964d2438099219beb1bf69ae66469ae17a878279967a41a7662bd71f1497aab8

Analysis

max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 32.7MB
Sample260910-fp8paa1vey
SHA256 964d2438099219beb1bf69ae66469ae17a878279967a41a7662bd71f1497aab8
MD5 6ce571db0d1895301fb2ae58008fabc5
SHA1 76c014cd171da65a4d57cad0c6c51039f22da1be
SHA512 7cdaa03488ce516d11171acb1a733352a80ce698b965006db5caacf6619392f5d8712aa7b245c5a04a3e83109d5df7e88f78af316fcfcc2983c3f6e147449ee2
SSDEEP 393216:1+Ep1zw6t7P9YoRMeTsqr/yF+g+kuiL7YWdRqtvJsv6tWKFdu9CyF9Q90HaePVpF:31zwSr9YoRMexgDu47YWygK0HaePn
TLSH
T13877CF92F285C036F4D240FA556A9B764B28AD201B6152C7F3DC3E6A6A309D27F37707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3428	elevation_service.exe
1012	elevation_service.exe
5768	maintenanceservice.exe
2248	OSE.EXE
1716	PerceptionSimulationService.exe
4084	perfhost.exe
3588	ReFsDedupSvc.exe
1692	SensorDataService.exe
5068	ssh-agent.exe
2516	AgentService.exe
524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\90bc232bc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fc94ce0e140dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2fc79dee140dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026a24adfe140dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d739addee140dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe
3428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: 33	4400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4400	AUDIODG.EXE
Token: SeBackupPrivilege	3588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3588	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2516	AgentService.exe
Token: 33	524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	524	SearchIndexer.exe
Token: SeDebugPrivilege	3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	3428	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
3764	2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 4172	524	SearchIndexer.exe	101
PID 524 wrote to memory of 2788	524	SearchIndexer.exe	102
PID 524 wrote to memory of 5480	524	SearchIndexer.exe	103
PID 524 wrote to memory of 6128	524	SearchIndexer.exe	104
PID 524 wrote to memory of 3704	524	SearchIndexer.exe	108
PID 524 wrote to memory of 3392	524	SearchIndexer.exe	109
PID 524 wrote to memory of 1636	524	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x0000000000000504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7ffe8423ed4cd4541b75b1255220fefde60949647c1c420e974e0a427db64e33
MD5 ba3bcf9e400dc4aad016c71b7a3a79a8
SHA1 50d48051d863236ca183d385f5ec10f993c0f017
SHA512 ceb55fd815f3239891e41f433e7c6425d5939bbea74ef0bc9c8f3329388afdb1cd1f5a9006c470b1e067d1190fcd089ce9a0fb229cdc47a4f7f989922ce1131b
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxncPLNiXicJFFRGNzj3:P3q6sjBPP7wRGpj3
TLSH
T186D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bd70ae4f8628b879079a681cf2aa0794060b0ec88af225536345884b5158ea08
MD5 ad6e1eac3c9c400481c19889be6243c6
SHA1 e23278da30061c902a5c8b7f0ccc152732bfb954
SHA512 e74e804dffdb90232e02a9c9d3d33f08172385879674a40c304e9ab76f8e92d02dcef1655d7461cfd033a0cd620cb85add57e1ebde0afa96a276baad23454bbf
SSDEEP 24576:AXYfDtczA7P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3tcCPLNiXicJFFRGNzj3
TLSH
T1E375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0f7b1e28f8dcfd29c95c6ec51c217a1e4195b327cc5f09024ef363195b0c5c5b
MD5 9787449fefce160628d33ead2cd90213
SHA1 efe78e8b76a26c3b283b81ea51469d69bb5248b6
SHA512 55db71969707831d45ebe427a5a7f8a9a1e1983b9762239c45cb960851147b1d3d0c6aabd2eb1e6278e5c3d62cc10bc84c5adbac89bfc48bba94d49a59465abd
SSDEEP 24576:60Le5ji0hmxxrM0P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0Aj1PLNiXicJFFRGNzj3
TLSH
T15C959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bcdfe70c9cb1e5b0961eeba9e0c92067d84679749805dcb9fd9db722284c79d7
MD5 69f2f47381fad802921606c59a875214
SHA1 69d9058fe8279b001d04dd3bbce13bc6a8bcbbaa
SHA512 b008b881b6f62b7b99c927f025f3171a3700d8bf35931fe08b61a0add01d9a91e52113a656e90b342d6e2cd2adfbdd1eb07d102fbd014238f494301c333f7878
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWn6q8wyuSP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H/ezSC6vUzPveHjyBPLNiXicJFFRGNzb
