceptionSimulationService.exe
860	perfhost.exe
1792	ReFsDedupSvc.exe
4300	SensorDataService.exe
1388	ssh-agent.exe
628	AgentService.exe
1448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\131db73eb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047e87f18b530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092effa1bb530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006512b5ab530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df724a5ab530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fe54a18b530dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000804cd61bb530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008da47a1cb530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800000f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3328	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	628	AgentService.exe
Token: 33	1448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1448	SearchIndexer.exe
Token: SeDebugPrivilege	4640	elevation_service.exe
Token: SeDebugPrivilege	712	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 6044	1448	SearchIndexer.exe	100
PID 1448 wrote to memory of 908	1448	SearchIndexer.exe	101
PID 1448 wrote to memory of 5704	1448	SearchIndexer.exe	102
PID 1448 wrote to memory of 1364	1448	SearchIndexer.exe	103
PID 1448 wrote to memory of 4656	1448	SearchIndexer.exe	105
PID 1448 wrote to memory of 6040	1448	SearchIndexer.exe	106
PID 1448 wrote to memory of 5248	1448	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:860

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9786d205851598691788d1999f1490c833307a36f1b12e95de42b65597a5e35a
MD5 77553c7fa308a9fae0b7974a287f064e
SHA1 a9a07e24138de6f192574ecb1d1bcf002809c8a8
SHA512 c5f11009eb2c7c4bc38cb7aa6bfd9cee7c99e9b5244020889ab22987302e7486f3143643d41078915882b0b99679c16fdd3091994d2c1b3dd309ad8d35265284
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Q/lFTjN4:t3q6HjBRLm
TLSH
T1E9D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 83ed69e34fd29be5a6ba45d102ef315fb8167fa69d12885121bb957cb25fbde8
MD5 64dd3562020213eeaa3fbafb496ef758
SHA1 7cc27db967a9afcb9329fcf3035c6b1e7848f9f3
SHA512 11eecdc247fba0fa5f00355c2a0ee5886d49756776219274d42f19a0449d6b31cc96eac076cd925e1f2d980c8f838fe8b5538379916048292048dc3cb31f1b81
SSDEEP 12288:q1XLsswWkxy2lRq2czAqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:gXYfDtczAqnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1A765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d82d042c1efab29ac277c2210c5a252be656e5b453d35fe201e5c885d39e113c
MD5 dc4047cb10abf0332fd9678303837b2f
SHA1 a181a8c99af0a52159d207a28448dd2e6f85a8a7
SHA512 79f792b9cb39f10dd87ce2c8129d57be937e1171831c963c4c3b44092de31fabff34109069f85fac5f7aaacaa202b22dac1995389e693acc7a61de41f0207224
SSDEEP 24576:J0Le5ji0hmxLrMlnQ/tbw/2Mkjy6Fr7g0o9:JPji0AlAQ/lFTjN4
TLSH
T1C3859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d18dca04edc9f1ed8e26e86d12410867ee591ed05f8fbc9a916c1efc48c3a02
MD5 0e04a75d89250baa8e508792645023ee
SHA1 0003aa696408fcb4398548b1d3693ca08d29b8f0
SHA512 d25b3751af8c700a3911a129a8f6918ebcb6def8e4b54d935800724d152d17eda6cd9449ef02fef959f0eb501f4e746afb42c34848856e46eaa44904bbe84d2d
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuPnQ/tbw/2Mkjy6Fr7g0oS:q/ezSC6vUzPvxHjyEQ/lFTjN4
TLSH
T1CD755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cd7a0f34d69430b0d51fe5ab59955654fc45a975ac8419449790ec327fa86e7e
MD5 41c1493fd1ea85fb3462a935ff1f02a4
SHA1 069f9fa90c1d630466e01988007a7f5c3accf043
SHA512 334eebd4d045a9a63e6559819c0a52a4346fa8ea9b336f1ab0d32e8bbd4dff066456918e7ce4424548db2def27822b993c0723a8af7a1d58b18bac1e5b7ea424
SSDEEP 24576:fVbqPb88hv/l+6WnQ/tbw/2Mkjy6Fr7g0oH:fVO88hXl+JQ/lFTjN4
TLSH
T142559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 41f3e42ae1b1b3c41fb9a86b47f2858b5e60a8cf71947b8a311c5f70960714db
MD5 7b8c14b02a6fb3f4a53a26f8270f1e16
SHA1 4ad3a2d6b004c5d393ba6783fae2bb4beb21b557
SHA512 da9e42db0c4986a954056e1ded0906a74da8fa95bd49d470bad52276ab48568726fe9a792d5898d21694a0d8509bd018ce795e88c9b96d76204e8b51ecbf28cc
