98ec85f0d98a135b83aaec616f2da133264f5e8b08d308428c98512482745338

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 5.8MB
Sample260828-cl577sem6w
SHA256 98ec85f0d98a135b83aaec616f2da133264f5e8b08d308428c98512482745338
MD5 f0963d3577dacdf32c455281fa94e3af
SHA1 0196db63349b2d8161961c90ab2ee840e686e774
SHA512 5944147b9243d550a3267c0638e5d1660b5c35d03dcfd5a9e7e321421a89c96a0a7c9af3865bbbdcb0ce5805e407b0c2ba90f5f423bb93bd1226fd0758204d05
SSDEEP 98304:/enyzZLvyUP6ZVYsPHpIPIIwy5AG8H4TWr9XKitMQM5SSDntdDpbRZy:/enyzZL6UykYpIQIZBBUYFSintdDFRo
TLSH
T10B568E227603C532D9920170967DAFBB985C9D304B1A99D3F3C07F5EACB11C25A36F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5968	elevation_service.exe
5408	elevation_service.exe
5692	maintenanceservice.exe
1932	OSE.EXE
6008	PerceptionSimulationService.exe
840	perfhost.exe
4372	ReFsDedupSvc.exe
680	SensorDataService.exe
1904	ssh-agent.exe
5560	AgentService.exe
5792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d8411013e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5adf1c19236dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c07a2f7f9236dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007c5857f9236dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bbe69c19236dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000070f067f9236dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSecurityPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeTakeOwnershipPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeLoadDriverPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemProfilePrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemtimePrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeProfSingleProcessPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeIncBasePriorityPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeCreatePagefilePrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeBackupPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeRestorePrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeShutdownPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeSystemEnvironmentPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeRemoteShutdownPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeUndockPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeManageVolumePrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 33	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 34	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 35	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: 36	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeTakeOwnershipPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeAssignPrimaryTokenPrivilege	5560	AgentService.exe
Token: SeBackupPrivilege	4372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4372	ReFsDedupSvc.exe
Token: 33	5792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5792	SearchIndexer.exe
Token: SeDebugPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	4828	2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	5968	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 4968	5792	SearchIndexer.exe	102
PID 5792 wrote to memory of 2688	5792	SearchIndexer.exe	103
PID 5792 wrote to memory of 5424	5792	SearchIndexer.exe	104
PID 5792 wrote to memory of 2672	5792	SearchIndexer.exe	105
PID 5792 wrote to memory of 1136	5792	SearchIndexer.exe	109
PID 5792 wrote to memory of 4284	5792	SearchIndexer.exe	110
PID 5792 wrote to memory of 5804	5792	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 84a0af5f929787a0b610178874cad56d8258526148e79ee7bf787d599d882906
MD5 80d62ec9197f87ba13a8a09089da7190
SHA1 cadf7e322e1958488651b18e19b25455375e715e
SHA512 ca28e07aaeff565ed5cfa715fab31e184596cbe889529bc0f284a6f0b17d354c9011a639ea5abe679e4aba7c4b1e8367eb90845106395343dd39b8cf657ae1d4
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnj5SW6H8DS52tdDpbRZy:r3q6HjB65SSDntdDpbRZy
TLSH
T1E9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d455015bcad26ca6d821de321fdc312b3bd5288113bcf365527b3fb98e66ceab
MD5 563d04eb5288dd807275af79a017be82
SHA1 1eb2d87791a118133ca9d3076fa83c233e5c1303
SHA512 9a91d80c29c63fe206b69283e95448fca2a33f13d04799452dbce28af313870f378b5781fc7b965025409b2858f719cf685eadaf7ec21473da1da83f8a496de6
SSDEEP 24576:+XYfDtczAG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dtcB5SW6H8DS52tdDpbRZy
TLSH
T17F05022873E008FAED6B8279C8B28511EA33B8554760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e4b57739cb31d3fc611a163fd06cbea0de59c97eb26073224bcdac8ae869ec2a
