cfcbb320d3035951449da4e01738a2b9b58843a4844c7137449345c0861344fa

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Size 3.5MB
Sample261113-dedeaafv8l
SHA256 cfcbb320d3035951449da4e01738a2b9b58843a4844c7137449345c0861344fa
MD5 54547472f57663bbb5443415ebdc4316
SHA1 577f4d946ff5731f27eaa14c9654b68139ef39c0
SHA512 fdf97601cf55fc14d72865f1e2cb030ac1a0a73b646320647735a5db9f1be880e17b45a78e7037be03bead59e960d52412ced7bf4985cd06178ceef117aa9c21
SSDEEP 98304:7gsoKuxSBdKrvYYxhaXiqIzsqzE4ZweGiQnSodyP:7AKuxSBIrwYLYiYYZwXJ
TLSH
T11AF5BE12FE018532E49201B1E6BE4FB69C3CAE28133855D7A6D179784A313E37A3975F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4372	elevation_service.exe
3336	elevation_service.exe
6128	maintenanceservice.exe
3488	OSE.EXE
6088	PerceptionSimulationService.exe
420	perfhost.exe
5284	ReFsDedupSvc.exe
5240	SensorDataService.exe
1336	ssh-agent.exe
2480	AgentService.exe
4060	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8cef067465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da478b691a73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003293cf681a73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004399ba681a73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeAssignPrimaryTokenPrivilege	2480	AgentService.exe
Token: 33	4060	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4060	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4060	SearchIndexer.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5284	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeDebugPrivilege	4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeDebugPrivilege	4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeDebugPrivilege	4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeDebugPrivilege	4372	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
4948	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2636	4060	SearchIndexer.exe	99
PID 4060 wrote to memory of 472	4060	SearchIndexer.exe	100
PID 4060 wrote to memory of 5768	4060	SearchIndexer.exe	101
PID 4060 wrote to memory of 1472	4060	SearchIndexer.exe	102
PID 4060 wrote to memory of 468	4060	SearchIndexer.exe	104
PID 4060 wrote to memory of 5332	4060	SearchIndexer.exe	105
PID 4060 wrote to memory of 6132	4060	SearchIndexer.exe	106