SSDEEP 12288:UzxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:UzBnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1CD5523796A24F887FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4eb3b9d4f964af05e6a26ac6e0a038fa1972d7c1769c95c52bbf5a2e15a702d5
MD5 0bce05676593bb3afa9e292abf9c2dbf
SHA1 8933588a174677cd8ae7f9f28234dbdd33011fca
SHA512 2a13e8f1c7c7e2d16e6d214c9c1c506f2412efc11760f5b2db0551e61c01aad5a8663034410d03b68fc7e5480ef55deb499fc86f65b2d523a1294b1a11c5d4cb
SSDEEP 12288:FeBNUbTVO86UeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:FJIUenQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10D75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 97d90ff986196b553c0c1fdda11993a8559bfce21c82934e62244db1f565d3ad
MD5 b195f6ce1a5770e42aca0bdcfc0b1761
SHA1 c41c23da710b372aabd2ebbb5a8aa3332101a1e3
SHA512 f0df1faa66af951a22051d12d4eb7e5b9e4fba5043f78d307b68c3a250af1ffdd78a5cd0fb0c5f0fc98142398e7b96b734ec04ab2964c83c9bf2dee28ec29ff3
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:gQvGAdlCEL8c/yRNw5CULm
TLSH
T1AE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9143db046cc1f241e5c8ac45771fa17ebaedd7bf98e568a4fd04f91328ca6890
MD5 e15891cf4e81301791e5e2ae9469c1d9
SHA1 bf957a855bba49ba64dd6f0938230b46d7bb3ea3
SHA512 d5cab7109aae4fbf80ddd4c0246d35f1e3ad77efdd6f7d712d8704c20bdef0cb7ab98757cd58897f636cecf78d1d44d667a53a18982eb6de56b2d159334aa507
SSDEEP 12288:qAwSfxL/2Dc39DLLmt0LDQewsAjwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgs:/QewsAjQnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T19375E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0000f6070f0cc20ef825c096e6b0137b5a12a84893f99cd6f31992785a3a8079
MD5 ca3e0d2dfe99d1f230adade7c7219207
SHA1 7079d8951662b4fe8742ce27eb0f917ba20b25f7
SHA512 4a31252360d7b606046bbf539485218cac98c43e672606170c7da4659607c9082bf8966969ea3f16244fd2fb3a7a41aa1073f345e9f9b47f532a133690de046b
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrL:cUEtQevvqc2W1cpV2EI32
TLSH
T1C0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 43e8fe1645492ddab4ab415ce8be419df0024a4234a8fe99e56773d47ef86b8c
MD5 20784b91dfb16415a41ee254ea9c41b6
SHA1 d240bcaac678ba76160a64108299e515a5acf9c3
SHA512 ce7efb60f8d9246854559d47886d00695dec1641e1b5f792641a6813c6b977a377773d5740e3c724b04027fdf97c28ebe6794965ac07da78468cce0d753091f6
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zwQ/lFTjN4:YoqtVjnmoLm
TLSH
T1C4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6f541fd3dabc78632312301b60c2c5765bd81693c91dd7f1ce2299c028b0b7d1
MD5 3efe6696422869ed757cd1337ded12b1
SHA1 690952f1bf2767e02b1794e4d2abb7fade277be4
SHA512 01a57e194058cb7282cdea32780530ebad89230020e118f59194823e9bb8ae73dccd9fbdf0cde2944d4cc2d034edaa4ab35bce40f3fcf6fbecbbd4e57fb01fa9
SSDEEP 24576:EAhGLJIFoiwtA5l7S53jnQ/tbw/2Mkjy6Fr7g0oi:EAMyFoiq5TQ/lFTjN4
TLSH
T1B035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 03b339114886851f0b00c6c4c9dad72693528566992ef02ae69a8df2f31af7e3
MD5 379b5f7b43fc6521d0af3e4b511c278e
SHA1 da2750a2af2287461b1d8c1a1fcce99f09862afc
SHA512 55dc1a7c4465799ce4cbe7b6dca76ce42499f828e6a0364941f1ea63b997ca014b5a06a53965fd5d222e7729a3c4d710c548319b402c86158014641fbadfab89
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMS:VwuHOWknQ/tbw/2Mkjy6Fr7g0on
TLSH
T1DC65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9d955b2ab1a12c187864a67e232c58fd5a87c2db6553369b2d85ad5bbc378fca
MD5 d87352128c0378fc3c768eca41398d9d
SHA1 3dab317fe099398341e6ee98c087c5987fd8688c
SHA512 7982e3bfe87ac45c3231053cb7802693a183b546379ee2f0240134d058a30ea132dc394a0afd157e3a6189980a416606af8943163297504bb248f20906d52da3
SSDEEP 12288:KXZ1IyAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:CZuNnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T19F55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d1b62adfd3aa262fa5ef19a429bf61f0e660200356922a46296b630405e21022
MD5 3e6e9b96b938217c18c537cfe330cc9f
SHA1 87bb034563bead0c627565c37c66927d40148bd3
SHA512 f8e8f63fc61bbd3b545537108d4cde0e71067fac140df40e7f4355e81c02d0ff67e6e0a2c0fd3cbccb20bcfbf16c7797f1c112790a8f0bdcacc376d2df21e198