MD5 584194a9befbd0e4892f100f989d7c63
SHA1 60f2df4ccc297828831075c410cf8df4e18bed83
SHA512 cbd8febccbcb14619a2f0a432141ff01aff989ad8e5fdd286f57a2b86cfdcaa421ea94385b1cbce1357e7d97ff336d45f710965f450d2d8e18a70cc2de341b25
SSDEEP 24576:u0Le5ji0hmxirM75SSiVw6uAX8DS52tpz9ZRzbPmSZyo:uPji0Ac45SW6H8DS52tdDpbRZy
TLSH
T136359E15F6748332D073C0B9C5D2A69EE97130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4ea2974fc5635b0783201449e2853954e2382743860895d7962bca0c03777b62
MD5 48e7a8349eb341130f2838b6adda9b0b
SHA1 a541b1164be4d544323a04cf03d22cc02b0aeddd
SHA512 a8a3a60c8571dadd80dc56bfb8d27b338ce90921915709dde47887436b1eff0f635aab3f4d8563062e92e89c07f8484677df01179598ae14bc4b8c4b54d98981
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyuR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Y/ezSC6vUzPvxHjyE5SW6H8DS52tdDpO
TLSH
T1FC755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 71c9be97d1ce823099d3f64d6a37ad863196ffa461f4b4697703e28ac2a8b7d6
MD5 f8d52e45f609f2c1ff2c966c750f68db
SHA1 dd02f570465bb7e1d5f06e62ab07ed9ad2dbe73d
SHA512 534cee905b9983efd77f4d5d3e447b8bb39dc334de5116c593cbb71d9ede15645662408882175d191a675cf24991dca9144ae69f6c0cab729148829f80baa1da
SSDEEP 24576:6VbqPb88hv/l+6K5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:6VO88hXl+35SW6H8DS52tdDpbRZy
TLSH
T1BF559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 15fa07a9e9d99fcb8dbcaf55764b0fc479160f22d66d45d99032b495e386f8c4
MD5 fdd5b1d225af039ff929b04012ec07fb
SHA1 aad648b9f92a5a056bc8c5f3201cc5d6cc55dd6e
SHA512 58c0a91fd9cd4b0323a380ba37ea5d2d2626141fa40131c893811bcd390f5562c13c11f5425f43e0015110764c14b7e735c525bb3d9d21afd57a4316238dd5b3
SSDEEP 12288:bRf5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6I:bRf5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13AC423C4479030A7E31F0AB3F1FA96E4DA18EDED8408653B4E717687CA3998BC577426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 25d68183102432d5b251e08c813197638f4ad0fe5f0cc7eee73a553678bc5797
MD5 7049a802612fbc272bb531127935c4d6
SHA1 e90a62e89f61cf5ff1d2d10ab2c95893a1f044ca
SHA512 88f163087a14382bd93db46e44b81b94a388e75a50a5da357c8711c344a950903eb4b8b5b4451212d778ebcbf9f9708db6fd8b29bfcaa7e1410f154cac17f3e9
SSDEEP 24576:vJIUi5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:vJIUi5SW6H8DS52tdDpbRZy
TLSH
T11905DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eddaefd16bd81f4ebfaca7bb2be932cc8e20d20fab76886c238b897cb825a344
MD5 def2fcdfa0b3e43d59bd8e5324ea8a90
SHA1 8b743bedb9b76e086bc9f9706e4452620bdf6449
SHA512 9bbafb2d5eed01c88c033517980b7bec0abfa73c937297027c31f25590bfbc13dada6cdcac65dfddaccab7dce422f9a417aae07ca1839657790aebc9cb28e9a4
SSDEEP 98304:TQvGAdlCEL8c/yRNw5Ch5SSDntdDpbRZy:8vyEYc/y3w8jSintdDFRo
TLSH
T15C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0bba64a65d0ba57373ee5f4f460f8732210e97133716b4c7701e8d163d4be9bf
MD5 0dfbfa55c7456e775b23e10e2c2a09ea
SHA1 764747d8fe6f14a01c050b9e4371d5f532a7e68b
SHA512 1484db1d9cd7e82ca2f5fb4f16d2921b9fa1e52b8cab066f42fadab94aee89b487752bebb79739204c7ebf4b609df13531f395c801d86dc952e18121d7c42f7d
SSDEEP 24576:EdewsAjI5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cljI5SW6H8DS52tdDpbRZy
TLSH
T1A215E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1de8921b22703fc74ac0d4f061fb0dd0f35c7c48b85475f991fe1a28e19df852
MD5 745c9c81d9a347138fda0b51d57e2adf
SHA1 a0c518312bcde178b697f97e3c8266706bc92d90
SHA512 d355a0f28f4cb08dfdab6a37a5c279288ea2308fe1401af4ee33718b2a59d1aaaf8b8caeb5922cd45c0eba9b4cb29450ca2bd88a0a5369769c1ca032cdbc1858
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmSintdDFRo:iUEtQevvqc2W1cpV2EI32vedDFRo
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8fcc3a828cec69e6f153c090df452f2c7284dead022d05891c9d9eb3fe14e644
MD5 adb96e3f355fcf164b3c7d6ece1d1c96
SHA1 9bb2fbb4779e642b582f532ff597725015260ebb
SHA512 7ee8e7499a2b115671eeff83f669f52d08067dceee99e32e791129078081b011098f7ade697f19e7356b1490ae94806553cd1dbf4f90c4b25b5606c336a47760
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zo5SW6H8DS52tdDpbRZy:boq2Vjnm95SSDntdDpbRZy
TLSH
T1DAD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a501b5bdf55346b9bebed1a38ae946b251d14c9649cb19433539934031601f3c
MD5 bd9d4d548ffd38b2454e8a3748246dfb
SHA1 c0ed0cc66736abec8f39bc0590750090183698dc
SHA512 286c056c1829d112ee3e3aaff006a7aa0e245fa0df401657f304c870b7bea32453974e8e50c2725187abdb650ab9ca0b476733191f7c2696a4689348770fb998
SSDEEP 24576:UAhGLJIFoiwtA5l7S53d5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:UAMyFoiq5N5SW6H8DS52tdDpbRZy
TLSH