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_54547472f57663bbb5443415ebdc4316_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0babe9036d6cbfd7bebdc0190b2f5587d4627de305f6e7638c837d6bd23b0db7
MD5 6cfd61fe1c97385afebfc3886924a3e5
SHA1 8ace6e835f09a1434b452321fb638029763b54bb
SHA512 bb05c974631ee6495626b6ad280e3b6983a9e57f3e2d7d3f84ae9f216eee16f0ed7287c97b154b14b5285e24701c6aef729a58185d16eb6f1f8e95d7edde1156
SSDEEP 49152:Kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnuB+lZxYTEdyP:83q6mjBYnSodyP
TLSH
T188D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fc339a8efbb2493d334fe8f7481b31d62a00bc8d4c7a5c5b200d93f706ac4720
MD5 b9a6b615e5dfe531b121e2a531298365
SHA1 a3f6cece6493fa34ad81e9d9ac85d2d8517baacd
SHA512 8a17b3f8aef3eb14d132633a9a1df8d1e3113a2355c8225f8127ffe3767274876989a2c05c71deb7f954d7062afe0e246e4307ce52b33dd6a516b65e15e568c8
SSDEEP 12288:41XLsswWkxy2lRq2czAP7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHw:+XYfDtczAbvhVPnpr+lZxCBTEhHyPU
TLSH
T13D65F169679408F9ED6B827CC8A28511E733BC558760E6DF03E09A261F333D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e75bdb90959d57353dfaf5f682f599cc887e2e53f497acaf353ac8e04b3e68aa
MD5 0d901ae852e7bd663c3282a970177a1c
SHA1 751c0aec371e11d725a9cc50cb6bd566459175c0
SHA512 6201de9757e8c9a0bf7a4390a9da09e116a3a20e16cc59315cfaa1682212f5a2948ba16c48a580e0bc1f50dcb0e3110a59930c03f1c0f027d8885a314ab2f5e2
SSDEEP 24576:Y0Le5ji0hmxhrMuvhVPnpr+lZxCBTEhHyPUW:YPji0AzVB+lZxYTEdyPN
TLSH
T1D3859E56F6748331D073C0B9C5D2A68AEA7230865B3089CB4285D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6c56cfc14e51a50b768007de48f6d956ae1a616679d852de26ce50c94efd95da
MD5 afc40cf662d1db1c3320881ea62f91fb
SHA1 b71dd98a5cb8ea8f6b849a94feb719a4d4ffe98b
SHA512 3c7e33695152354861e4f9d8f4cb69747000140297a2466c44f547c31af88150ecdbab8367695ec5550ad513e4f19b5c5825480d7c7e73455e67481ebd926883
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyucvhVPnpr+lZxCBTEhHyPU:7/ezSC6vUzPv+HjypB+lZxYTEdyP
TLSH
T168756C55F5788323D0B2D0BAC5D6AA9AFE3230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7d16aae9757bf09945d5772496806678baf96e3323925d87dd7e81e76a7e9187
MD5 ccd2d9fa14e1209010ed3cf44b04d276
SHA1 7438527120e351c6f40a5c1ec950bb9c5dfb86f2
SHA512 aafd0b8c7984971004b1720b6c9fe28ae77cff5aae79793aa8f491c1f94b70371fa8cc13e4de0a01bf0f7ab3b2e96c31d6ca494c7e5cb08b2625c538c7a1873a
SSDEEP 24576:aVbqPb88hv/l+BfvhVPnpr+lZxCBTEhHyPU:aVO88hXl+1B+lZxYTEdyP
TLSH
T14C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4fddce47b632a9c9f66852468818f0a6aa937b1b90f906a96354898cf0f01168
MD5 4e28e268fefb8d0269a6f7f06adf5754
SHA1 b071a740410b5c842436d3e5fc4001ea0cd8ea72
SHA512 b9343b52d9dd837c6edd23b211ae266fdcb3de78552295c2f77bf5a0aac16b271983cf564fd3514d70c70e6ddcf99184c38d55f5b4726fe5ef02064ae7c87299
SSDEEP 12288:NGo7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q3:NGSvhVPnpr+lZxCBTEhHyPUU
TLSH
T1B54523CB4F08B442DB3F86F478D548557332AF8DD84298DF8FA03B1A55B96D1E85214B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eac0f330717ff62fc151a17c3dc4372ff790f023433dbaf239e832d177cd86db
MD5 8ca0efcc02ba05c078b728be33e22a57
SHA1 e70e97bfb173ae72a78aebe984480623d9139c67
SHA512 832397d9cc3f38cf4e17cf649f8c231b4bace5cbb6c0e14ed5667b58f2d323c49d4fcc3446338b031294c34fab7115bb8bed9f1f0b74efbe757aebf2b66c4d73
SSDEEP 12288:veBNUbTVO86UL7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:vJIUXvhVPnpr+lZxCBTEhHyPU
TLSH
T1FF65CF7BEE28FCD2C27E8DB85A918600E77278718B52A3CBD164830EDE235E15D75C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f5378b9a26888fd29b75361379aab589968ffab3870615eb78d0894aea52c78
MD5 803804b470ecb714991854938196b114
SHA1 e0ef538764a2cc1113a2474488069b41f5dd1894
SHA512 28cde619772e5f5c4508b677448a2c0b03366b0e68f1b9fd8faadf14e815c09c739a6c783f9789de5c32b6f080d7609febc337394cfc3ec4f586e9c95e383642
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:NQvGAdlCEL8c/WRNw5CXnSodyP
TLSH
T1A0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ede3652146dd5527b55359e1f82bf5edce6128e127b94413b440233375578c0b
MD5 a06fb0b897b7a8ce0beea3bf5069f73f
SHA1 73c726e4f945ad01fd725667bcffffd23ca2b1b1
SHA512 f11c2cb35bbf147c8226d87108b5d5d14ddd4ca53a4065aeac86d4d01af4293aa77692b3eac4fd85be4d9bab7066211bc0291e1c16b2ad2871f23c87c2729e72
SSDEEP 12288:nAwSfxL/2Dc3mDLLmt0LDQewsAjV7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZe:AfewsAjNvhVPnpr+lZxCBTEhHyPU1
TLSH
T1B275E031FE74E032C27F0DB62B26C716143DBA208B5219C7E3E85E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ad0c0b26dc84f077083b4b61891c2d777dd5db3062662a6b92f473013dd3e8d1
MD5 883df265d6c01f29cb998cee37182a44
SHA1 100faf6633e1e9cf2d68daaf4ed9597903018e8b
SHA512 2d16773478f4d2c3bc2bba06aaba59494809cb87aa49883c29a193f7deec87f5dfb20b79f25993def64ec9517ee4d20273b034cddc8ae62fceda0ec3713e6c99
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHSJ:FUEtQevvqc2W1cpV20I32w
TLSH
T19D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0a81ae2be5e9821a583bf538907b2966fec13075556dd76373410f5fedc752ba
MD5 ce237edcdcc51017f22e9e5668027ba5
SHA1 77793122a41061fa79cd51b78707b138b7a73c87
SHA512 88dda285111218530787411d215e8361b091fcb57c2bdfb007aa35b52edbb4769a093ebb76c6e1d8182e1529056c4bf7fb1479fdfe0579e0a314aa963785fc59
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zlB+lZxYTEdyP:XoquVjnmbnSodyP
TLSH
T10FD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f7210c3bd3d1234837b803e76ca0b92822d232801651b9074e3fa39aa8746857
MD5 68e55323e5f703840f62af1badbb0465
SHA1 9d69b311ed2774024a71b0585559b56a9443bc04
SHA512 9f2c454f0cc6a15d0f04bf4ed971daa358eea3b7e7bad36a310a5390eea6f1f86a7a13c1608ae95172bde710df4872cc2e047f34e5ba542af53fe968a6d71316
SSDEEP 24576:VAhGL6IFoiwtA5l7S53YvhVPnpr+lZxCBTEhHyPU:VAM5Foiq5IB+lZxYTEdyP
TLSH
T1DB35AE81EBF955D4F5B3AAB899B68170EA76BCAA5E31C20F1150D11F0E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 137106ca8168c261eb2a027852fb30a1542a5541bd86ed1bf6b7942720abb9a2
MD5 20793e0f5821d1a05041bdf350d56c2f
SHA1 7a063ca8aee96b241574926ca4697d1c084e39a3
SHA512 c65dbfeb7b5c7e91753695d991e55536dc53aeffe9ecd58a9f29bebc121f82b0ff4699858c417161a51bbbeeffc3690aa00af4243edc3c7816efac0f47b3ed94
SSDEEP 12288:pmw5HEjsChNEBFgl0WDm+CG7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEO:kwuROWpvhVPnpr+lZxCBTEhHyPU
TLSH
T1AC65F18A77941CF5E96782788597C136F7B2BC062A21DB1F0760C71B6F373A1AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef454ee2e77af2ab3a6fd893592e29508442f6e0eb78784a5493c675e98c5c3a