TLSH
T159756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ac1528f23c6828a7a5752cc379519ca1a1c876e39a0b617e3b7c7c4ae3a13944
MD5 478708987af1f656beb7dec8a42c8ef0
SHA1 658798f6242eb8451018b3901e9a7f2aef7d0d34
SHA512 9542a324578f63cbde5b607a2a20f1bf04c7feebf1e1fcc7753c45341a250333f19b4b67d2c6c5c4c2b9771354978be6fe4d31d4d23fb9b35cb51beedb9ffd0e
SSDEEP 24576:JVbqPb88hv/l+YfP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JVO88hXl+6PLNiXicJFFRGNzj3
TLSH
T139559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 506b53c106a79b50d658c94570a0e0ef0349a729a21e377671ffa013db256c81
MD5 d78f5e08265bf882c6037b42eb91999e
SHA1 f48adcbc753d2e747aaec4e124bfe13baaf2c46b
SHA512 e565b29cbf159621512b2b5d5cf7125fb3c345485071dc2df1c4e3e55a343f38a2615e759c301503f4b52eaeb8f4b96900e40c1ca9a31c5264852e368d80c269
SSDEEP 24576:kLIP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPLNiXicJFFRGNzj3
TLSH
T1D05523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA17CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 008a0258f92d18a54aeb9874094c7f8ac748cfc45017057f83905459e9cab935
MD5 81eafe57b5fef12b3f2c9404370a1c84
SHA1 0e367b550ec24d6234074d066c6f36d3fbaa18ec
SHA512 2e75e6ea65f2a2b37653fd1072905871baf8371421acd6190ad721c3d74233bd4fd978c3c57fd29abe5b8e7ff17b89ba3088d2577eaee173619a74f684ccb180
SSDEEP 24576:AJIU3P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJIU3PLNiXicJFFRGNzj3
TLSH
T1B175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b0613d75b52ab849cb34e409a8708010eb415bff4f88e4fcb06cbfa3f54864b
MD5 7a5ecd28ff36bf1d217ef2779972481a
SHA1 13214bd8fa6a15b06c5a2be80a70661c912c87ba
SHA512 579c8b06ed026f1f2100b9fc594536fd06ff372fb361db17dfd53f7b3f21f1d5ec5e41f8580f1815704b618fc40d101590ba44ddf2215a5d41eaea3a21cbf7b4
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THL:SQvGAdlCEL8c/DRNw5CiP7wRGpj3
TLSH
T101266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4f29279338b47f1696705828ab067748a0ee0daef348f7b55e19663978c6e7d3
MD5 4727f3da1c477e36641bff3ea4556a53
SHA1 4c7cb1b7ac39dc27923aa71d71c59c1bade50ecd
SHA512 252f5ac820427f871b82195d1e8daf03746f7a24bafd0a217bd49c477771b6aafb1e9c971a1a676f81da4dc2a6b80b5b2ff057a7687299f0b788de6db2a58244
SSDEEP 24576:D0ewsAjFP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QljFPLNiXicJFFRGNzj3
TLSH
T1AB75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 94711828287a08a88da65c40965e72a2ae876807afd96e0b50879a0ac3f82ff1
MD5 6117bc98114b26595cfa780b9dd2f3a3
SHA1 8198568b589d4a2d92c00ca90c8763c028e1ed71
SHA512 0b771bf50d6635f76275780558e9efd7d8c37ec5106d5e2544a5f12928b890570120d8610f48db3f36b59a94fe9fc8d57a8bdf7561c8c46b5badc3f8d90707fb
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHxF9:yUEtQevvqc2W1cpV2tI32n9
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e01066810ccaca28e8f81a1bb9d114801fffa42efa0c5e48cd877cc7b95db9c9
MD5 4dc34823de251079d60225a8acd15ff8
SHA1 4cb2c1997a8167965e1c6cdbe9032d493f5c4d0b
SHA512 470f3dbddd8ebf2f1a1b681bb1b12bbcda8c05153a50151944eaf9559821db7f1e7c6fcc9b6658d940e323f24d040ddcfbebe193f3d701627e617371fcea9f52
SSDEEP 49152:VCbRquA/m2yL5zifFiV+XenmE3/zlPLNiXicJFFRGNzj3:CoqHVjnmeP7wRGpj3
TLSH
T1B7D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 650aa241b790d7d432b48f240cb6c2cce0c05303f481546d6e0298d99464922f
MD5 f012ff3f452512d2384e1651d5ff6024
SHA1 01e69a7f25ba0c2fe5008a2d97434cde71008440
SHA512 60792c4e7416205ee1f071545cfa488fcf46eeaa4c39a56c2ca43dfbf3bd6f333949589e93c48dc03f63c8866440f86ced3aae2e3d85ce3defd8255db1db3887
SSDEEP 24576:qAhGL3IFoiwtA5l7S53+P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qAMUFoiq5uPLNiXicJFFRGNzj3
TLSH
T121359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9ee9389bf16ff8440740a18ae5b757da781457b515c7973bb261c059a472fc54
MD5 4e71eaf562ecb03a9a09b99418b26bff
SHA1 f661b79a6eaed175cb444e70533c0ae7f96f2c84
SHA512 b12107cd55d24ac0450698ad08d4b74f909b12f6cbd79a69d8ee2288da382a8ca256a185a42504eacf859abfd0e8137c50fba37f9be0110c26c649e591bbb535
SSDEEP 24576:Fwu4OWhP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FwvOqPLNiXicJFFRGNzj3
TLSH
T1F175F18632940CF9E9BA41398657C035F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d33e9f5647c33c748d39fe3a7663212f4cfeb51155b9d05d1601c57c545f7f9a