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:/QRQyi36YOcPQLvw2gAf+PN39Lm
TLSH
T11E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 12f0a8d79c02885551afc1cb44cd30b0f8a8931e8a8cae4f455b54d11c7bd4a6
MD5 fdeb9cdc8494cb6d39881f672ea9994f
SHA1 bee1e3c6d7c4b1850c1ba0a5538b300c7f324067
SHA512 923077a9b83b17b3adbbfe8892ff37f42a5253d52cd9497edbaba51c836cf6e751508cc24eaf3a28b0bda5c0adcf0c48788c33a976dee9feeaa79db22e34dccd
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:SQRQyi36YOcPQLvw2gAf+PN39Lm
TLSH
T1E9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b97108a04f22ec54b11e54d11a624e331c85c72e8bf34878ed34ac97b077598b
MD5 fb2d81f111a2a6e8608b2c22ccf92ad8
SHA1 95ee2ab57d38206b7b138271538a5de320c34583
SHA512 18709a79f7a379402eb99a8b72a5bce5817aef38ab263790f02d245919d3fcde19b2b87305271a117b2583d6e03ace3bf41f621f0feeb7ebccca68a4f0b63b6c
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09nQ/tbw/2Mkjy6S:P68Qg55nhheWu7PNU3/AQ/lFTjN4
TLSH
T130B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d7cc839895c5db08e4faea4e7182af0d8f69e28969dd37f91c4038811825cac
MD5 c62a157478dbcc84b56a8cddcd03fb46
SHA1 56ebb524c48be19a2de43313798f460c449e8307
SHA512 4bf9c12c12931a360c5f7b92bce5e662efbcfe7ab123af7b579e0089d8cb7755218d3bf4cf10099e6d05551027cfce958636dcfa1deb914ac676358150333213
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Hy5112gYy5azzVvL69nLKnhZmLm
TLSH
T1FE167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8755e7d3711b93c3ce1b81508bdaed6a7a441add858ea3ad57cbc1fcba2c476
MD5 88b3471abef99701f166a55b71ea4744
SHA1 4228eff13da69d3ab2e2a4058a990e7e03fa2b6f
SHA512 9f28914dd2a65141c86cf777d4e67781e187d00f988a76ba9f550e42a8ab469727dd7e2d4155a8a8c99fc16054ea403ccf74c8506bf921854928488c991160b1
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaQ/lFTjN4:vu6JmVxd2dVLm
TLSH
T16AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1861a40c250c9ed5b2d41f7db72af13db25c48e311124a193167b037d40be68f
MD5 9013961df3b0324a315c52ef4c133a9f
SHA1 a2e06f0be2bb547f0c5cf5ed0e350b824121620c
SHA512 164d7c710e85f11c6844bc1b565467dc446354f97edd9fb5328763338acf84622ccc92e11f41490c6c9398059ec7ad648813b1d20b0aaac338eff314bb669f4e
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4x+Q/lFTjN4:/mifPbRoLm
TLSH
T1E5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 270de1e676103317f946b6eaaadbde26fbd3f4ae51d07ec00e8a9daeeab29913
MD5 4f27109bc82dbbd1634b0edd56eb8bc7
SHA1 3073ac4c09189147aa3ecb8829b93cbaa723f067
SHA512 04e0c0cd3101683897b34d0a689cc3b0b1e8ac865a03e41837382b1fa0dd65b2cda780d3a3bb09f40933c75301e9fd6304b1a8a6ba1b45ea9576b4d33a06a090
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqNQ/lFTjN4:N5dKTi61CLm
TLSH
T1ABC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 72fae849a941958129c0f196b3ec3e34f4e10028ecbd2b398d5e8bc2fd8989d0
MD5 576c5a6df4ffea0dad9575e1b736c57b
SHA1 81fd37fed6a2204d1622dae0213e8098fd01d58a
SHA512 1a15340e8c847fb616db3b34c1889a0add60e65006e2cacd823e8067dbc4b3a63bc8009fa4b8f6eb1f12f5fefd053a28062bf99ae453913f32f2edd492442bcb
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wqQ/lFTjN4:hX2iyphcLm
TLSH
T16A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5af35c8732a7e8c3e17f5c3c4c5b1f1f5f0fb1f6c2f0ece8fe3355b7faa6935a
MD5 162385110baa0f5139953fd625fcdd7f
SHA1 90901e9841a1642f73e7b9ba29ef61d4fc5b0fdb
SHA512 214be710d313d0ff2c6fb5946985cf8713e6a1335ce875753eeec913322613dfd8fa73f68d722c8b62075d1e9f68594dddc0c47e58d7ab802ad2e40195b0804b
SSDEEP 12288:65GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:6JnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1515523697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6b362953523915ff0bfc92fb876e8efb57cba8a57d3ab875879b2ec2017f5816
MD5 3de99d91033c4eb85a3588d2357de793
SHA1 9d1fa32a0c711047b93c9b6becfe42f868b4290b
SHA512 937dcfb732abb59dc6ccee2bc31032e845538868b8c90e6eff563f76fd8d1e9c6bbfde0459e67e25420a21bc6371fdd59ce1af3ac4689c181c2a18051d835506
SSDEEP 12288:ucGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:ucnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1225523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f23ba1f57773c3467fbca85afbbc1d16223c7cea83e2f3f08c2332229c6c3a8d