MD5 0240eceb98a29d2ab8695bb93eabdfe1
SHA1 7a500914208504416417756e7ae160b4d030ba8a
SHA512 bc5643a41180b2816bd3a50c81c0c831c2ff9ecc67c5b8ae1982c568c80eb1b5fa800a97918fd596a2ea9c6cfee88a5ea67df2d9f082f776e9039fed6124b958
SSDEEP 12288:JyZ1IyF7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:gZumvhVPnpr+lZxCBTEhHyPU
TLSH
T17C5512CA2B9470F2D67B82BCE8E54505E3327D5AA73243CF0660572A2F77AD15D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2162e7d33896b046ca98e92d4f759bb240c639496a0bdf28ffce145ca4e2afbd
MD5 cc5063b8d3fc7cee02c96b633c951f0e
SHA1 eeaf7680fdbde74e286cd708b2f76fd3fcd2d429
SHA512 1032893760a5549326e301f89623ec56a91ce7b174576c3f407ea6258ad518da4bcbac6607872c9c3bc15878b5918809579201f75353aeade2fd8a47fe102907
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:pQRQyi36YOcPDLvw2gAf+PN3EnSodyP
TLSH
T1D0667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c5ae1d49b6ac4a5d21226319d94f0eef86bcd456920d5890191959d7d98720b5
MD5 1c4ffa04717891f75d62cd38b38f2b31
SHA1 6817918bbd1f543c07b0c30599d64cd5b74e57cb
SHA512 73c9e01d43eb1ef040c1ff0d7eda031eb19d21d3395a525290d7ebf986e655c002decc19abebdf824fc1657e258462583f091aa62d8bfcdd2c0dfeec59ac1690
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:XQRQyi36YOcPDLvw2gAf+PN3EnSodyP
TLSH
T123667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e00f745c0e523039a84a9954114d935c553ceea9a88d7fd09d0471d21da625c
MD5 36f24f4440aa39abe0dffe9e440c3277
SHA1 e711a97283a180a7a7e8461eb822a05281558de0
SHA512 2009236f202ee5d2a43410afffbddf4b23ae1f350e6dc6a9db10dfa28490f24f355fcf963865a7e38e65b53986c12e455f9bc7aa1140db3106869eb9dc31ad86
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0WvhVPnpr+lZxCB0:f68Qg55nhkeWu7PNU3/VB+lZxYTEdyP
TLSH
T129B54933B2F60099C44DE1769F4A872196D27C75CFE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7a417be8e87da5edb4deccf652776d0bef60c8a4dd6b29cf77812e0d16d97f0
MD5 ce0b21c7d312da94b1109f4814c642ae
SHA1 d0f7e33ea6f41df2791d4933dbe80a4d9669b4c0
SHA512 e0492ad2aafc504247dfce90a8daf576a22d49b3d593b93ecbb7789ee73b09d024fadc358cec4ff475107fe97066825fa2633fe65b3f8c0ab3535fb3945b1855
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk991:4y5112gYy5azzVvU69nLKnhZ5nSodyP
TLSH
T168167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6fd3b472208a4a532688a9e200ab4faaf2059eecc77bfee9ea7f934a077974a3
MD5 dc78a4327a5fd82e72f1028549ffd583
SHA1 3215559b5d45b5bd647dcbdaea0a4dc3aed68056
SHA512 5e887ed234633d52351d96e37ee0a9e8b0473f5f7ab20f9d50d0622d7beb5df74689626a0dad6cbc5a97e5500946317d873ba980f9393026476f2077fcb4ed56
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glbB+lZxYTEdyP:Fu6JmIxd2dsnSodyP
TLSH
T163D59D13F1DA01E8D06ED078974A9233FA62BC494B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9c232697850e8f4da38804a105174c3bfe12655c6b6a1d39ec0048bcb830f73f
MD5 a2e57c94722544373d4f2d20cde80091
SHA1 0c928746d02495d95ac7c438bdae3918786284a9
SHA512 bcdc65726250553bec9ca036d4ffbff9c406e7a387e54a9496157f02117e8234a58160d151fb7ae263f58d499e1e3cb3dcef51e2a6cc70dac2311f48cead98e3
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4xfB+lZxYTEdyP:NmifPqRbnSodyP
TLSH
T135B5BE13F29900E8D06ED17887569232EA72BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5239cce867bcd35864ac696cdd6469459554ef0d7d49e8822a4484b33b26e068
MD5 27adb7bd7b0364d0229f39c0a3adb1d6
SHA1 69c6edc26aa9a656b388b7871012c114302d5cfa
SHA512 2a6ebdb7238702f035f16a7d9e6f2f8141a8b43f498aa0c7d657593754a67d5b1fd49cdc4d83ac91f515e1bb5a7e7cc88e5372ba8828a92e04d45c0a33dea614
SSDEEP 49152:ESuZQIY0Be2KkRVtOnks6NMHqeB+lZxYTEdyP:W5dKqi61lnSodyP
TLSH
T1ECC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 decdb62ce897f49a39474382e6d852b4a2667f84ba797fb0d14973a304a979bd
MD5 1cef2469164fc6b6105dc99b2551cb6c
SHA1 ae8043460e514573a03675477401ed7c1aefe28d
SHA512 05db19d621c812b696c05056658890fc3faea289bcb113cf76aea2a67c61e9585da884be896487cf61034c2627eb19d3ee21a8a083cd038483099902ea159384
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wLB+lZxYTEdyP:dX2iWphPnSodyP
TLSH
T1B395BE13F2D900E8D05ED178C7468632EA62BC164B35AAEF0A9077561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0b8b91489acc70a181c0bface6c88a80b37e0abfa561b3667212d229c198532a
MD5 0f9565d5de63f8ab1f6c9114951b0633
SHA1 d55cf94b64501becb6c8dc76a211060c8e672f6b
SHA512 ecbb19057166688dc0c4c8495862079d9fd4862e0cc5c9f1327e74d88ae81fa249654ff53e54452a6f2d3539e624e09c9ee461c7f566cab565065f56d59eab49
SSDEEP 12288:WQ7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:WKvhVPnpr+lZxCBTEhHyPU
TLSH
T11B4523CB5E09B543C63EC2F4B8D105447336BF8EF94354EF8F90261A6AF9BD1285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 947901cc77405fe4b7c4b6efb803d8f3d3cc444198bd7ebd271f1fe4ce344f1c
MD5 0c52413e05443ed230d7d515c81e80c7
SHA1 6367eb8863082a826eca0e320f55bc54ea54b030
SHA512 16aa49c1150502b2f107b5a1310e6d28f04fa7bc96d1c2045b03e63bb1021f374fbc0f3fcb9b221081702bcbeed57aaed3cd8d1e6a3654f523091c9c67b58f1b
SSDEEP 12288:Q57Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:QxvhVPnpr+lZxCBTEhHyPU
TLSH
T1724523CB5E09A543C63EC2F4B8D145547336BF8FF90354EF8FA0261666F9BE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 14454207ea50f6c93917967bbd9661bb21a82b216baff7bfed189f13c246739e
MD5 423558fb0818e2d09040b5e6166e6432
SHA1 36d62c993f28f2bf769bd4a12e741cf4a8527473
SHA512 6df2aa771001f5bbcab635bdedf0cfc1296c4525c7923d0f76e215cf684f88bc6e0ce94563e5a3fd096d182e47b09718860c5f512ca30afd2d1717819339cc80
SSDEEP 12288:5T7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:5PvhVPnpr+lZxCBTEhHyPU
TLSH
T1394523CA5E09B543C63EC2F4B8D105547332BF8FF94354EF8F90261A6AF9BD0685618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ccd301ae0e251a0537af57ad6fceffb907ac64d8cd902f8a5669eaa08076043c
MD5 67f8b4ba9cfa45eb09e20d9d28708d1a
SHA1 c2393ca31bc5b3281b5aa4c292c04aae6bbbf0ed
SHA512 7820da96d64aadb56bfc79655926a942c019cd3837895f472a1ded607432e91bf906e39d10712e9e1a8701970ae2f27cfd24b9fbba84dd1067703818c385bbc2
SSDEEP 12288:SVS7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:JvhVPnpr+lZxCBTEhHyPU
TLSH
T1EC4523C61F09A0C2C93ED2F8E8E24555B332BF9EE61394DF8F501A1A1EB57D06C25786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 26c66f05445938fc687c17c66cf303505a2cbe192ad82c7d11b003cf98c86fb9
MD5 7e0e76a6ee2ca4cd0eec96dca18fbdd2
SHA1 a5a1b8575cbb57d3fbead6cdae859238b15a5026