MD5 80bec070361b79acdacd596a8c5387dc
SHA1 c5ac9901c1c70d03a57cc950fcd01dedd62fae68
SHA512 6944a6cfa645ee2b19ae1ffe72aaf20398ffe72df55b26bb1048b1c9c9430309e50ab69a1998c26b2acda8bd9bf5ab3699f671635f69ceac23c6d19d6ff85d46
SSDEEP 24576:qZusP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EPLNiXicJFFRGNzj3
TLSH
T1CE65129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4f0e4d130966e142600f962c5fdf5b939f76988f8b89f4a0e4c5c378716dd23
MD5 12f4675968088bd53580fbdc1d72f86a
SHA1 0800c63412776a716cd2324e7d43348c71832f21
SHA512 84982536f2b3f47b294e0816e1e3838e61775b9d171a087ed82388ac1e0e8dee2d006259db05ec10e6c8866f0232b84db54e47a3d11eb48e68617a77ea78a5ea
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3zP7wRGpj3:wQyiKa/X+PNHF9
TLSH
T1C9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e1744a602a286571228d46159010e6b919db268a615b6ab1efeb60bdc883b077
MD5 976e6655502dbbfcff8d61ce7fc2eb37
SHA1 e6da4bc485fed27aa2352c7c50b7534543983a61
SHA512 2a6d9e5548c1713a84a2dd9fc1e26ae7bf61451f87dd8bdcbd831e89b11fef140d3deaca59c3b68dc47af1e8b26ddeb1df6c249b328a18096401a44aca900fa7
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3zP7wRGpj3:NQyiKa/X+PNHF9
TLSH
T177667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ae845cbd5e1bd1a63dde9a423b7190d19665d479b9a9a5e1225beb9f4c8b5377
MD5 240015dccbb9b37cf861f050c0a8f366
SHA1 42f5d59d43f1366fed9e3461acaf994420e040a7
SHA512 8ec220af705df41e0f212870eaad427fea15db51e365f0daef06cc322b0ebb221d78a77a52bb3e0df06f1a6a56a661685a5d438a8f9205dc8c56818666fac222
SSDEEP 49152:R68Qg55nhceWu7PNU3/1PLNiXicJFFRGNzj3:PthLRc/1P7wRGpj3
TLSH
T185B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 72c20fd08d3afcd3f12d7f7722eabf5624272260e34c87ba2a0c67c2d2dd3172
MD5 82921888c3e4337093a52e7ff811b778
SHA1 42245dc698299b26cb0efa738ce9615e2b134d27
SHA512 0030208b41a149995b0ea09d6abb591be2bed317f96afbd2200ba74136e4c4b747bd1e5643909221870be1dbd5369f94719b9c0febf3b2f71fa8ad8a606a686b
SSDEEP 98304:wy5112gYy5azzVvt69nLKnhZIP7wRGpj3:JLIHEWhuF9
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 88b413da6b0e199c76e2b58166f09d9cbea17357bd6d47a8cd396db893a1fd6d
MD5 7d9739a435eeaf8208aa0000946064b2
SHA1 2f37bafb65fa02e0b8b3af625f4dea42168d4f5c
SHA512 0a24838bb17798ac220da6b36b3d822199a2f62dc2a224a305e7912b818a64a14768ba5d9ca4c3dc8b3d9ef90ba0d4c2c04a862f60e3d4676e846b21268e7cb7
SSDEEP 49152:oB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glrPLNiXicJFFRGNzj3:iu6Jmdxd2drP7wRGpj3
TLSH
T163D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9282efd638ad5672777a8f0311c6267d0a6136a39447800e625b504d8b82cf8a
MD5 7f51d3908c243fb285f0b0cc23cd81df
SHA1 e66119e90665c13d69ae54ba3f6660899bcd6a71
SHA512 c7d3f2083ce49d0204b91d326e10a32fc8ef17a3a67d4e003d694eb8b27b811d4233e8cbb054dfe74144dca6032207f41c533a4148936a9dd554eb0d6f43407d
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xXPLNiXicJFFRGNzj3:hmifPWReP7wRGpj3
TLSH
T144B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 03bb52319b665e9bebf199dad72e9248a686d0f94f176559e464d460991222b6
MD5 43b9e2aac9d7bfd3d6d74bfce5918ce3
SHA1 f401bb4b444eaaa63ef06bca88a1684b21b4b7b8
SHA512 5c7c7f6b232c8ec2872b6c72200cacc164a5b4682f8eae0407ee59534f10b01670a16a5c8520dce0cc19525d61cce90bd1c96ef7dbabadafa215b3cd66faf75b
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqsPLNiXicJFFRGNzj3:65dKii61sP7wRGpj3
TLSH
T12AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d12c1227976a57d9a9c036ed3d5a54a2201394a87f2c9bd17b89c30da2f57508
MD5 af131adb16ea23f1f41dc25caa520c31
SHA1 e6447dbc2907958de0096f0df339a31d64d7640e
SHA512 183ce982a948c530bdf910f96938c59d1c915f390e83c767c9cd8a0a25dc905eb8bebd35bf413b2433be3ea2d7cdd0e07dfb348f04e59d5c8a3bfb75897f3dbd
SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5w7PLNiXicJFFRGNzj3:AX2imphKP7wRGpj3
TLSH
T1A695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 1d12f157f73506e3df9e2ba83f9fc8150ca2098ba5962528ba53b38cbbac4a27
MD5 46455a6531b58fd67e9f144959849bd3
SHA1 b2680d801563329b5b397e565f1d7d65b163024f
SHA512 53bcc0cdbe5a76b935c57b5d0bcc0f34feadcd6a4e2f0f23267d0a983342fa93495ff8f210e72fec8aeaff4a212c2dba8fcf09d569bfb2bad9d2baba27c8a5da