MD5 2828ea28ae0117b39739c6266bdd83ef
SHA1 24553e8c2ceb228b1953b648619574fdaac137ec
SHA512 baad25c338db12f5c57c5b75aac67dbf2ef6620809595539ad0b8186a8b438280a579bd4ed2e36844dd34f355a07ab617e0ab76dd847771840faf2d824a001f4
SSDEEP 12288:hmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:hGnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1975523697925F98BFA1706F14C8281829B7F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0de9b1b0ddec24f428107ba3d1a11fb790085b42454a2d5405937170462a98e0
MD5 7fd8c3488d99f077d8dc6f7190330811
SHA1 c787d7a750678f27b4713279e259b11048d89bb1
SHA512 d6a7b4845b99b5c77147b737564a88c6fb88c0b18489290b3b4297b5ed2cded0e2f59e7b35bcb8650be9d5e0a4b2cb16c3ebc3a89fb0ba795a5cb8547f67eea3
SSDEEP 12288:ZVTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:nnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T16A5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e4e0099285fca2ae03d905fc77b7c5714f0ee43325a141562ab5c62bdd599eaf
MD5 0dc58265c84cdd5e308dd0fc73106b7a
SHA1 919d3da7fd9f1d7c90833d5ed3c0258a190793eb
SHA512 31aba31c2829ce4e0f5a61ad33d01686ef178426e6b75f9cf59b8c5765d4ed11723b1997f9c6003db08df7687502f20559bda2d00d118dc51cc78c8d10a1eac2
SSDEEP 12288:IrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:IbnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T16A5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 addcef37bb81b89210310b14a2406e188e5f60809bbe8bda15c659efd14092a8
MD5 f2974e2d8d4482112e4f9d9a276abff0
SHA1 3f0c5bb8cc3b219057ea41dd00aee7bdc1875a2c
SHA512 77e53e1cf714ab21d1b1b06bc7cd205921aaf0d7ab909f457c5b34774173e99a68b489b9c143bab3b53a7117a83baa957be46fa49971dbba10050c7ad5939bb5
SSDEEP 12288:XYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:XYnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1295523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ee405bc7bd5b3a27a4fac6a1d1dbad0963cbfb6bc697a90752129f47c60907ec
MD5 32a7d8b5441b3ab42efba64df2d94d50
SHA1 4691179513dc7e0fbc903e3af4bd8b62620fa163
SHA512 19f7872444841309b296c8824fbb34f8e11aadf3089062d7711ec13eb77d3e4bf3c75f360b7ef1605e54e9abf4110d3a2949f2f8e5917d063faad651eaf8a4c1
SSDEEP 12288:F0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:FUnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1175523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 36f1a243fbae9de380da21bd4f049ede292d688a6668a06385c1ef977ae96a24
MD5 bff297307cefe02a44c973d3d433f697
SHA1 e7213e221a21249fe40ce16f893de5b5b9b51a2d
SHA512 e3c4208258bbd0f9745bd6a9ae1b3179d3396e374a7ddc061cb2c486fb63c3647f562c45955a755dbe6ba2af64bac8f8f4b7638c56aca98b34b9a1950bd63566
SSDEEP 12288:2iZwbDzzFEoS2cPvy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:5ZM3zFVSO8nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1427501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5d6872d46411f5f5250394a04c71eb04c22f9bc7417a8193308c2f9be484325b
MD5 21c38ca0b791ec907cb323761a3a8837
SHA1 2ab02bbb5a0b8e4eadc1400350c313fc0cb8a193
SHA512 e69072e80b277c5daeaddd1d6371b3b34be3f02555815b94449d4ff57a9f87add11cbdc8c296e1ffdd65c05036e964c0ba95eb2a0999a3bce63bcc502ae4ab0d
SSDEEP 12288:Y9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:YdnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1445523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9ff9574353f0678712ca633ccebef3b761414124fc15cef2fde2fb703808618c
MD5 49d0a6e2dc5e9762f1c279651bf6b1a0
SHA1 992b856804e6ca70df510877d1a67d0cf6709d12
SHA512 093e4b0c9da9bd1ae03d6959d4f76880ba467b006d0f69e47f80dee92ecaae0f798b25b919f498e5fe74f32b99b6125edc57f190b603acdae033f296fb1f24d8
SSDEEP 12288:8BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:8RnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T11C5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1bac3bcd6c5fee6e648d2491a187968d6dff7023e8ddc662ba434ae23c718a5d
MD5 3e4abebca731c108d3570cfa173e38eb
SHA1 b95ae5b0308b3ad34474efc96aed2b13023231fa
SHA512 ae33fb2b8ed077cc4e01609f13bdc1f05363fd0e09d0d946756a4a41afded5a851ae01f95545f8614bbebc40b412bbc5d61347c1c1dcf52e3b3301a88c1d3fdc