SHA512 ad1e1c4e255ca907587774905895efe30acb9631a924c3d14948635bb8136877bec6dbae786a8d7a2eb9737db17bf19a7b16092ef43157b33f34fc4920df4cea
SSDEEP 12288:rK7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:rgvhVPnpr+lZxCBTEhHyPU
TLSH
T1BF4523CA5E09B143C63EC2F4B8D105547336BF8FF94354EF8F9026166AF9BE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c25579b7af2f941f9ec824ec36c64faca34dd52a7f23e08f941cef12d8ca06b7
MD5 8a8124c36c2703b14434809b3166eb59
SHA1 8a8fa1776a876befc4767545825ce59d477ac514
SHA512 808d5df8f6bed6fce5c314c5abf4a0445342774e5b6d0ded68711822ad758151f1998591b49d1e2c0ab43910d89aaee40119cd88c8314aba746af20d08eb46c2
SSDEEP 12288:f97Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:fFvhVPnpr+lZxCBTEhHyPU
TLSH
T1584523CB5E09A143C63EC2F4B8D145547336BF8FF90354EF8F90261A66F9BE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fbab604197e5bd59adca58db085ca0d34196a61accb3a27a8b39ac071556fe19
MD5 8f91cf2ebcef4291abeff11db59658ee
SHA1 a1d00a888c79dd59cbac21837483b9690666ed1a
SHA512 94d816772a56ac4d35429b1dd29e2871419d97c7d44c0f0ec6230616cc7fa7f0f23450d1dee264f0538078bb66b4308510da9db84d26116f371681262b7ec41a
SSDEEP 12288:1x7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:1ZvhVPnpr+lZxCBTEhHyPU
TLSH
T1074523CB5E09A543C63EC2F4B8D144547336BF8FF94354EF8FA0261667F9AE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f43fd366035483b891a779b507214515b7a8f19e4d05c59a48f71dcfeccc6353
MD5 af5f58eede61b591190343be6b876934
SHA1 4a3edf2ff2e53fe8ba23b90c3f5f0442ee5d97fe
SHA512 cc1a7da1c77344562a1c8b2a573ecff6282b6879d26be96091b7e9cd52eb2fdc2ab1ba89bc9ffd1ebebbdbe691f1ea5baa844fde875dc0d5ffcdc8f5a8bb0134
SSDEEP 12288:giZwbDzzFEoS2cPvyZ7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbx:jZM3zFVSORvhVPnpr+lZxCBTEhHyPU
TLSH
T1D6650195B75018F4DC67827EC8558906E2B2BC5A8B60C65F07A0362B5F733E11C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d27c2c49457113f1c038c4cd70a4f8ded47d33896ce62567acceb1baec323fc9
MD5 1b91fb2166bf13fb78a758072dc94320
SHA1 1f2f043303b5778e7a9b3d72bee3f060a54cfb18
SHA512 0897f39a73a974bdf48f5ff0f2730984aaf5cbe93909e874eac06764cbd7301ed929cc557453d59b1a2b6b8c56b20b9fae2e24882d65533134eda6cb4335e33c
SSDEEP 12288:qs7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:q2vhVPnpr+lZxCBTEhHyPU
TLSH
T1544523CB5E09B443C63E82F4B8D145547336BF8FF94354DF8F90261A6AF9BE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7106d083d7f0702f8148d2ae37544a52baa1029dc0d3d836afe99b5208352651
MD5 2b4e48baa46ff824c1fd721a1bea0753
SHA1 74c651980845c51f4c4e113ac32fc92f0bc6ffb0
SHA512 d39e4ff0e38c39e78f49b01d111e7fca3f40608b79c9ec22129df3245dac1562a279006859d729b65ced4a87c2f6154e0b588b3d2861707c740935f76d03656e
SSDEEP 12288:vY7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:vivhVPnpr+lZxCBTEhHyPU
TLSH
T1A24523CB5E09A543C63E82F4B8D145547336BF8FF90354DF8FA0261A66F9AE1284618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f6e9f751eb216d04356a802349655d54191bd624d77284df3a9814e8126ebe25
MD5 2ec1afd155ae8caef1b0918b4a95c872
SHA1 5ff8df64d66ba62fe7188d27ed6eb35650914696
SHA512 757b188d78db620d33e22799747bc2ebd94bfeb470c39fb055ebbdd5219bea79c89fa1233b7d9e792111c195b7f679731f77f6f635b0b8d61631f9838c1f462b
SSDEEP 12288:zyPz5L8F7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:+zydvhVPnpr+lZxCBTEhHyPU
TLSH
T1B1550287775530E5D13B8278D8A20A01F332BD7A972189EF57A0073A2F776E05D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2b741167b5e3584260e9385b50ef33a325c343a27025f4c54e991b51a6592a1b
MD5 618c83354bbb576e790f2f43ed762cd1
SHA1 d25ded419bd33ccd04dc65fa6995714c4a58d125
SHA512 0b054d96eb5abb68e1a852cf226eed3a92eadf7e91e3770603e0f2330386214c077cce0c2e5ecfddc7c5b10ea3cb694c650cf6d0ef109a472c094e41a75c5daa
SSDEEP 12288:ds7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:d2vhVPnpr+lZxCBTEhHyPU
TLSH
T14B4523CB5E09B443C63E82F4B8D145547336BF8FF94354DF8FA0271A6AF9AD0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b4424a2cf8d78d8cf10c796c2ad7afc236c0c1119accd440a782026f071908cc
MD5 e3844230679c52a3ee95843c156779be
SHA1 bc8e9793b271c5e89a9957262b6978b4b6708a87
SHA512 83249e5f4b37cf2fb822612e6dcc1e6642c2297d93e8fb7225955bf0af59bd26321950834c31d0f4572907d35ecd64a1ad7aca2faca73e874bb2230db674cd32
SSDEEP 12288:Ls7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:L2vhVPnpr+lZxCBTEhHyPU
TLSH
T1294523CB5E09B443C63EC2F4B8D145547336BF8FF94354DF8F90261A6AF9AE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c23fca5d57e335a2bd08ab3a39283898828e3fe25bf20b242388db8446973fc4
MD5 7f60c30e70c22b60834b64e02da19520
SHA1 2291794602e50077c680cb495d7215f1a8d116d4
SHA512 2a1a65cb4460f5e2c7548d7065de35f56440ea9d58fd0bda7e60d01096eb0ab7baec75ea9b10fe017d6e5bc552570da94ae6c7cd85453407eaffca0e1e61f7ea
SSDEEP 12288:uyPz5L8F7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:zzydvhVPnpr+lZxCBTEhHyPU
TLSH
T122550287775530E5D13B8278D8A20A01F332BD7A972189EF57A0073A2F776E05D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b2c344ba7e9acba2c4eb45317775ff53ce9cb434628b02944955e0f89915cb54
MD5 8f63fe75745df3d8fd01c36b0eae62ec
SHA1 bcb1bf1100b4beb74354f8a142b85fbd7a1d23a3
SHA512 3f9d9d6cd00ee77d98f85dece8c1630552e213eb496cd8ffb6d7d514ffa3009a0cc0ef266a1bbb79ef2a3efaab81a959cffe10d93db1cc0e0036c33d9b684fff
SSDEEP 24576:dT8aLl3z0zD/vhVPnpr+lZxCBTEhHyPU:dT7LljkB+lZxYTEdyP
TLSH
T1B5650195B35018F4DC67827ECC558906E2B2BC5A4B60C65F07E4362B5F733E11C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a0c10e985e55f1b4aeeb8d99f30877e3498eaccefcace76ba7023a5f639d56b6
MD5 91ab1ce75ffb66f87beae5e3b1fabeef
SHA1 2ca06f2f670794099b38a6546517ea9d2695d730
SHA512 a32f57768c9561df7683d446e28ae1650fcbc1a4ed1924414c096f41785ee791596c9139130d56482967ed5018dda73bb7496631e5c78d971b5e8f4ac440fade
SSDEEP 24576:J3rd9CHKy7GZTvhVPnpr+lZxCBTEhHyPU:Zrd9CHKya9B+lZxYTEdyP
TLSH
T1A975CE90F7E810E4F0B7CA7589764512DA767C9A5B21DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5fa16af2980b80b00d809a1c75138e6ebcbd08eb5fb16f3fa0630ff6b5c19e73
MD5 6319a0fdccdec857277fb442112db88d
SHA1 3ad8218dcdcc6d6968e39e7e84cb25a2432846fe
SHA512 9fd58619690b0f714174a368a0979caa279ac3a909faf481c8db70820a631bd6fc77e8abcc9e388a3efdadaa53e6e96156a0c024f2244e66bd44c3da27dec449
SSDEEP 12288:Uz7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:UvvhVPnpr+lZxCBTEhHyPU
TLSH
T1034523CB5E09B043C63EC2F4B8D545547336BF8FF94354EF8F9026166AF9AD0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5df6916e479ed934f58ef7595f082dcb4617fd3bcd5b40efefb13c2e6bc5a994