SSDEEP 24576:hAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6PLNiXicJFFRGNzj3
TLSH
T1105523D3558955B1FAFC0039C6764428F5882E1DEB5618E3E348391EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 ae10bb52235b45fa4359bb196e52e407403888c5bac25c2f9deaa191f3cc0880
MD5 f608ce1f5b54a6c53fb53a20849960ce
SHA1 a93bf55df82d71a0221ee5a82f255601f2fe2e75
SHA512 b63faca9c12713a2c8a8aaa0b945f4c900ae06942eef771615078d1ab864ec628d87d9ccfc0bef52d37f4a27c900696c0d7d7505cb777b6e869c5b328dd10f17
SSDEEP 24576:VpP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPLNiXicJFFRGNzj3
TLSH
T1DC5523D3548955B1F6BC0039C6764428F5882E2DEB5658E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 f9edad8e580f158351fec3b5326c404c7437dd214588241e3d72ef29740106a2
MD5 6a08fb9be8369d0c6b2b85561698bd16
SHA1 9a7d4b05bcf0fe291b30c9d5f894c9ae3e0260a8
SHA512 7b10493d61264ccdff3856ea0c0ee30e41f76daad89c0a58a967e8caf9da3fc2ac12375f3cf0107e60a7dd82913c718fdabaa6618b332de267c717960023cc23
SSDEEP 24576:sPP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+PLNiXicJFFRGNzj3
TLSH
T1085523D3548955B1EAFC003AC6364428F5881E1DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d990f79e11f9b3c2e412bff0a3f1817549f5b8bdff11e78b1ab604d571b52235
MD5 ccffad18b327832bfe3aa2d03ba43728
SHA1 a4e058669453a7bfe973728b3b598f1bf8077403
SHA512 fbd84eb9123d41b02d85a4677e0e3f8641773a550843b4a04e4e1df3ba746d2249541947ea89c6aa006e08c21ca9ee915ee858ce46279ae53a40dde0d4200552
SSDEEP 12288:lVebiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A5552392168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6343e06cefdc0135aa0b88e31181cf337c7ee24e4cce949e5e52ac89428d9f18
MD5 6e5d887f8e88c2bd8dd3e5d6758013c2
SHA1 2c7488deff59822882f4a4a3b11c9e3d8427e608
SHA512 3ef35b64a679b22412f4c708220edf8cf4019049d302c18e24e4ac634e0e09f0c3543e988216761d51c2e7999773741a699499756197141c67a63d8e7a151283
SSDEEP 24576:+mP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bPLNiXicJFFRGNzj3
TLSH
T1805523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 0ad45ee8b2bd200cd579d06af7fecc6d9a4b4b80d68bfc2259b1b4ec245e39d1
MD5 175ac5071e7ee55e1b1872b8fe697f65
SHA1 76a0b295f2cec567d0124df31618120e40e9c245
SHA512 77e32f9c618c28a919db3d73b871051ea4caa86f9288a8be3c07960ae9302ea3ed6c060da76fa5dbb71e8bb1c5ad687006009abd117f4781d728ac21ebca14b6
SSDEEP 24576:N9P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HPLNiXicJFFRGNzj3
TLSH
T10E5523D3548955B1EABC0039C6754428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 1a3f45d7d7fa315a6551f851b6c8923d97d5f6b1a5f5dad02553c7fbb368b7ca
MD5 5a0a47dc420c074550af0a27dc4a89de
SHA1 d1ea19f8a49a5a910b5f8025316687f1871338ab
SHA512 025449343a916e521bb332285e914943004a4e872a988594c52b810906c2ae7eb1614acdc3da168fedd607d708da51a0dc57ed05b287dc3e473f39a45791c1b3
SSDEEP 24576:eRP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KPLNiXicJFFRGNzj3
TLSH
T1CE5523D3558955B1EABC0039C6354428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ea2cd14f3fc8d2b173a5d030fead7cc3ee56ab50b20086fdad41506623c5baa9
MD5 211b8eed70da8b2dbd1724624a0a4d15
SHA1 e690981f6edcf62eee1c27bd94e0cef27a198d6c
SHA512 61e9cfd63a7d20d3d0cef960d9ed511008948316793bf3fcde26a4fdd2a795d94574f7658fca228a77f2399d9c9a767611314e1e93ba466056f3421496271e1c
SSDEEP 24576:rZMRzFVSOJP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rZMRzfNPLNiXicJFFRGNzj3
TLSH
T1EB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f6fd3d34d499819c312c5dba93e5c09044d9c7a5661d860faa12702e84ebff73
MD5 9242c6ee4658b758259efbe7601f39bf
SHA1 10a5f7c05166928d758528dc068813ea4ad64f84
SHA512 1b974e287735e73e9281daf45c3c93b47266e03b7b0d3dbfc89cff648a1149471e2670fdef0cd6e4af6576287e2a065976987af10ffc7d150c7da0ca3b13ea85
SSDEEP 24576:v8P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UPLNiXicJFFRGNzj3
TLSH
T1015523D3548955B1FAFC0039C6364428F5882E1DEB5659E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 ae802d8de3fbbbdaca756a78f23b93df90b3f341871f645c6ac03443235da9ca
MD5 3fb2ad6f3515b364c378abd65e080045
SHA1 821dcf76f8daeae29ee76ffadd5164e04333d880
SHA512 a511f2227faef2ae33a4ee5ae62652397d99421ffa1fb07a2f8bd5d98392110e4127a9b34fe4350279897982e9bdc34a831879419fb1ab941d688327cc268b4b