T12235AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 45051df8c10402ae74584428ea4fe460034ab618e5fa67b202b0029f29476324
MD5 72bb2ca140b30582598ed6ac760299e4
SHA1 b74f984ec6df5b746ccb2742b1a3a2fb3731d71f
SHA512 5c3bf3d6ec0ede20987785a3bb2f5e72d1677238140293fda058c990ae40ad09608bbe365ab1b033d27a152b77b79cf747fd87e1f96e8545d18b07b981add31d
SSDEEP 24576:8wuoOWk5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:8wDOp5SW6H8DS52tdDpbRZy
TLSH
T11405F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f0fa465342ac5be5c75d359ead9adae205f73b63808d957526ff4dbe5114fdd0
MD5 ea1af53ee77b18445d8ffa83b6196c9f
SHA1 6d5cbd09ee4961896dbfb628b32e4c1ef5f34978
SHA512 f3af4f9662acad3d1ada89f3cafdc8c12e6fb654514db220b12afb54969321900088302a0a1e79ca18b33429a7bda58018547535c230ce56f9a22c0cb8829fe7
SSDEEP 12288:zBZ1IyY5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:dZuz5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1EFE4128923E430FBE25B427AD9F58685D771B4A6533443DF0A60429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1226b90bbe94b90025097f542661d5f03f142493ac447015252ebc1ea82ec233
MD5 fc8bef0e6823c7ebad4a4b9142380052
SHA1 f74d3bb5ac9ca087a01a2fd0db0dfd305da77b7e
SHA512 007af910e91f68d7f30a2ba96fa9b40b7023f753878cdbc4eb8df07741af1e5d38765c07c575a1597593bbda8e9a337996cc28c8e8b57b9483c9324fc28b119a
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN3e5SSDntdDpbRZy:VQyiKayX+PNESintdDFRo
TLSH
T1D0667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5bfd9a1414d1223156b0ed35039d91bfb9f50d27278deb4293c8b9d14b569ed
MD5 f4176cd996f8051b58225ae483881c39
SHA1 20d4d49802102e2c4473905bca76588041ed56e5
SHA512 528659eb01656018aaf86246ca2b75a3f3b77c52183018675555b4b1e6de704dbb9f7959cb028c6b118043d976e9b7bf8779256bf227acfe732fa8833072061c
SSDEEP 98304:FQRQyi36YOcPQLvw2gAf+PN3e5SSDntdDpbRZy:8QyiKayX+PNESintdDFRo
TLSH
T173667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 730d3bff4b2fb2789d6fc4e225fb9b8a6c7a43fc415b202a858c6102f46fc431
MD5 d489ada16e53da3a7f86b3cda87d4a36
SHA1 2aa2d72b8dddd88e425a1f77f40c40c2de8530e0
SHA512 680aa1b8390819a7c5228070a8feb3b9fc87676cfdc00bbd1934d47027f3015eaa56892c082e318eb92c2006a4744315eb75814ec38155218eb7d2c6f4843afd
SSDEEP 49152:068Qg55nhheWu7PNU3/45SW6H8DS52tdDpbRZy:ethWRc/45SSDntdDpbRZy
TLSH
T10BB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 17166ef6c19995de62a3e922e6a93ca83b5040ce4f71b3e607c5e0a335047a2b
MD5 be4e59870b1d23524c6df74afa184390
SHA1 adb1ca4eba00fc5f2b3029d93c9ab4c23763f5ac
SHA512 5471ccc8cbe33561feacb6904afb4f2bb353dd7c74ea19afed0a6b10036647e9f73869d955c12c47117c063e829f394c7e94de1d2a02a2e5b768194a22e77a9a
SSDEEP 98304:xy5112gYy5azzVvL69nLKnhZf5SSDntdDpbRZy:MLIHmWh3SintdDFRo
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13dc792438de3ff3789700b243449610496f55d3c74cd1961a541f68bb5ba8e0
MD5 72a536b25a02de79bc66c59f235e3d85
SHA1 ddf8217d3fa109bbbd86ae50b3b99739d804a78d
SHA512 e5e3aae73564faead4913b72b7360af154d14c90e031171a1469bb4115973b78a96c152cb034af6754840ed5ca9363124d88efb483463342dca7ebbb1c321ca1
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl25SW6H8DS52tdDpbRZy:Lu6JmVxd2d25SSDntdDpbRZy
TLSH
T189D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bfb09bc92ec196609503d4fa44c527f371b50d61a97d6d08a1857f5b332592f5
MD5 df16cac22f0c3af1e0490f324c8fecb7
SHA1 ec5156f04a6ba160d4e6242bcd3dcf8960adeef0
SHA512 73a747bc9c5a75fbb9cdac251f504ed095a1f4bc81559e4545e26683a1e03f6415137216c6bd9796407df3a92a8e9428612af1fb292f6649c686bfa9032f5943
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xC5SW6H8DS52tdDpbRZy:XmifPbR95SSDntdDpbRZy
TLSH
T1C8B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1a4ca3aa1d6344627b28cccf4425a79b4c37655e452ad40c3ac4c9eda8eebabe
MD5 47eaa06d93b3a9696a18ba41356f2de2
SHA1 b408913bd0bbbc7331538a77a4dbf42022e16466
SHA512 41a82764a2f15656be5440931197bfeb29123e04cbbb756cd542d16de1545d9d490f48e03a805a50192f8d7b699fb5f450c378bb4a3431feae2678015544ac5a
SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHqz5SW6H8DS52tdDpbRZy:15dKTi61z5SSDntdDpbRZy
TLSH
T19BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0587ceb39de2cc5ff93d3af1de29636ed8cc4b71e67e9bafb033be9822c27058
MD5 4d63344e2f1d783f76ed67187c70303d
SHA1 d5085d48894ca233654d3417f0389846f2c06367
SHA512 8578321f1ab70cf9ae1602664e64eb5fbcef975ed8a96705f3bd6032a13f00ac258b6d3af4b9a8f78bb1ff182c4503b7f0e099294e5ef15bad183707b141c7b8
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wG5SW6H8DS52tdDpbRZy:CX2iyphJ5SSDntdDpbRZy
TLSH