MD5 67353ddd3cee04720714a1252798bc01
SHA1 15f6cc313ed7ced8bd41f22ff5521c8bd8765125
SHA512 431bbf539dc58f6b0c08b629e0c81a2925a49e989253c4cc85fdf85f1ffd589100737038de54de6f90ece0eb290f2d7e5b985f69f0c5799165c65edf25668015
SSDEEP 12288:zl7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:z9vhVPnpr+lZxCBTEhHyPU
TLSH
T1734523CB5E09B543C63EC2F4B8D545507336BF8EF90354EF8FA026166BF9AD0685218A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 41c2e62d3459db7eef7e79875a71e8f4d6f90372d62bf67fe077534a9e8c8610
MD5 1f13c4876693809fbc00918c9213050a
SHA1 6dea65344406f98462f88e2cfc94150eaf8aa82c
SHA512 d7fd5e288452b0757bec1ac9503c8f7225e3a51b7e99fa3af6cae51a662a2121304210fb04572d871006a5861d40667b2b38974231d784555e03e376c46b0d8c
SSDEEP 12288:We7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:WkvhVPnpr+lZxCBTEhHyPU
TLSH
T12A4523CB5E09B443C63EC2F4B8D105547336BF8FF94354DF8F90261A6AF9AE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fb55ce969cfe3aa636efecad3ce7c94e2df91e9ece9afd4eb13300dcb0a12926
MD5 4914d4c888c4c223237d44db196e2a3f
SHA1 768a30780b928c0e80985f1667e231864099356a
SHA512 73707a8467f5a9c10db927e21c43ea3c6a616c7fa376700c8d07272389a125fdcdd5375b4ea151f9d2e13dede469b7a56ec78bf212e725a1061e0db3d8a01818
SSDEEP 12288:5s7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:52vhVPnpr+lZxCBTEhHyPU
TLSH
T1DD4523CB5E09B443C63EC2F4B8D105547336BF8FF94354DF8F90261A6AF9AE0285618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8817a7e04979f7dc3ce56f7d5f6bd3e35f03cf9e9fcd4b1371242c54bdfd010a
MD5 b49d549b3f5092cdf45f27fc8ae06fd4
SHA1 64bf27765745c6ce6ed0412555e86282234bfe1f
SHA512 bf95496c021ddbf65f2e744e77a10fe9f63a1ed3cc7b61389d748fd1de2b675184182a34bbcef56c86e9b6e630735fd1c01ad7ea79e4597540efbe07c1b69129
SSDEEP 12288:Vz7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:VvvhVPnpr+lZxCBTEhHyPU
TLSH
T1DD4523CB5E09B443C63EC2F4B8D105547336BF8FF94354DF8F90261A6AF9AE0685618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dd04c4a971bbcbfbfb90d46e8b934e71ae5df27efa0268c731091267ee1c5623
MD5 0f2790f0a40bab51786d10a42566ba54
SHA1 f44b2ea219269251f2409116467d5fac49079c47
SHA512 4d5af2b9b86dfd36627fdf364c1f99b3bf56a18e0b5b6badc734a606b748928e6c7f4ce8ef35eac509ce2886fe597c46958d3e1ddf29239fb2701479e7c60410
SSDEEP 12288:sE7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:sevhVPnpr+lZxCBTEhHyPU
TLSH
T1194523CB5E09A143C63EC2F4B8D105507736BF8EF94354EF8F90271A6BF9AD1684618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c11e8fb08e4aad4a3e7a3dc00711acd518db81fa9f95a3b5605640907622ec26
MD5 34042a67166db99fa86f2812b3c943f2
SHA1 e0ff42faaf4f72495fdbe8e653948781f18d60ab
SHA512 5ed15a5210b623bb97614ecb320340d2695a4e41dd67135d1a25615c47a5863195f6257e3b849b3878f9efb75ef83308ca7f79bbca03d6842e91750028e7240f
SSDEEP 12288:tK7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:tgvhVPnpr+lZxCBTEhHyPU
TLSH
T1DB4523CB5E09B143C63EC2F4B8D105547336BF8FF94354DF8F90261A6AF9AE0685618A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7ec500b243a73c3f0d2d570402f3424ddacf43da595968d7108485a113bcc006
MD5 0a1401599efb9563ea199fd7ab2d7312
SHA1 3431960584d74e78dd555b183fbb9064c00d6bc5
SHA512 1584117587ed3a393c0b6eb8e43caf8065015f18a4326ee50f4754aa47b949d878c6c0a31ff3aa5fe05530411fac116c797d6ad0d2baf86eecda248fbfedc0d8
SSDEEP 24576:wfwvzk9RX6wkyAIyvhVPnpr+lZxCBTEhHyPU:jMnYIiB+lZxYTEdyP
TLSH
T13A85DF29EBCC44E1E177927C99B3460AF2B178695B31C6CF0299536E0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5fe2f82d84865a4c087e57c7447850c28d3c70380828dac65b700e05b71ecd4e
MD5 bb61e36fdffa7710158c4738d0406e6a
SHA1 37b1bcdcddc90ef89b7f8b089e254e2a990984ee
SHA512 0c7bd17ecd05e3a4f51fb5776005ce144894fa01965be8bcb4ddef6aae5593cd004056ea0fe72f2c0dd757c3d3d0dccaf2be651f962f5fbf84aa77197259ed9c
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rB+lZxYTEdyP:mySzPknSodyP
TLSH
T157066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9f039384b6dab1bcf4fb6c3cb0c04e92ebc47e74c890e53460dc45c99ce5d7da
MD5 5376cbf6620087809cda62d242691c91
SHA1 08921e149e31d152c9e9a3b8a4ada49eac63cd09
SHA512 a9e73eead7765cd9e2d56a590063245fab97e34da90065828db771c075a4e1b428bf724ee7b8e1091b422a89a5c3f64f9cb5228c6b4530830408600a56d68c98
SSDEEP 24576:O47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYhvhVPnpr+lZxCBTEhHyPU:O47JUQjqirIhCnDHUPfF/bB+lZxYTEdi
TLSH
T12365AE1EA3EC01E5E1BA827885154A1AEA71782E5F32CACF1270437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a0aa5d79b15cfde407a8d8e354c01ce62373b7356f137ff9db8410d51994b0cb
MD5 8467aa7a41380d5fdccdda70191b1045
SHA1 be3b6e06782c4c463a65973a6903cae99425f80f
SHA512 114ef580a4aed2b79d695101e2a2e3d567fbe37c7be37f4a58313e43ef00e15240c7c6ce92c56954749b61df6db063e0395ff8d6afd2f1faed52510be0b836cf
SSDEEP 12288:vpsf87Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:AmvhVPnpr+lZxCBTEhHyPU
TLSH
T11F55F08AD64812D5C02E92B8DB924A40B3337D6997E2D2CF57D0F63E1F766D05CEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 88e8cd9e4ee879f438fc1dbb624bfff5bdd2eaedcc9411d565c4a93ac9a1440a
MD5 b6ccb523df5b5ec481bedc26f0b16e33
SHA1 515e778fa4b70459dc10b2df8c7627033a347523
SHA512 d013a9cfe5836be224393b67f9b306bcb54665f3646ea60c9a99a47f3728a1908154cee21644fdbca23e24d5c19ede37774cc27b020672ff86bdc0111359829e
SSDEEP 12288:4j7/yXbU3fFHIItFCop/NBuYgdkuUoyvGqMPOiv/pogvjF:4j7arUPRC7Ty+qMPOSpoSF
TLSH
T1B83528117626CB5FC66940325E33C6CCAB707D01EE056B0373C98B3FD576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 95aeae0e24541e50c1107d017a6e11db0a2cae1f044208f460dff846a25da452
MD5 347b7eef8beb42fe7cd07b223b45bca8
SHA1 0a105bf33a00ab6239a53415d63bbf5ae697515b
SHA512 6d47c1dd409f3a6ad5f333cff621a78730a646e119b0eedce831520b631be35d490945dd4c38216adc836fcee9808f36d3db06190f3891b6db5b35827e4fae77
SSDEEP 6144:jcHzEEDEziofwr421NwInJIChbveVo2VHA3NQytMxLQytMx3450I+NvyD8Jh:jcHTDEz+rJNBl3PyQ
TLSH
T19555D8815537E78FC1BA6032072A5F4C67A4EC06B7096F27B3C9453AD86AB51B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av360.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\bundles\av360.html
Size 2KB
SHA256 1ae30acb33c0074ba7a8a52cbf1658ea18effb07954b8deb0a685e77a7031f51
MD5 23f6794b382667b1e61a4c73dfc54454
SHA1 a48f9e9e3a9f888ccb18cdc67d39c9e12a50334f
SHA512 a5ea977e0952ba99ee503208d62662fb663e10566c33aeeeb648c430e879b895e4e93e4b26603ad0ccf2b8a426cc558ffd3656d1f50222f073bd2d94942307c8
TLSH
T16B51DD01A14F640F926AB14AF433632E4465115FB7B3D9A860E845BFFEC383186693C8
MD5 SHA1 SHA512 TLSH