SSDEEP 12288:MyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:VzygnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T15B65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba7964ae69c578a25780591a1751db595f0ec074b286a2cb1ac8752d10ed7239
MD5 fe69461b4f0908a00104fb922eb9fccd
SHA1 b78b305a80a44230b1eb0ece79fe72fde8101b2c
SHA512 b70f3d65ba42d0aa28e3bb732545f951df89fb1c4532f26d501139c24e7d7601e1839b471a5ddab47629731d7e063b5e5fbf1f68566b83eb8af64609a5e94515
SSDEEP 12288:l9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:ldnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F45523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 268b8228e4d7810a86f33cbe80518dc98632ac77d352410fc74d9901e0af2806
MD5 9d5b2a88419d721fd8c9022e23b115f5
SHA1 5c425d9938104d6d111b9340e4948f3ca93fd600
SHA512 fc473455334ce417270ecbe54a880907f88be557fcce96561793f8ad8c0d7d9c31ec1b9caad5335c912d41d0eda0a85beaff88c2521b7d3521895d9dadf48623
SSDEEP 12288:49GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:4dnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1635523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6701d878420efcdf8609d172ce0bd2d1803a635b563682f73a18bd3f36feb000
MD5 f66fe162416e1310c98851fb0c020717
SHA1 fecf7b79f54036bb91b1f0dc1b6ae82f646b6460
SHA512 b86c860919a9b8abf3a6a1fa34cb28ca72d0d3e1e19e7eaad74f76e2c5579e8f343e51eec3ae975109b3741e7a259746941883817922c008b0e9ccf8ee8ad938
SSDEEP 12288:yyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:vzygnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1E865021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 655431a37ea9f2d275dc6bb5128599f9e9a24f4db6a65fe0711e87999aacdea4
MD5 e855bfee7f9ee25da710afe0c8202573
SHA1 b44ec250e5cdc868f2132415ae831d812a160f3e
SHA512 e5e6c3f7fc61edfb12e53fa26f10fe9580368cb8a03b0634dc482d4034c67455813cf49e4c50364b0e076d0d97ec29182eeb2d7d76f4ce075f4e296988e31bbb
SSDEEP 24576:PT0aLl3z0zD2nQ/tbw/2Mkjy6Fr7g0oO:PTDLljPQ/lFTjN4
TLSH
T1447501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6dcb7d2790425fca59d7a4a2a7c0afcafaaa8f59b2ed42aa8403dffff44ea9f7
MD5 afb82549f28e5eb773182ed1510c5bd1
SHA1 26ae4882e5301494b42f138827b53bd12afd41c3
SHA512 29807a38e37159e17a218c28d2c99eeb49ac11e7595d163c3698abd71a4e66eb65e13a6a4accf71f87cd4ad497e8069c527defd6d0c570f2dd93eea03161658f
SSDEEP 24576:C31d9CHKy7GZSnQ/tbw/2Mkjy6Fr7g0oO:k1d9CHKyaoQ/lFTjN4
TLSH
T11085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3cd4cd5be25f35da831f8ce5489c2c5fa87557c9eac8728de03e4eb2147e7260
MD5 ec5028acfc5673fa475f7f8a03958995
SHA1 cbd59932655818dd46ef7e67909d43ad8a4194cf
SHA512 316a3885d056d31030a48caab1a1655fbb8f948cebf9b0332b312d976e33b9072010109c8af6d637e9bb4d2be1326ae762345f0e7b15e150b4ca618b9ae6782a
SSDEEP 12288:jGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:jmnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1BB5523697925F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a192283db849a59e7d73efcd96c7afb3f4fe6a68e499ef70f793025d68a8d907
MD5 895a571089162b2b949930e0356a0a6a
SHA1 bf2feba3a8b4fb058fbca001b93b206cbd5199c2
SHA512 9a695bc742c8ddf7c2d2001e3cce0b5414bb5bf2c16d2013ea8add738beea392d3dd0a4740563aed9023c96aa32c9939b075d8b6d4ad990e359e0b8131d15160
SSDEEP 12288:ggGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:gAnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1225523787964F99BFA2B06F14C8281429B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d1c861eb2d1de5354278e31939e9480d9544c2d01158dc247620e770d4a532b4
MD5 74960bbd8fb0f45b2c09a9604a842699
SHA1 73e560284b290e5ff93914f5edc44299b1c43af1
SHA512 37cfa8df03321e2e7537703523f11aa525963d794d331b6adacd3140fa070c4b59761fd65ba76c6e754b4a24f45a2dec0d263e5ccb866bdb5b488a467bd9f5fa
SSDEEP 12288:DnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:DHnQ/tbw/2Mkjy6Fr7g0os
TLSH
T18D5523697924F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2d5f77f51dd3c937a176226966d500e6335298be3a43e216a60a441db75f3fdb
MD5 bfee299d055c8a419985e8795612c25a
SHA1 3647d7d1e6dd0b2d25e96d11e96fd88449ec8bea