SSDEEP 24576:dYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iPLNiXicJFFRGNzj3
TLSH
T1635523D3548955B1EABC0039C6754428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a4c3d2a09f932e44601863e6fafddd86bfcdc04ff803f73fe3c53525073ea72d
MD5 48e765f1864f72dbe60e88816443b55d
SHA1 08ef71cd1e596866cacd2f4356fdaa4654cc0082
SHA512 7a9c8c436e6e9151ee3e852ba5b670fd3bee5a128294da6b3c0648f0498945c46d764f7eeecaeec97b4b12e7be66777bb0c454512c3c294a53693f6f74cb49d6
SSDEEP 24576:wzyVP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wKPLNiXicJFFRGNzj3
TLSH
T161650247629530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 48b8bc6bf6d840e02c123c8cef9d513a0c4e6954c15c051cdb6e28c432985dac
MD5 13b95eea6395ed6aa6815162be51055a
SHA1 f744fa7bb8c8aa0422707ac4d182a321af1c05b1
SHA512 75b8ececef2a58b4c170743a09f496547a014154d3a15a67aa525d5a8d125ea4b535b26c8f0503d20bb325632a1337cb102edca7ab65f695eae4c47e1290ad16
SSDEEP 24576:08P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XPLNiXicJFFRGNzj3
TLSH
T1AF5523D3548955B1FAFC0039C6364428F5886E1DEB5659E3E2083D1EE238FDB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 8d0279b472dbb1d7533cd47d205b685c439eec54121254b77302232cbf235b6f
MD5 4c07852dc2ce22eddc158a173259c353
SHA1 7a3f50df04003aa5e1406b8a3e90250d6211b06d
SHA512 7b7489b5155ef1bf1d42b422e4824360df47eaf8a5d3f42ca32662d4a2493ed318c37edee4bbc49df05b28a97c643ee305b694b5b37d904f379af8dea8fadfe3
SSDEEP 24576:F8P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OPLNiXicJFFRGNzj3
TLSH
T1035523D3548955B1FAFC0039C6354428F5882E2DEB5659E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b0c6f8c3c657015b183273e3285004717a01391a547a6980e2e563e751c368c7
MD5 bf21c1a342743c85916454a58fc44c27
SHA1 bb707790a9708ed5de55dcaf333ef033230fcedc
SHA512 660fc57bed6f27445dcdf6330597094e4cd7f2850dd6e04e2901ec7d6949d434d6831578b559dcb55f3f6d29e6f44cc51f0ad32261bb63b40a262ccb17002c0c
SSDEEP 24576:JzyVP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JKPLNiXicJFFRGNzj3
TLSH
T160650247629530F9E17A8139C9620911F3717C364B208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 536a923c888532c1fe2258d2021fdcb23a8f60ff13209bce171427f8ba2e1d65
MD5 50832c1eed42d94524c8b5cb54a6d1d2
SHA1 79ec5d8d252d1db66372de5c47cc364ba1eaa9cc
SHA512 3690146e54fdd1def9fb44daeccf77e303dd1cfac8eed303d50344f8b3d44f1214c2304234215dc6a927a9c0cd65ec792ac3a3830005b78c77a71af4e4b90e24
SSDEEP 24576:xTDaLl3z0zD/P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xTuLljSPLNiXicJFFRGNzj3
TLSH
T1437502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b9486692625fa6d085c17749512d3e0a7ded696ed10c802fe182a4de0566de95
MD5 0f56bf4cc181e6a9e70cb1f919d5bc04
SHA1 063fa2562cfdb7da7c4f1c260973ffccf8bdba9b
SHA512 bf72a58c0850c654c48cf4e9477709557fe8e8a4a14e1b08bf07b28f7cd868c4cbcb36b54bc6371d7a4ab8ec79839bbea2db4db05f44fe0a283839ecd8678b53
SSDEEP 24576:03vd9CHKy7GZTP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+vd9CHKyaNPLNiXicJFFRGNzj3
TLSH
T14585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 9acaa758ab1be033c0fc44db2694794d3f0f365cbaaad70f4c6f8945031376be
MD5 1b612f4e40ba0993ff4d515a9120db9b
SHA1 f01a4bfa3aaa686b698e1b982874bd615abdd045
SHA512 05b196ca5e23cf29ca108386d09e623bf9e9bfa2348ab13f90c322fc023634f489b675cdc6ed98dc9a6b5a863fc835d25f8f8ffe12e07825d70c15f0c56dac69
SSDEEP 24576:avP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8PLNiXicJFFRGNzj3
TLSH
T1BE5523D2548955B1FAFC0039C6364428F5881E2DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 1b5595edf4533e5cbc649d96e9a0c171b5e2b8f242e4ff30b272153c41f85c74
MD5 2c33be22bcc43a710b02811856aebd70
SHA1 f464e9ea54ed1b5dd9bc46731e38606fe6383b19
SHA512 6a0cd461001f84cbfbc3902e3be1b8568dfbd397bec94ee1188397479619c69eeb30d5f9dbd0f4f86c038fe16102e5d8d9a18ba2e3cf204dd6ba2ac76fc21934
SSDEEP 24576:+1P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+PLNiXicJFFRGNzj3
TLSH
T10C5523D2558955B1FABC003A86764424F5882E2DDB6609E3E3483D1EA27CFDBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 6340692b948c8e0c18a684174231f0f88c25a85ce9f1c69e01b28507400428cc
MD5 1acc184f4ee703b4ea51d0f000c1cc0c
SHA1 15a1eb6ad9148d69424da40ae32adf26c56c2bd4