Submit Download

luminati.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\bundles\luminati.html
Size 1KB
SHA256 aa4678d7d9b67a73b87cf2f6835fb4527611eac7a94ba730b40ce671e205a43b
MD5 cd3a8574ee5bcb88db458a5b7ceeffa3
SHA1 a59e423a11cedb3f51ce48e866fb1820691ab552
SHA512 7aebe4d76451a62253de364169e744db4091bdfaee3fc21d07ff97299ddfed89c6cdff40b447dac6ab992140f022ca92357198605fa857c8fdbb2789303c359d
TLSH
T1BB21AF00648FA11AD3ED650EF73277358C59810BF3D7956978A81E7BF9D283182952D4
MD5 SHA1 SHA512 TLSH

Submit Download

opera.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\bundles\opera.html
Size 2KB
SHA256 f4a3bf2f7721c64b9db371e991df3a247b6a8d105afbb2b85c2078212e8dbba9
MD5 dce7cc34d27bfcbd5fe591545a899d12
SHA1 09c83d6fe218fecd9c4427877498ad71f4b10057
SHA512 fc12ef04b9993cb29440ec2c13f60832e2902ff9d6be20d85e347def7852380d46e2e0124d341ce9e8bf246c299c48908894fcd0ff589de81711c17c94a6a2ea
TLSH
T139413301A0CB651C966DB207F532A35E9431468B73A3C8AD72D40A7BBAC7831475A2C5
MD5 SHA1 SHA512 TLSH

Submit Download

buttons.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\components\buttons.html
Size 1KB
SHA256 28793923904936ff72a5e04f40b3d485289c9847734eff2b913528ebe25e481f
MD5 573348122deae859a3b02335613c0c1e
SHA1 6b1002918808df8a4e62724141ea2b50e3c64426
SHA512 c9878966a76ae3a4af72fc8e1a1cf8291bcafe5c61c5c11cc4ac89da844b2046505abc943e27261f9c6fcffe635806f38de5b5d4e201c63a5fa919262c6e9d24
TLSH
T1F941D001705F341AE379950DF13377AE68F8450BA3A3D36870A615FBEED287153982C9
MD5 SHA1 SHA512 TLSH

Submit Download

caption.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\components\caption.html
Size 1KB
SHA256 2cb9e49ae7ce2312f179194264e374d66ab871f23b97301565271ca42c221619
MD5 d4919a623650f87afa081b85321b1343
SHA1 a18a1499fe1da53b5e5e8b4a3982b082184c09da
SHA512 71375bbdd8328e67dda41af469c5a26e7baf08414ae8349cf21f3f26255f2f5ce1e05d0f072d8a6b59983b5c742bea24c24aa4e8f7a91228d5ca08b2097878b2
TLSH
T16811DD00B24F500AE7EC181FF23277366C69851EA3E3956574A80EEAA8D283682D83D1
MD5 SHA1 SHA512 TLSH

Submit Download

Montserrat-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\fonts\Montserrat-Regular.eot
Size 314KB
SHA256 057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32
MD5 2dd0a1de870af34d48d43b7cad82b8d9
SHA1 440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e
SHA512 83df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff
SSDEEP 6144:9Z/Bu3n5921pv8hj+URIm4WFUh/ttOAA6eTMvf4BAYJT9xFyYcJLhzCx91SRkKoH:rUm16qURIm43xttOAA6eTMvf4BAYJT9h
TLSH
T1EB64F91BBF02530AF9110D315ABED391B314F9B67E1E870B90496E65FCEE0D90D86B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outfit-Bold.eot

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\fonts\Outfit-Bold.eot
Size 54KB
SHA256 e3da9d49e49dd06b2bde5968053b03cb48e1198d09ffb3acb8f01d40e221d8a8
MD5 3460efb65e7982f855102aecdd323133
SHA1 da5944914902648e42484254ab897314a08b16d3
SHA512 c4704fc7747b734f34293d6e2d10ba45d87b63d0dbcc2e484373a5511d1d07e758291b0827b4bc937dc4c715b00ce175b63c690788be15c8d7f0183d29e5c9c5
SSDEEP 1536:Ky38mkcxdeD8TQVlpvzWFp5vvRGypFmAUgc:Kw/kGdM8TwXvzWFf3oypFml
TLSH
T1E9432B31F309520ACA037EB85132976477AAFD34BB76830B44B6B719FD8B9C50E72649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outfit-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\fonts\Outfit-Regular.eot
Size 53KB
SHA256 b888638bd97d85422e9cfbe13a063648456482f4f9c0feb142ffa4d989dccf8e
MD5 72d0ccfc5a4fc2d79e603678fe7ac318
SHA1 4fa8972ab633ca8dbfcfcea8be32ec2304bfb654
SHA512 6d50569f12cbbcb8ce984c6bc2471f17b3206b4a32e24d924f5e22f8b4584a1c3a2a16a3a8f9c677f7b3f6f669196242682f49d1ed8a5326bda0897a0851988f
SSDEEP 1536:fddJv2+dkD8TP0tG8vS0MFqk4qcDaPorqz:Fn2+dm8TctPXMFMqcDhw
TLSH
T1A4335C81F382A609D747ADF8503353241667AC38F6F643175A7BB728FA87CC61DA6284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.eot