T1BE95BE13F2D900E8D05ED175C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f80b3877315539d924568b31e53f5f0491fe9895bbdaebdb9d6016ce69f67432
MD5 d0ee582b241037f06209c99375f68bcf
SHA1 34272ac054e20cd84a2cddaa439ceeeb49663baf
SHA512 8e2096c64f9c4b1dc4c28d086128e2d5c050a01ee028103a7e33e99c73796f8651ef0eda0e46153affd87a9869b4f2d89d70fe1324fb1f839a9f6148285c6c02
SSDEEP 12288:P35OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Q:P35SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1AAC423C457A121EBE30E0AF3E2F686D4DA0CA6EFD408623B5F716147CB35D8B4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 057c5dd59357dec46248e273fc0559e2853069715b3520b5a78ecba9c9ab7c01
MD5 04ecf7022e30bbec264f3e92aa1b20b2
SHA1 2a800845a71ddd0cde1d18ae5bb839d4333f6f2b
SHA512 8f0c1fb922217284e7a835fe43e257172494efdc729370787793e544c5ddf3eb756e9c9455d1841a3fe5500f6aaf3fd88e05d9c1446f52c1e63ca4b5cfb2c867
SSDEEP 12288:1M5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Q:1M5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C5C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E719147CB35D8F4676829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 cde09230d0a91c09a049547aa431d01a9733acf9d56c0f5a05c2686a08e8c3e9
MD5 33dd2b67a91272e31c55580c3a1b076b
SHA1 3673a6f1b69ae52d621c488498bc74e0096a2093
SHA512 f28e825da077e8b3890ef141c1b7d7a0cee2b8ad037dc64e955cbeb9cecda0ddd7cbf3c17bae7badb3ce68c5b44fb28fa5afbf71ba5ff6ea534d303ca6ee96cc
SSDEEP 12288:u65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:u65SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15BC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B9E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 eac6ee33c06a77a1c1af7de2abe323ecba5dc7b754d4acc68cddc2f872f204a7
MD5 24e6734c0bd8263f811127e0f8c5294f
SHA1 1f97e89517e87aa2cea84977a0ab426cbbb5a6a7
SHA512 279b1a7e00fc264dc27a8423bfed6e6f822a90cf6785965754d82d6807782b42ab1b9cfffc649e3c79067356358411415203a4d469fda75f90bf742c393a48fb
SSDEEP 12288:4V95OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:K5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1FAD4238417A121E7E61F86F3D1F682D4E628F8EED524637F4F20054B8F31B8B9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ef4906b5f5ef2e09bf1bd81652d3afe12ee4a645d8628152a6d610991e97bf7c
MD5 81d3448caf68ce03ff5eb36ba223c331
SHA1 8dd6278d002e11d37403982e66f74a427ee8f906
SHA512 caeeaa393d60ff352a1e648e2391ba2a6f5c5a3e7d51aaee6df23192b0892a7a61afe30f391c2d21aa1a211998330ceadbbe520f87ad58a94eedeba3d05dafc4
SSDEEP 12288:NF5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:NF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T16DC423C457A121EBE30E0AF3E2F686E4D91CA5EFD408623B5E716147CB35D8F4676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3fd644524ee9a69912c7835f7feb9fc8320f8ce8f19797aca9bddb2d2b92dfc5
MD5 32511a420ed6cf7d38d9564150a4ab68
SHA1 67ecf67cb3d2d84039be809db1f89fa96f215ae3
SHA512 da1aa396ef2f88ae156843fae6dee1ce69e70e96672b0764aaeb7bd58107e2675f237066436064b014107afe7e23053d714d4c937cdcaba05951b58a7f711444
SSDEEP 12288:rg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6X:rg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T18BC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E719147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0e9d7c81ec0a53027b8701169c5d121cbf0a4de2cdfd2f990031b9e02ea33110
MD5 7477992243a4b067e5035f0b29485164
SHA1 b3f6e0d54377009b3e91d7f741374579adf3e58c
SHA512 19796a6ed1ff99755a1493329c4eec219c71b4fd71e37b35a400abe37abd92e33434e9177d98a54a5c0bcf867e599bc306b270aaf9d4d2b1b29ee2d780259e61
SSDEEP 12288:2U5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6v:2U5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1B5C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5F719147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 92587838fa39df964f0c071293eb3d7e6ddb74a9f2795122a9adca3d3a8650f2
MD5 98e53fda9e6d67802a37cf2697142109
SHA1 8383bbf9a2eba57d675c82978628c8a8332343a6
SHA512 95d2ab2274b9cf4dc7d2567ce82b41938452ab88b6fbb1999a8058269a0fb698c584c6714f6b1e2014714829c6d504292c0fc981d08fd278e3a5f55e67468094
SSDEEP 24576:eZMSzFVSOs5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eZMSzfw5SW6H8DS52tdDpbRZy
TLSH
T119050294B39018FAEC67823EC9658945D6B2BC5A0760C62F07F436675F333920D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7761bff66230ba9537f0df7c0fa6dc07046e6d108b74e0eb131bbad9cfa58e80
MD5 195497e915d3a925a3fe1a5ecfd4ffc0
SHA1 51623160ac3786d1b1464bb6f802fa31a0196999
SHA512 35e4f63fe7aeba7bfe30ed50a02eb19faaf96753b138abd4f452cf3ef0ea0592297e2be0a0bc5502530992b123443962b27b68fc00022a41d6f9a4c35fb09dcf