SHA512 d500c8becfb0818d5b9e8a10de9bf890d94ea3aa8321235a56d061bae8011807c891585fef273999b867ad6b478797cbbce5a6a68f524e32b72230ce17c4b777
SSDEEP 12288:I9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:IdnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1BB5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 95f2d5d28e9118308e62c7c3d34d966ad09f724d7572f4368fbe9ce97fd9d6e7
MD5 dc2a54a62ea90b04e8275a98133ea833
SHA1 0cd71b689b9a962d3b0fa8920e64874a6c3d4b56
SHA512 1dd0bc0b8a20ec68f0662f4db885ddb8838c4324c17574ce066a5820a05a44ed02e1a4d653d4a7656162e715c7a632434d64ef20fefeb1534fb48485adbd7d72
SSDEEP 12288:hGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:hmnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1685523697925F98BFA1706F14C8281829B7F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6ca42af68db19c96b79cb74d9e26f4eaa4c5e8915155d4823b294985ac35d82d
MD5 1f4778c87ae5c39b808bc38e7153b702
SHA1 b474856f008de1f8dc5558808eb7592f3741d628
SHA512 63328a71d36ecaa46091e2a76739ad06be504c7f8c9a7af51013cf0830295e3f11fe51a82092c26452520aa9f9cf8cae6fdf4e2506ee949061726f294f0b5fc2
SSDEEP 12288:c1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:cVnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1C55523697924F98BFB1706F54C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 057993986dcdaf639f3648d86fb76ceb6b237aa017d655b3dbd6263141f62cdf
MD5 893fc4b3830197a58a2ca53d740cf12c
SHA1 ebde1305fd2e6007fa65dc5a1dfdfc3f1c910cf1
SHA512 ac8fd48d1db2c245e83737a84f8533b9ea14f9c31bb2a589a9c13245dc30543bc3c65c00b916cad18e36c7ccb8329424bfbb63c7508865e651a85d0d75916652
SSDEEP 12288:frGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:fbnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1425523697925F98BFA1706F14C828182AB7F0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0cc0c48eb713d7a36761355f22a2d18e86623cc2ce63be01cf940a7e2dd25949
MD5 bb9e1626e1640d374289036e7ac6e985
SHA1 5ef83a3b3a6667ed1ef9956aeb5cf0e7446750cb
SHA512 10cbc48c825de11ac6c736270e52d5da4a07eff5901bd38f9a292be134190309aeb0bdb18101cb0ef1683ad4b451cb23551a80436971f16224032b7b66aa98f3
SSDEEP 12288:guGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:gunQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1575523697925F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 14fe9947092e4abc40888af3fb3269f8c9dcddd2b9a01193fc202175df38f0de
MD5 6039ce6fdc96fd7201450a6aa2a504c5
SHA1 2900621198d63fa15b933f885a49dbb123d17ee8
SHA512 df09b735cef74b7ddd450b362207c2c3746ec6a2db674edc4370aecb7a076bf15ba21984642d2c84722cd15b8496294a7bf85d6e71d8b1f012725f3faf1aab1a
SSDEEP 24576:Ffwv/k9RX6wkyAIhnQ/tbw/2Mkjy6Fr7g0oK:0MnYIhQ/lFTjN4
TLSH
T1E185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cb06ceb420f0cbfe88f004e7e74800d80843ed177469456d08acf11b202e072f
MD5 c1296561826183b2d5581221b22e2f5d
SHA1 80a7991d2d8f1c2c2ceabb79495c2160532f7d78
SHA512 3bb41ff71b1d0bfd253d0a9e32626ad29882b22a43a9a8f99546d36954dac01b57e81d505e1f8f087c2de65bd8f3f784c3d1f04ad26202009294e646b76213b2
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KQ/lFTjN4:MySzPdLm
TLSH
T1F1066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 494cf587682458f5a771599d9f9b16890d2370eb56524873ff40189ba7a4f60c
MD5 8522386c1d2a400531e1adc245df2b33
SHA1 97428e72c52165ba5b2931e16643286c82e6dbe6
SHA512 7e5a2505a2dd5c2e5d09de8c74abc60cd610c082de7290daf42e347a181b90dcf29bae25245866d0320350520d42b2945a3d4443c4d584f30a1618e6f64a2572
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYMnQ/tbw/2Mkjy6Fr7g0oe:D47JUQj1irIhCnDHUPfF/aQ/lFTjN4
TLSH
T12565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 aef4257971189269ba9a440a5c7fd65c8504cde05971a715ae4674651635144d
MD5 f2c16ae26786ed1d0331419ec0f5255d
SHA1 0f59600ecab565666203b287afa959861797cd44
SHA512 1e04d15362bd1fef7b85babaff02a195e0babbc9083e0f5084d6e9e0a1a8b2f2dd8f2412c4c01aa1795bb4e5c4d1ba354b294a3839a6fde15ff37a926dc5687d
SSDEEP 12288:BssftGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:pNnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1BD65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b438912b918ab40b3db3d162a1f3369e4536694437c340a9603b2dbc41b5ad29