SHA512 462d8bcb7a32f8a526e6be011eead54a830051e30af09eb45bbfd4bf5efe305e087f6cf20e10738fa76e0c55bb1c622192e9073271785b0842361d03714376e2
SSDEEP 24576:vaP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SPLNiXicJFFRGNzj3
TLSH
T1D05523D3548955B1EAFC0039C6364428F5882E1DEB5659E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 646eef2f6d137237c089b42a025a85ebc81b60c4ef153f4eb5692b37e5f1d96b
MD5 d80b3ef6d5d33be78d929426b8b3b736
SHA1 9ed6526e9bb490e4b495dbc681617fb20a0d905e
SHA512 d2737bc70ddb418fa58f18f71ef4be1ca3cb014a7989221547b7fc02b1a104e9c73f0db0b0994fa42668051a8a99848c5204a1de57b430bb9b43195cd552d59d
SSDEEP 24576:Z8P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qPLNiXicJFFRGNzj3
TLSH
T1DE5523D3548955B1FAFC003AC6754428F5882E1DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 6160bf6d8ddc66e9202c881e95931de0331ae040bdcd6fd13f71c6706fea8306
MD5 d717568e995e7a9c9d6738d97bdaaa0e
SHA1 fdd652a3bbea274f0d806e589d658fce8048a393
SHA512 0d4924c11ef43a3d90ef1e9aef9ea988482926717117e9dbfa18ef64098b03443efeccdfa65d00da4736c18b7ba4dc80923e10b2496e22fbd20586383410d20a
SSDEEP 24576:fvP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HPLNiXicJFFRGNzj3
TLSH
T18F5523D3548955B1E6FC0039C6364428F5881E1DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 e8b6b76a62548b92e13c383fa453f10d997b3cdb59889624e20fd0db726357aa
MD5 50e3fdde7140860358c28f8bb2f8bf78
SHA1 07539b8ae68cacfd665586ffa778aac3750c02a4
SHA512 0c46986c3336cd116c4c9182930364d540a3fa034540b22a7d2833d3b4735e88a53a68f507d389283392203652f2462c468316f1f61b6c8d3609716ee5c9c284
SSDEEP 24576:FkP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GPLNiXicJFFRGNzj3
TLSH
T1875523D2548955B1EAFC003AC6754424F5882E2DEB5659E3E3083D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 bb6da7d8ba5f213981d7118ac98d343ba153b29ac43863d4a2598c17b50100e1
MD5 79de1e9de508b723d19cc48d3ad8dd69
SHA1 8b529c4c046c5fccf26b48f319b940f29406d221
SHA512 05b126a2e8176805728ae87939f1323f5347b67e8ba2d719418cf3416d39671b7a8596119b3bf716f3a1b782dc8de7e1f36141fc77f4ed130ef1d65ec4b359f8
SSDEEP 24576:FmP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4PLNiXicJFFRGNzj3
TLSH
T1695523D3548955B1E6FC0039C6364428F5882E2DEB5658E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bc8189971b403d3dcd25c5a63ff94081d6ea0e9b710515aba2484a8285689892
MD5 eeda208e6c1fa1ef95d63098b13bdf53
SHA1 c0b1d407f717a08aed8a7132107fddde63d25696
SHA512 7f2293bac6c0b701f7172eece0e325f14863561f90edff68a0825e95843662c6557b991e6fde9d7ea552d7ef7daf5ba72810b8e8e35837bd143397c9329cea55
SSDEEP 24576:QfwvUk9RX6wkyAIoP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kMnYIoPLNiXicJFFRGNzj3
TLSH
T15885DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4f7001a2aca20e4964a42ac0e4ba7153069929e673bd62b35cea1921fa8c9934
MD5 425ab536a392192b2e7f8bb41763f7a7
SHA1 2ec5950d013ba57b90240f040116e09769b8f441
SHA512 ef40443821eed8b26f4fa5e50209c78aaae4d9b5c468ded9382e2ea5d93a4226e614b65d9f1b8c9f9eca8a45cce21f3a3322c2910ffaf187610830a8dd4e99e8
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bPLNiXicJFFRI:4ySzPTP7wRGpj3
TLSH
T1B8066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6bd41857dffb326e91750b2ad03cc62013ab1b7542ee62c53617519af26d72b
MD5 157faab7cf7833307ab2a355b08c9728
SHA1 2bb10a9e3e4c790a8b2d9dc63094f7f08dd73a51
SHA512 c88cb0e46e2f0fc77e508be1f60e303558d06cf27a5a95a833011c27e70e802a2477e9a01e57deabe5db5b7f2c764b7d3bddff94bd73643cc23e7ef5f3617199
SSDEEP 24576:K47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYZP/TwSfVcYG3K/cJHlnFR+IGNe8j3w:K47JUQjTirIhCnDHUPfF/rPLNiXicJFc
TLSH
T18865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 490c76bd4d21165be94147e7a621051c9e5b6cd5d7f083f25834840bffa9f6b0
MD5 f5214c5e7c3e0a9ecf6e3de277ec9ee1
SHA1 692c9b9fc768a5a17e28b606d302ab8f83f6e393
SHA512 3fa83cdb566597efebbc09d300d3edb18fa7d0b815833b5e57456940acab566d13d18ebbb953a88191a8b897a3bffd3748cd0d1fbc06e0a584864d0874d54ef1
SSDEEP 24576:csP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fPLNiXicJFFRGNzj3
TLSH
T1EB65F15AD28802E8D1AE5139C7564900F3637C2987E1D3CB93C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2ab5ded47b4590c16a2d5e893611e8e1d42b1751afa1fa11325033462c7bf810