SSDEEP 12288:HD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6C:HD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T171C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B9E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f0cce0e0d7d8f59f07568b93f2b4d999fa392435abf52311500a8c1e3dbba1e1
MD5 cbc1993f3b5ba9a1e5d2c4e71a20955f
SHA1 9863484eac151183e812fef945d75a6f11152afb
SHA512 9cc78dc09ba2d07df59be194123862b3e599ec82523337ce23ecba84d94328da219bd651b062a2eed40864a8f4edbed80a502d41ebd8e29ae0904b2ae0950e6b
SSDEEP 12288:Av5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6C:Av5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121EBE30E0AF3E2F686E4D90CE6EFD408623B5E715147CB3598F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 891a1ce9bb502d043c8caf748d980cd90a057c0d2ca634c02136f28b47216eba
MD5 a3be6564770442008fd91f3219daf087
SHA1 75c2f290bd53805c36bc5e0f43174fa714f14ca4
SHA512 b1fcd3501fba4693d66377b73af7e4fea93f4d36b528d55a571d5cce41804e97df3324d1e5d93cfdbc996fa0e7c179d43ab158ce5082fb844e51905835f892bc
SSDEEP 12288:8yPz5L8Y5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6E:lzyY5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1BFF4024773A130FAD12B8275C8A20A41F775B87647249ABF1BA007775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e0a35c23d0b170c73f2e8023f087e61138fa26ccbf7820d2bdc100be6535f3f7
MD5 c16c63c71196497c12d3f5b17166e657
SHA1 3e186cbc94c62fa5ccdf231d52c262664f17d928
SHA512 1551d97d7df46b951f0c33d642870318aaec5947284a996494d4e90428823692c99951553728db891e6209ae2ab8a6b03e16e57411e5b1604c6af789322823a4
SSDEEP 12288:kD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow69:kD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T161C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B9E715147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7852388820aeb5858148a695242ba8371be0b674e90812c85a4b47bef8d70d80
MD5 0c1eb205147ee75b7716b4a3368e9f40
SHA1 aeb40d556dda27d5aafc22193738b5d4ce4a9927
SHA512 f293026a1aaf08bc0c38056696f5a58e3a7df22942841dc9f679f0f866f399d23138ed5a56e0fb4475177316326265c8b5f016be65e68402a7b6ca07321154f1
SSDEEP 12288:nD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow69:nD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E3C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B9E715147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4c7ce9933409ca96bd114392814aac6cd3da937aa7607d195207211b534a4206
MD5 d0b950a310dd1044b5680feeacec8edf
SHA1 a042fe0eff94ce7d1fde2ebcc43a7522157a0b4d
SHA512 593f47469ccad2e32d48fa5927eeb026d60500a90fdf44696a588f7cf0e3e6906f40de495ec702e6fa784b2f631591dcf07654952fc1cead6e1b0b74b7c6af91
SSDEEP 12288:NyPz5L8Y5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:kzyY5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T170F4024773A130FAD12B8275C8A20A41F775B87647249ABF1BA007775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 431e6db8be544320ad2bd6cb6fdc66231396363979596f505142597a81ad2c76
MD5 f220a6104573769a46cfd318c7da6c1c
SHA1 c4539d34f3cc2fca445a06794698f943c506f280
SHA512 37f243983dcd50b4d4ed1e7016e2ccda7650db1b0f4094a5c72436caf31ed3c4b484b5fef04d442ad439ad14c0a72f321dec4037238c38d97c707777e6b68d0a
SSDEEP 24576:GTHaLl3z0zDq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:GT6LljR5SW6H8DS52tdDpbRZy
TLSH
T169050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1fd7897c87eb89fe0bc84aa7e4daf95a63995b23cc7dc514a97efdc5bfa0acf2
MD5 944ba536af3afbe1b72ad6c24557e9ea
SHA1 011a5f160efb7fde8572807f1ba21c6d6d388fc3
SHA512 00714c754c53c6bf1ac878433bcd188aa32bfef037a03dfea3b7231a0a082ac6c47e56535438e66ee1d77b19e508e4ab9c047438e7ecd852a3d5e6bbac99a9d1
SSDEEP 24576:L37d9CHKy7GZ+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:r7d9CHKyaw5SW6H8DS52tdDpbRZy
TLSH
T13D25CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d298c905272caf6094e07bdb4fd2eefe51cdffacdabe30a1b94e69ccb18e0ecb
MD5 c92aa7003a83246bb3a029ba3cf3ec8c
SHA1 5c20e93603b1de9fc746a24b35b0740c67387b0c
SHA512 65bf3117bc66eb7b90bb4d7b5696ab2fdccb940b403aaa79afb6424057defa6446f89e2ea8eaaa4f9277e3527631dca10efa7abc65b8edb0bd071c4550f70fd3
SSDEEP 12288:Qa5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6c:Qa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T188C423C457A121EBE30E0AF3E2F686E4D90CA5EFD408623B5E716147CB35D8F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 579dd589aaf09d9c145db663ad404688040f80c977845e4fac222c1e88d4d0b5
MD5 4665d084b6f2634e58c368ba37c639cc