MD5 16f54ec152c5132e8874d0218895a18d
SHA1 6e336f1e2c1b19aea0312fe979e5b6f86bb2b58d
SHA512 dc1c35ce0edfd9b9fda5199ca3149176c28fb979120ef65cd94c0147f116b2d2b556e72958c21b2c8218f0b3c1624efa52f5455cbf756aced36f4beab310d0e1
SSDEEP 24576:N95+ZhUPH82th54HX/A61ZCCJIdeQZZYPQG+:4hU0eh5HeZlIdeQZkY
TLSH
T16C452940766AD75FC69980321E32D1CCAB707D01EE45AF0373C8873F9576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 15ce7f46bf2d8db2125d77ca5fea146f0697912a90e9155869fe89ef5cd2cdc8
MD5 99201cc4a89d6aa2d08697d90c52d25d
SHA1 56214ea42e30af44ec03534fbc7d46591cb5590e
SHA512 0d2f0f082751e66137ab1260b52b28e8236cbd0545c51380a454b724f51a66728bf03a8f86403761bd77f5489c49868ce113d5ec165dd1bfbda0fd607c7d0e07
SSDEEP 24576:jqwECeY/QEyxR/agsn2fTsKcyVtA9TaIAoKnKRV2l:ap
TLSH
T13A65D8815137E28FC1FA5032072A5B4DB7A4EC16B7496F2673C8453AD82AB25B4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 655646f8218f3516f1095038d587437ef737c60a54a0bc12a9f7834159f84595
MD5 182c169277ae945cea51b50d10cc3909
SHA1 f2de98b92e2319772f8b940393ddc6455f48370d
SHA512 578c476dc3ffc48fcaeb97dde6a229dc00823e98e2cedb8b046659c96e9a6ca82e1b75cccff9cc1937d1aa2bbab26ee0a49055292fe7432749eb3bd196c1e2b8
SSDEEP 12288:567lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:wFnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1C55523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9385bb6434e4c1ec5c447da7546f05472482c141002b9122a3894f18a4cebf60
MD5 dabe3d03c979d58326beb91253c1f44a
SHA1 1ca641bf2a01cc44c9b17c14ddfa560c69f1d393
SHA512 926ed3d9e327fe3477bf34d1a2676befe18c529f26f18e1cc190c768a4446ebddb12b02cadec3a87423524e809b6d102d544b3981792cb1c251878b6d0f51b56
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYPnQ/tbw/2Mkjy6Fr7g0oG:Xgb4mBIBhGFMQ/lFTjN4
TLSH
T1DB65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 31fbfa10e9d906985b8df441eef8652dc5d6424f7a00ca081b0ceddf15d78294
MD5 64408b8cd904755b70fcb44e126ea3c9
SHA1 92d2a38f5d6e11479c5ccf6a6068c9b91c9e8ca6
SHA512 727b2dfc1afc60a31ad4f11eadb3dcbb8cf92309a88f2b79d2a1d63285a3348b863e7584eb1cd12f23b682fcea74f91b62148cba36bb9669391240ea6ed00b97
SSDEEP 24576:yG88u8FpJqH1Qzria7/m8nQ/tbw/2Mkjy6Fr7g0oZ:p7ZFPqVva7/nQ/lFTjN4
TLSH
T1C785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dbeca46dfe2f75405bfd10338b9faa2c89a357d5748b06cbc3be0489d6451fba
MD5 2851119919f76dcfbfa1f640445c4e33
SHA1 4b2e5bb1b7325f7db4e3812adcf9b354265859c8
SHA512 36528042a7c23688146e7978fefeb6b292026446b4c2b1b21691cd5a5147f3348e3394213c53e669daef8cb926e0d9caf7aefbb1a623a8e17253677e67dea3ff
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYQ/lFTjN4:4G05lO43bOLm
TLSH
T1E3D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d6ad03c9292daca2bd2a39f447e8bbec170b676747c94869f7c778e364d8725
MD5 d0c2bbad594dc52c77c126f3dca159f2
SHA1 ee1adc43fbf946d48c79442896f82d7c20f6dde4
SHA512 1d9402bc0f65d0f4286f5d318a8049d120afdf9b68724e7997614d8d96b3d2619bf02506e508e65fe897aa0969a7e6e68431d08eb559c5874cd45ad1cb176439
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnKnQ/tbw/2Mkjy6Fr7g0oQ:Za5POZ3+Jt2pasx2+mAQ/lFTjN4
TLSH
T1BB65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 30cc3ff29a246a030528dc7f9aebadfb4c4b833394545522da9703652a8c7646
MD5 8ebe46dbbe7c37e4c7eb502aa95251e5
SHA1 35253e1ea9ad644158632de1947beb3480dd093c
SHA512 6c049c2db564e1204d12b4082fd97aec4a78a5944d80a27fbf7486d1332891d7f0226118b3035c68ed5babdad7994028a4211029f07a2340230c70d7818b0418
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkEnQ/tbw/2Mkjy6Fr7g0oE8:pNc/zEOVHFHQ/lFTjN4E
TLSH
T195858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3e0b8d92ff20461e3033172580b5e498fb9a8912e79fd1ce25e4c7a53287048f
MD5 cfcefa17d3873383112d0392a19939f4
SHA1 8c31d93061c4358744aed2c0445eb712e3e6a84e
SHA512 c91042cbd030004f8d88f50c0d6115792353b79bc73e5ad70e787ba5c70d8e182774f7a5743c5f6b3a61f1712652b453a275881c7c8700a8d852117d87e30bb3
SSDEEP 24576:l8kNvNnaFeYhJNtmZBmunQ/tbw/2Mkjy6Fr7g0oZ:l8MwBtOmuQ/lFTjN4
TLSH
T1E655AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 951a8a443907fe0341cb4870661bc58834ced180b0ce53b1add59794186d3ec6
MD5 7081b1d93cd76f148c0760b983fb467e