MD5 8637705d3f5715b4b006b59a4359457b
SHA1 1759fe83692ccb5db814493950528942f6613321
SHA512 74e205926d3da7b08539c2f6b112211f8ec24532c5c90a0f653e51e695af8793afd09bc63c2fcfce97abbb81211ce5b1eeb82f0f47a15cdbd6640b2ad56b1827
SSDEEP 12288:wCqKzxU3f+lXXTh17NsWVMuAmkXaozQ+zbc9ptmO:wCqKlUPMttNdMQkJE+zg9pt
TLSH
T194351850766AC75FC6AD80321E32D1CCA7707D11EE05AF0372C89B3FD576669BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5e5687dacc60261efd7763e865dc7df8dba6d43e5dbc2310861ed9591894aab5
MD5 589be5f154fadd74e33ca504798f79d8
SHA1 16d42b7f626aae1022fed74a4b5760d4e114eeed
SHA512 bef86f1ac8efbf9231fdacbeb25f24c070666715e68ba40eed6c5574d7e7d9bd671080fe082bfb4f1b1db37106d2f071051804178690b673c70f2a75b2ca17d7
SSDEEP 6144:Kb3xIG2F+ritXRXMRvHn/vR6j+7ERRmupCRvq+RPtMx2RPtMxd0lkwTWX6W+Dfcg:Kb3o+ritXRXWH//qJ4fd
TLSH
T12F55B7815537E3CFD1FA6032072A5F4CA7A4EC06B7056F6677C8453AD82AB25B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7212924d529cb40d7bc96c1700812daafb45945766e5c18fcc673acacbf4af4a
MD5 43ff797361017c245178242adf285f80
SHA1 2f15055d580e51166fc0fae7015b1fb1b1fb834b
SHA512 c32d7653d04be8bea48f44b6b331031472cdf16538d1da7c3c03d33a52faa5588b2a99836c5ba8a0255ae94310480472e5aeeefc97ac50d2473db67382d6203d
SSDEEP 24576:VUP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VUPLNiXicJFFRGNzj3
TLSH
T131552393568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8f89ee7d3e5df70102156c8077611e4babdc6f6b8161ef37e3b05f2813beaeb
MD5 1442e71d269221b0f00dca6e4fb9cf5d
SHA1 5aa1ce97f9978cc9b3e7a030511fa82d6fccaed5
SHA512 14851271aae3e8f268e9785d43e424a7ac08a7423132d3f0cc19fc36c21381fef0777f161a3bbf01a2da6c713d664f97c0e2e8a7e6f9501a41d3f552e19f5645
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYSP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vgb4mBIBhGFZPLNiXicJFFRGNzj3
TLSH
T1B665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a06d609021195a99b0bf16310a3415171163eb7c0d340ee807d9379865690132
MD5 9f8175e25a0341d9ec66e54506d5e557
SHA1 a500bc63e44dc22ec74541e15b1c822be5a67b61
SHA512 8a087f3a4f7786e57ca9d6bb425f10fc70454cc5e6e03bdab7c6013326fd3ad57005113f0de3c11b57fd730fb4fc75ba596ce542d76aba5ea1b9d3369956fac6
SSDEEP 24576:FG88u8FpJqH1bzria7/mJP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o7ZFPqVea7/6PLNiXicJFFRGNzj3
TLSH
T10395F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0617549af8140f83d38dad66c9857adf2726339d2bd640a8bb289a9d12f4247d
MD5 8f9b5114162e65f68a78484399398f2e
SHA1 04da25f4f69ca43ed54615bc4cb349d2169d3f61
SHA512 d53edc3a28326e9cdc140fee42c91eb390eb44bedeb84447a792b29e9b89ebf3cec4390a1ae86c6f5f0d3922c989eedd78c7e68c4d4a93b625fa2541fb7111eb
SSDEEP 24576:gPUr+NQNP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gJQNPLNiXicJFFRGNzj3
TLSH
T12875F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a1a5f3613be8a95f4039ebb91cc1514a462b822fdd752c029709461b9db3e223
MD5 ef0d5ee49b78ecd573a60f7a42a92006
SHA1 efdf3040cde2f13db294b7835037623afdc8c17a
SHA512 f11ece39e825497e60f3ad46f2f86b3c449790ace51cddef1b40f3c67244a7c388e152bb5442d9d7e681b4fe0e62b2df4c5b0a0ef9c039e6ef5ef35f79fdbe70
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9PLNiXicJFFRGNzj3:lG05lO43bQP7wRGpj3
TLSH
T14BD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f2a7798a5e888b1b5759525d5b3126d72d8cb1888cf75514c5fb353e4f6d8adc
MD5 eef547f46de33567e8b52c9b3977f9eb
SHA1 22a40379ac4d7accaf38b00b05fe791cfef41839
SHA512 13a86d583368a37783af55b3a3a6ae76c9ce54fa7dc3def133dca70c3abb8f71ba50f70a9559be7481aba9656fe97a5457fb4d06fe2b9406263db4b721dc332c
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnbP/TwSfVcYG3K/cJHlnFR+IGNe8c:Fa5POZ3BJt2pasx2+m1PLNiXicJFFRGN
TLSH
T1DD65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9d4154f7b88cc0d8c31d2e1da2f90906f2edbcb90f0e528133c9c752b58a9c87
MD5 0f71865679fcbd14b2ba9a63434411f1
SHA1 fb4b08a0899ae29c048813f3bf933789c306e91a
SHA512 0475c31b60fa270941ebe8a550a7c211999fbdd41952ae2f255070ef90fd063e4eb226cdd290a93a634bb3c133b4b81734520f96481b9413dccac102d8d14edd
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkBP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vNc/zEOVHFaPLNiXicJFFRGNzj3
TLSH