SHA1 04531f3c64f4e03639849201e7d95eb799971532
SHA512 2308fb1439682cd816e309b8ca5d89b502959dbe649efc5e2417e6aceb2ec019f91a8edc9a7f171f345141b26255cfca3713d15ae881625520f941eb09c85c4f
SSDEEP 12288:145OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6a:145SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T173C423C457A121EBE30E06F3E1FA86D4DA0CA6EFD408623B5F715147CB39D8B8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7b84f650be424ab6b91b9765a90faed8c8d4e0da184f7c4e86526f35462fbc60
MD5 ae60f5177d1f94cdb36f3c02b28e741a
SHA1 3a53029761199ce4cbe33ecaf3ff2082ba99838c
SHA512 d9caf72e73b1a82bcb4a33239efea670be99dfedc83a4269479054903978dd9c5ff0c742b2332bdd7c2f88f0b58fb756e3943d1d9befe34e6e7c86d769194fbb
SSDEEP 12288:xZ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6G:xZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T186C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ff9399d33ec6d2732c24b68b9b0116808e47a119989f205f5d1c05fdad51a594
MD5 bbff4856f6656df75d73aefe4478a9a2
SHA1 d6d92d0b5fc1ce75a1906adfed1a234a3f52584d
SHA512 d8af687932b03f43fa1c9b741b63108bf1cc168b1c341f80110ffcb291a4df3fe4cab228495ef7c9103e9979f227d3056ee747a437fdc95b056b9822f4e1e12c
SSDEEP 12288:aD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6R:aD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T18BC423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B9E715147CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 3e01576fce25b38db5d10f353aa7f79c0be7551a9c70d5b5ea5010ca68166d05
MD5 1e51c0b4e24f3fc0301ba288a8f233c2
SHA1 2c90a48af6d837af459e53c866c77c0f301daa02
SHA512 18dc3df53ce452e427ae3f5beaf9286ed20fe1c85241bc3611176769bc186ed57a4c6518dcd0348310461aef0004299eab49f7834a54f420f13e08ef04330c8d
SSDEEP 12288:Ga5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow69:Ga5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T10EC423C457A121EBE30E0AF3E2F686E4D91CA5EFD408623B5E716147CB35D8F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e0e61affb7bc20b90fc7eabca0c3b92843d59d221f6f0b9be5fbab1e8e823aaf
MD5 3dcc4c8f75512a590aa9f02bdba4499c
SHA1 cc0b3c60cd285ffbc049d57c06e3a89c754ce932
SHA512 7a4436494219f20304f750629a73385f33b3290362af591321d3700168e6f2b7520306216f0f5799dfc8f6f070528363bde5aff670c63d743fdd9e06d474ad20
SSDEEP 12288:tr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6D:tr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T114C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5F715147CB3598F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 928c36284ae476852d34e92154f9f9311d2e669de510600ac720cf87373d5579
MD5 568f92fb89510a28bf73acb40928ef18
SHA1 7e54fc4fb44fbf6f64f110775c75cc2199a5d2fc
SHA512 da8857157596c3b2ba79f94bd66deba5094b569d4d1a19ca6dae3d03f95599bea8845bb5d3b7088dca0e60b9d7e9b6739dbbe650fc074dab20355d35a5900609
SSDEEP 12288:0F5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:0F5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T128C423C457A121EBE30E0AF3E2F686E4D91CA5EFD408623B5E716147CB35D8F8676428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 29318b2b39adbeedb4f4e88ef57a6efacb60e678f50b4ea9d36c62467e367e71
MD5 b39ebed69e6731002fee6536037ef014
SHA1 52269ad41bfe8a45120a5bb1e559b6397e95be7d
SHA512 cb9e8a1b5277ed9e5f9b11aea6877d04a3eb7b59a74ccdb07a42ec077587e5ab3d149de12d7755d8cdff64c5184e245fb93746d07cd5cfcc5546f65cd5c8238d
SSDEEP 24576:Xfwvok9RX6wkyAI/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:RMnYI/5SW6H8DS52tdDpbRZy
TLSH
T1CB35D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 43ace3df2f24a20e94f5d50cca406ee7cd9d294ca1f47ab1aeca25e8ba70420a
MD5 f9a271bf494b83b99d6fbded67efb041
SHA1 00aa1eefd270f5535dcae31de1c68dfbea95a4cf
SHA512 567ec2093833bc4f0b18563be748592e0f16370003bb87e5b40e906c6fb16153df54e30e840641a45cbf5b12882317be70220c4a22f27f1398d863fa819c09f0
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m5SW6H8DS52tK:YySzP+5SSDntdDpbRZy
TLSH
T1EC066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bee32924ba11fef9814ede15b3dd294bcc96e06f2dfa4a5e8920559a6e4482b7
MD5 98ad3080cdb0d9e9ceac03d5ad12f40e
SHA1 4423be2a2bfadd298f1c7c0ebef90e33c7c65025
SHA512 5934531e10fa6881dde8429c824b876e61ef31e4b475bc2bd23a90f870f622f7bdcbc9838d2378cd3e0f76d3ad07a3d0d327ee1f0e78edf86b9cd8cc8afcfc48
SSDEEP 24576:f47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY85SSiVw6uAX8DS52tpz9ZRzbPmSZyo:f47JUQj1irIhCnDHUPfF/25SW6H8DS5X
TLSH
T1AA65AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d09a77dff2c24613cadad6c8f6d06757fb18f18ad4536ac84ebfee8facf59941