SHA1 b06e1ad1b279c370634cd37a6a07bcd533d80018
SHA512 100320e4d06c2af7c285f339ffd98736bb2b50711e9d2143ee4221d08675e46b280f1ac3587d65d90865220864d9d0ada518fcee95bbac951b50d521a58ed69b
SSDEEP 12288:aHvUrBFrEjwaQoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:aPUr+NQonQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1BF65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7340162d159251a64d42e5de7abcec1d71209a2486ffa7e79c327c4bfb341793
MD5 20646a27a60475cd6af00e8b7b4e5a97
SHA1 b9077144ddf4012a40e9c43d4b5510643c522055
SHA512 ecc022a2d7cc716c92c1785edeeb0ee6d52bbbc62166abc67f4bb4195bacf8146d64e907eea828acecfe4c30ee3446564a9ea37adb53a6042fd93eddc9054f9e
SSDEEP 24576:rD3FHshBIYQgApnQ/tbw/2Mkjy6Fr7g0oN:rDVHeBIAApQ/lFTjN4
TLSH
T10F75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/240-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/240-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/240-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/240-147-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/628-136-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/628-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/628-142-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/628-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/628-148-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/712-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/712-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/860-80-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/860-86-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/860-81-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/860-356-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1168-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1168-332-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1168-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1168-75-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1364-422-0x00000278367E0000-0x000002783685C000-memory.dmp

Download

memory/1388-364-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1388-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1388-124-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1388-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1432-299-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1432-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1432-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1432-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1448-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1448-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1448-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1448-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1792-101-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1792-435-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-433-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1792-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1792-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3328-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/3328-7-0x00000000026E0000-0x0000000002746000-memory.dmp

Download

memory/3328-6-0x00000000026E0000-0x0000000002746000-memory.dmp

Download

memory/3328-1-0x00000000026E0000-0x0000000002746000-memory.dmp

Download

memory/3328-90-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/3328-370-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/4300-365-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4300-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4300-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4300-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4300-114-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4300-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4640-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4640-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4640-13-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4640-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4640-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download