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\fonts\Roboto-Regular.eot
Size 176KB
SHA256 6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6
MD5 b9077621ce786b55c176a61456bfc077
SHA1 5f164e1bc0b6573bac876e38ca1bb2e60ff0627e
SHA512 b1f2c599804a2d0ac51d3adfe7b2d0a21c5fa1e3d8d83d932f42d30bfd26aad5972d96555097a60f8fdc4d34ed24bad2876a89cf0b27b8cd01c72c0ba8f4d02a
SSDEEP 3072:KT04ndyjyP3ngaWTj1UIW6/qFFdOzbuI41j3Sya03fYRX+57sLK2WY:KT0dsgo6wdO2ldfOX+lsJV
TLSH
T13E04F601EA42A619CAD5B6797D7CE3BE0D31D82DBD09602B70E5AF3015C9841EC5AFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av360.jpg

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\av360.jpg
Size 21KB
SHA256 8f32aca9b0613a95120c666901cdc1c5a037b18f21e59fa4b1a7993d1a1753e5
MD5 b88851b7d19b0bf72eb720c50c056760
SHA1 e1030a41f01e93d7a90f8c75abbf46b3215ff57f
SHA512 aed2b0caa0bdddcd70ff836a4c005ea979d25d6ca07e8dd684bd3c9677282f6a4df95d2dc52301b9c73b2b4a28041d92cbb9d4236f21be2c95ac5760c954d787
SSDEEP 384:p15nEdZYdSE2zTdfco39BHpGy52/FVKA/YxYHtN0ntu/Lnhb6rZRs2alj+vcPWeW:nYYdoJfB9HG+2/7XLN0SLn96rRalj+ic
TLSH
T1E5A2D115FFC097595141EA3A417C7906BC31F68CC5ED8B6C88668DA85E950ADCBCD8E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

checkbox-blue-on.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\checkbox-blue-on.png
Size 445B
SHA256 8b8f0ad0cdf07227f759cb18c64ff64ae72fcbfc7916524acb355d889ddece3f
MD5 2cccc5edcea3e3eea2d6b563c108f862
SHA1 a86c65c9a40253af8c0e93b33f3067f0f557693e
SHA512 e8ed643f81047b1741e22cbc4025da2a4a8a7feae6e579685d8b06164a35adf65f0792ff6a48306cac68f14ddb5e8a164884dd62e5e69dea605b09b6bcf8341d
TLSH
T137F023B36FAEAD37877958686C890770C11702709AB7BB1C3911FEB0D6239408A99917
MD5 SHA1 SHA512 TLSH

Submit Download

clocks.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\clocks.png
Size 1KB
SHA256 f337a0d867f651929612ea5900d9ef8c8b24757b94bb5f3bd4aec4d0f8d93297
MD5 a295894cc5d918e54830f0c640a1cc4e
SHA1 a97625d380d2e78aa3a3bcbe6373e6beda52bdfd
SHA512 b3b974c1fe562f023d9bb8e31d2b0098627b75dacfea36e9911c3998274de9ed74dd26403c36343391dd9df9dbe95905ead0778db0a7b8c2a20a9b301d3a0085
TLSH
T1151179EE3B059E8ADDC347537B4D3AC9785306E4551B7CAB02405E324009A9EBF71A35
MD5 SHA1 SHA512 TLSH

Submit Download

close-gray.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\close-gray.png
Size 271B
SHA256 2d445a49383ef3d251935caebe0a7b178f0bd69b20e54a44f67394409b6141a7
MD5 e562fb2f612cae47038e9e7fa24e6ae1
SHA1 ee4bc40abf7ce50ea27b4bf78629deaa76a877df
SHA512 f1d8d426f02bca7ff538c923a21e89f07d6ec9611a5da02e30f353d046d9c0fda217f714c3ebdefd39f7fe298bbced5f6ef53e399f8123927be063dc1be26764
TLSH
T14DD0EB6A4903AC8FC0270AF88A8F808FF0FA572860A8363D10C0E018042B020A0A03E4
MD5 SHA1 SHA512 TLSH

Submit Download

close-white.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\close-white.png
Size 193B
SHA256 47da256cd5948d2bf95add2cc0873325003f27b723701e8d69eb466955a13336
MD5 7e3cf99e9c492bd12c687af67504e227
SHA1 05c8d34d161b5877347e33ace9f905f6179da3b9
SHA512 09dbcd320eb1817815cd6ad83003d8121ee4ac5b15680e01ad4b1c852f64d16aaa5b279b790dbd36dedab76d4634892b15c5eed1238c85dbfb287253637fe60c
TLSH
T1CBC0C0CADB8C0EBCCA0F037781FE1010283F195E01111D0C58F8B43100298E06E453D1
MD5 SHA1 SHA512 TLSH

Submit Download

logo-blue.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\logo-blue.png
Size 4KB
SHA256 5a683c38d8dc12ed44465390adc5a29a268a6a529d23941ef09a6e8fd0aa9b0b
MD5 c39213eb735f298d0b9f468294725532
SHA1 b04a7b00c3d2889eccdac13e831b0e676497a2ca
SHA512 25df552f867e915bf1bca70943a0fd9f8f57478b9d58f1cfb296054fdf26e827a239c0c038b685eadee430c619d59314774c5aa9aaa6e007cb892400d2a9a62f
SSDEEP 96:iASR91rwqny1+wccM+KYGh5OmDTr6ALTm49FOsjDsAIKFRQshQ:jSR91rwcy1++zq5HPfFFTvDIERZhQ
TLSH
T177916CCB2DDB28AF534BEAEA33D7C90DDEDF584A1524100A4666248280F99B1E58D1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-white-220.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\logo-white-220.png
Size 2KB
SHA256 e562b4aeffd21943b0d536c2992abae0e6a08b7fa8a74cd656b5c1716adbe530
MD5 1bb79dfbd21e1d253811ac19a996d42a
SHA1 5564abd8e7b97e9860e99a9179fd94ede4b981c3
SHA512 eb44d148aa65248b5de9e2ae78ea6cddf59e81eae844136d919c751a20222c57a6465e9b75d3fc360f752a3c7c91600bb51d6003f7a085ae8c3dafd3d5eeb321
TLSH
T1F3514CF7F490510DCF9EB8622CB3ABE9347A489D17D1060F8C58088087064A43F52398
MD5 SHA1 SHA512 TLSH

Submit Download

logo-white.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\logo-white.png
Size 1KB
SHA256 1b7ef989b42d558f4c37b6ab93bc033cad206aaf4926e0d4f95814ff81822a94
MD5 e097385b54a5e98bab759b5e1d2f255f
SHA1 f66aa16b7354923ad8576bf456c37393e132e462
SHA512 a2906449ce86ba4e7304b61ea158c3108a030aa8c9326c38cdbe522567c8eaea0c6bc0edf7e06ba440ebf2b2882efbcbb28b10e026d82af8cba4adf42ba0ce77
TLSH
T19C3129F21AC638BD0B5D14FFC988DEE01C48B2E40C533B21A51EB806E309C320EB5B26
MD5 SHA1 SHA512 TLSH