MD5 4a53d7a263c714515043f187e01fb163
SHA1 265794a4ecec700e4a129e519c7c34e752c1aa50
SHA512 6f40a70bbf3a408567c5032ad05a34e359090fa6d23f13426a46bf01a93008380a838108c1795f5dda4ec951548287be8c38489718931b92f1fc5c23ddcaa05d
SSDEEP 12288:yNsfz5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow64:Lz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BFE4F149D39412EAC01E5276C7A64A80F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 64016d9b3553dfbf8ea4fd5fc3ccfe47fe8716317dc2ab5fc643ce6174ce89c7
MD5 29390734b539db8ae0055329b8215711
SHA1 16a655ce16ce04cead7c358f9cc55fed2470ff5a
SHA512 1cc089e2b3e760534d0d9e1c8af7eb3ba801317b9c61c755c74da90e59e11e101c78c19d9280b8c85e8db2ca12eaed92616027a6d60d1f1882809a4131d0533f
SSDEEP 12288:Wz+qZ+nU3fxGjjdiooCLYCHkIfcQQhEqifOwO7K+z:WzncUPx24rCEQh5qifKe+z
TLSH
T155253A10766AD75FC6AD40321E33C2CCAB707D42EE459B0372C8972FC576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 354KB
SHA256 f3e71f532f4e0912a79467ae8431cab2e8b6a3ec716812b7b10dd0bbc68968c0
MD5 dd36a3cfa9ab528dffc5820ae3ae3205
SHA1 a4bee95fb8a64c9ef8fcb605bea094924189e407
SHA512 33a1a461da97d91a68490a56de25ee16e29f166200b2c2e17dfe60fde711883f550646100b2242032cca6b76a2ef1141080bbb8168bae51cd6bd440318d11313
SSDEEP 768:T9lToOlTPBlTz2+EQMSD/TJj59lToOlTPBlTz2+EQMHDwXo/T8m9lToOlTPBlTzC:Ktcry1rcu9TJYOx1WTZ6ee3Rcpar4AA
TLSH
T1EB74C511B758B329C4B680738871D6ABEB3DB422CF6352033FD81D95DCB22963A76B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e1a770bcbdd25cfa334c882bf6e14c315717c33483af3432b278b5401cd50779
MD5 db53e3a6b143cb5e47129ddbe2fafa9e
SHA1 ab72f8afb336ec58720ec5b2d0763c6e68c77320
SHA512 366895f297ab4307815e476c7441b6eb258fa5c8e1dd3ff7b2f6285330b56dbd21557a50224c1b6f5c023f5d7f2cb5bbf4e42ede3ee75ac169cea204d413e9cf
SSDEEP 12288:FF7b5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6q:zb5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A9D4238043942557F22E06F3A1FAC2B4E60CF5BD8B0491FB9D205287D735DCB8E7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 14a67d985d910bfc90d436f9e9e3f822abfb5df0d2b4823a6676f28ff2d71946
MD5 17d89e296328b552c820a7dc23d83b47
SHA1 38a340c366f2f7e5b5f00be8334d5575df7fde92
SHA512 c4b54ea3ed8b6c6627b6ef3b9036e4d2ede0d4da851be0095b9b134d8f7a5dc9923be8d74fe0b78c9f13ad5a6c5b922b224b6051e7f027f48a1b07fa823d5c2d
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Dgb4mBIBhGF85SW6H8DS52tdDpbRZy
TLSH
T1D465AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9ce676b02cd65fcc34eb5cd89947386851fde333f09dcb3f89bd7a42a04ed504
MD5 d2db1fe6ca34659567e92c3217df7965
SHA1 85a98b40447e301361718fe778e20351609a21c4
SHA512 41cae9ac1e518b121146e56b661e23c6e55ccc0359a92d0ef9c3053fe7003ea73eb455d5e078d6c8d296741ea1b137e7bd8f15f638a9b228c1cda513fe33baf4
SSDEEP 24576:RG88u8FpJqH1bzria7/ms5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:07ZFPqVea7/55SW6H8DS52tdDpbRZy
TLSH
T18B35F16577E101F1D47BD138899646A3F6B1B4250324EBEF0BA88B521F23AD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2c71782422fa21afcb579b8a521708ca7e9eb07514a67736a90da92270a3a144
MD5 d446b72f0066ef44b9d46d2aa4fad950
SHA1 587536bfa341f00d1a3a38411c19a38e702048bc
SHA512 bb6ea4d9bb51b6dae6391e6f64ca41e17ec3d8ad86bf876ef71e66b1905ccb83c184647b7a849cba43cbaa20ff0b546c7e5f4b9623fa32806225394ce657ba1c
SSDEEP 24576:LPUr+NQw5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:LJQw5SW6H8DS52tdDpbRZy
TLSH
T14E05F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7887d4350371d219a37a1c2924e773d7037be09164da20828568d48d21b03a75
MD5 af8f286310025ccc23fc863e8843b31c
SHA1 dc2b39142572220720f058ff2421e478c67081b2
SHA512 76d9cbc78d606d5ad6e8f0dc2c4904d3ab9f2ec7448cc549e9e1f42d62347a64b629ded33a53953ca6477780dc3ffaace78f651a212d4dd4225c4ed83cd3f54f
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjg5SW6H8DS52tdDpbK:VG05lO43bH5SSDntdDpbRZy
TLSH
T10CD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b71009acc2fe18cc6af0b0c0fff2007d07f3a0f8b262af814dedd0e5005dc1ca
MD5 4d9041d01f1c70ed9e3bd98aff614fad
SHA1 21e5252f46246892b7d2ed986a6663eaf5d89d04
SHA512 273840f62e88c4067fc69a8506399efb47d5389dc41283c7bbcf7d7e9b7dc400d562aaad6313505f15ca53c342184b4ebeba4fdcfd5af389a8570999dc3b50a3
SSDEEP 24576:mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnm5SSiVw6uAX8DS52tpz9ZRzbPmS1:+a5POZ3+Jt2pasx2+m45SW6H8DS52td
TLSH
T17D65AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 215702ed5fa8e2593a9c33184efbec3120ee035533393abd4a5a12c10cab6b40
MD5 463697c75d7eed302a64eb7b5ee09c60
SHA1 9e278ae6a5e84137c4e1dd4c46e1784933542968