T193858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2d36c64fdeed497e7433d5ad503641c4f0d81e9325111c63e26b4ec9224b2e5a
MD5 6bc26d4be37fcc6a69e3ad8320fd6127
SHA1 f0136f005977c198fc8b6aed7a046672438b7ed5
SHA512 e1fe63d101d14616e4da3584cdff2d4f9d065addd71fa09ba1fa509b7e700f21bbc0ea6b3dcf2642f56c6dcf4bd5bb5815d52226a42398edfd7129fd6e44c880
SSDEEP 24576:uTkNvNnaFeYhJNtmZBmHP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uTMwBtOmHPLNiXicJFFRGNzj3
TLSH
T15F55AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 4b7f76e6504c2bc6579c8811a5428c7266211e0769916ab62b8ebd3e5cfed842
MD5 1bdf79e636fe5e99d149a7fb684a2f9d
SHA1 daf48e86f9df25cd33fc3e24b21368123845a7ac
SHA512 2f70d554a259862a49687ae1c218289c1ca4770a72c35243fe3882f4f165112dd98993ff7730f9464d015ba86e5487d7a0a32a12a968978f2c88fd4ad238f572
SSDEEP 24576:HD3FHshBIYQgAgP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HDVHeBIAAgPLNiXicJFFRGNzj3
TLSH
T18785E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/524-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/524-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/524-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1012-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1012-222-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1012-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1012-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1692-308-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1692-96-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1692-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1692-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1716-62-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/1716-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1716-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1716-270-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2248-241-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/2248-50-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/2248-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2248-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2516-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2516-123-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2516-129-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2516-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2516-134-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3428-19-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3428-138-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3428-20-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3428-13-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3428-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3588-84-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3588-107-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3588-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3588-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3588-324-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3588-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3764-5-0x00000000044E0000-0x0000000004546000-memory.dmp

Download

memory/3764-95-0x0000000000400000-0x00000000024F1000-memory.dmp

Download

memory/3764-10-0x0000000000400000-0x00000000024F1000-memory.dmp

Download

memory/3764-0-0x00000000044E0000-0x0000000004546000-memory.dmp

Download

memory/4084-74-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/4084-75-0x0000000000AC0000-0x0000000000B26000-memory.dmp

Download

memory/4084-80-0x0000000000AC0000-0x0000000000B26000-memory.dmp

Download

memory/4084-286-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/5068-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5068-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5068-116-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5068-311-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5768-51-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/5768-36-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/5768-37-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5768-43-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5768-48-0x00000000015B0000-0x0000000001610000-memory.dmp

Download