SHA512 96898c0966451aea425777cb862ba57c9d61aa516de148623fafdc05b0f1b6ef2791ec42485ccccd0d5c0e5c9bfaffb211b5690483b9a3373674660e26c0e54b
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkE5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:oNc/zEOVHFZ5SW6H8DS52tdDpbRZy
TLSH
T180857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e43a1a01dbc0bb663362f3cbaefb6df5586b6e0a7879de2aa35e50f0ccabe2db
MD5 819d5c7e2d1497566537db75affd99ad
SHA1 eaf57981e3fd21227783c81adb1eaf13a3b3e7e4
SHA512 9d8bf7c5c1cb99fc4f4459c9f865ff8034986e1d9b41cc08863efa6c07a6c996ac13ba9e3b929eab6fca873c4905683c75414683f53b5265d4db61e897624201
SSDEEP 24576:m8kNvNnaFeYhJNtmZBmy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:m8MwBtOmy5SW6H8DS52tdDpbRZy
TLSH
T14055AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 73ee8c133a2d95e6652fee2d671f11a974003fc07ab6a43c9ef901a97987ec2b
MD5 e69c733bde18da8357b930eed81ba9fd
SHA1 c7d92a81a6a17fb2d50940ffb68f33a92377ba52
SHA512 802e1de2b5d82ee7d44bff2b24f5a9f0abb0f7aaaf894b5024a9b466fe98ea8eba01ce44b23a0a4b20a140f60a8c8238f5e2210c0cc2e3be91df6bf96a39af28
SSDEEP 24576:sD3FHshBIYQgAX5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:sDVHeBIAAX5SW6H8DS52tdDpbRZy
TLSH
T1C725E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-110-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-104-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-324-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/680-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/840-83-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/840-315-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/840-88-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/840-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1904-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1904-125-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1904-119-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1904-323-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1932-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1932-295-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1932-66-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1932-60-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/4372-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4372-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4372-346-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4372-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4372-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4372-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4828-92-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/4828-1-0x0000000002750000-0x00000000027B7000-memory.dmp

Download

memory/4828-7-0x0000000002750000-0x00000000027B7000-memory.dmp

Download

memory/4828-0-0x0000000000400000-0x00000000009DC000-memory.dmp

Download

memory/4828-6-0x0000000002750000-0x00000000027B7000-memory.dmp

Download

memory/5408-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5408-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5408-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5408-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5408-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5560-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5560-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5560-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5560-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5560-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5692-45-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5692-44-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5692-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5692-56-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5692-51-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/5792-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5792-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5792-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5792-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5968-28-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5968-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5968-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5968-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6008-314-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6008-78-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6008-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6008-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download