Submit Download

opera.jpg

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\opera.jpg
Size 20KB
SHA256 c1a1005cf855c47d9141e07e877810e908a2db348d9e2f0ddfe9faf8a48a455f
MD5 043ec0b1ed563ee3c97f2e757c165b4c
SHA1 ee430f92e2af74f4997d9b71859acaee53a3c877
SHA512 f5d47747dc3a9e1baa44d398ba360d0698fe14f78af9d43cc34d0dffc89be8364964e0572dfce82f195c6bda3bd3d32882e6bf3300bc3985f5968d755c7aaef5
SSDEEP 384:5adPXS8LwnMeoCY22YDGqV1AU4gpq/Z8t9mn11QbLU4kugvHyiMj:UzknhjhqqV1j48q/at9m1+nUOLj
TLSH
T12992C0897D3DF301E413D4B5E7B0A4367ECA973514228DFE23394712927A2F613AD266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

point.png

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\imgs\point.png
Size 159B
SHA256 0914121c7693afd3b625929d540acb7942401d6f46736e6cb8bbf59276d7a1b6
MD5 351349f30b3e4020b9ac6aed95d1540a
SHA1 4a1754e06f68d91a22e85f3758b38f099b80e616
SHA512 126b271dbbf480f8b98ace697d5579874ad5f4b6d442d2350df29907921748dae4c82145d0b28fb03df709d193e57ec9c1b34320a5c3900aedcca8692979e6a6
TLSH
T164C08CB36A632A78C2CA063128A11071E466A961902125568085BE75366E34A52D136F
MD5 SHA1 SHA512 TLSH

Submit Download

installer.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\installer.html
Size 2KB
SHA256 1746b47c78e679dc8589222c5e4d342561295e8d6fcf0560bd8f8847df797fd4
MD5 4574191293706e0f7faa61f262f53902
SHA1 1f7ce35489f2b29ad72474a255ad3c286978682b
SHA512 211ea3d3f1d2b94ab7aa236c968e134221f999db810e8dd5a11bf785428b4b2b5ad3a7361128eb7c4f4cd1daa8eaec2eb25a6210bf68c1f7082739f45c11f52e
TLSH
T17D5165523E2ED437F2D5A11AB9F2F6170C59E14BB34246B870F432E78A86C201329BDD
MD5 SHA1 SHA512 TLSH

Submit Download

installer.js

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\installer.js
Size 8KB
SHA256 e1a964cf70577738c30f4e7022a317959a42aa8f6be46af8566fbf2efcbc2eb7
MD5 58c4c12dd88cb563c32188d9bfd4a184
SHA1 269abcaae630e96c00526efb0d47930cd768bb4d
SHA512 701716f9cf785e27c31d963140e78d2f628add5552ccde7d117c44a15ed042aa820c43238a6b8b3f9f5f796692715b506f43e4aeb2dd6ec5f24f4244731283c2
SSDEEP 192:rMnwqUH6qFT9ABhjpVtbgyATeQP1vOL6kcBZogS:r8wV6qgDjpj8TeQPpOL6kM6gS
TLSH
T1E202B097706BC03CEBD73A65363D0A0D7C39C2303A60A8D5D9ACC4E0A0E1D95567B9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cancel.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\pages\cancel.html
Size 2KB
SHA256 3c32d442868ca536149f3e1e62197dd7cf0d7cee45a40ac6adabbc258bcf2115
MD5 431b4d60ad743328a31589db1d20aaf6
SHA1 9226edef49f4e40c54809a9c715fe4def6c83522
SHA512 68a2c33fa17031d9b780ef527ebce1e15d7b90d35ea11f8915bd875c6441afa75aaa06c5d14f7c7ab2d8197c93cde656b1305c8e50cfe8b4fe0a43c1091d64aa
TLSH
T160414200B14F6009E77E7209F632B76A58F4810BF7E3A63875D915B7AEC287243E92C5
MD5 SHA1 SHA512 TLSH

Submit Download

finish.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\pages\finish.html
Size 3KB
SHA256 b1203135cec993ba0fef656c40eaefcd85f27162420fb3b803e6444b26b4c3bf
MD5 c8bbf50af745c5b407965ab8408b0973
SHA1 6009e31b0db56114949d551731e591c3748b1e5d
SHA512 2e7b025c5d1bdcfdf189beb19e60fb6cb62c85fdbe1488889b1329195d136672299b918fe1e2e732acea585dc8d31206dd8329ed0deca1f7ad9ba00f00ab4513
TLSH
T1AC618602714E6509E7BA2209F733776BB460454FB393972C609915B7DED383243AE2C9
MD5 SHA1 SHA512 TLSH

Submit Download

install.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\pages\install.html
Size 1KB
SHA256 1781ffb245b4f4764a2d414a663b4e15bf79212dc26e4550168f95d752bfea9d
MD5 b5c92f8bc5f4356b578d1f7c098db904
SHA1 199e47c3795fbbb1983d477f90841e535ea59c1f
SHA512 9403802c7a4bc828246f4609b77a16593ac8cec86eadc6c3d1eca002428d21552a6a0e9a72be2ee875f6b79aa52108deab6f70e4935a07768e6516de5fd35500
TLSH
T1EC412600B04F511DE3BE720AB532777918B5820FF7A7896C35E81EB7F9C683146992D4
MD5 SHA1 SHA512 TLSH

Submit Download

main.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\pages\main.html
Size 3KB
SHA256 f798af14f122d4ee9bcf926b044fac6e06b810c628772b81ac17b1c90291ae59
MD5 7e5457a71bdf730f13dedfad72a51abc
SHA1 e07f5bd0e111028610ba9513f8db851c8dab0ff5
SHA512 b3c4a6f3687031054303e1880a4bb873fa14ba95ddd3a63c03922fcc073d08a06fdc709f66b9a6c4d0c31dcf76ede7903adbbfba8a65e6eab93a506e9d1770d6
TLSH
T107614502608E552AD7BE6109F533772B64A0454E77E39A7C74E409B76CC7C3127961CC
MD5 SHA1 SHA512 TLSH

Submit Download

ready.html

Path C:\Users\Admin\AppData\Local\Temp\openpdf_inst\html\pages\ready.html
Size 2KB
SHA256 f0317bda048cf011ac708daa3b31f3bef54924fd1f742e8263845679490d1279
MD5 c2745cd4bc016371a46fcbe6b3ed5b02
SHA1 a7a5c3c54960d68bed8e5c8993ce2fd2b32011f0
SHA512 01a91d83ecedd969388d9a5fa588b8e370ec55cb7e36fa1439086683b280b9eaa390e4b28731e9920375bec9b61c211ea173bd3b40739673b8ff7f2bddccac5f
TLSH
T1D9419600718E551AD7BE6209F733773B58A4404FB39355A830DC09BBD9C283247CD2D9
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 94a17501bc038d665b417c86b46aa3347a7b94c795f9e5d8707ab65cd41e3cff
MD5 8909825815f8c92c6a4914aaf7bbfef8
SHA1 3dffb2e5fa957e67233ca9584926a12d25d7bc86
SHA512 f374c34d46c2ef457a4584eab156cbb0780dd7d00002a9c7f93983bec11c33727dcd4fbaf9295fd01e268affaf4ac4a3211b93c30347f55e961a237e837a62a0
SSDEEP 12288:O07U7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q8:3OvhVPnpr+lZxCBTEhHyPUj
TLSH
T1C64523C74F09B403D93E92F478DA45203336BF9DEF0294DF9A50271A66B9AD06C7264B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 442114c53eefb9129512eee3c01529d00465a66284546afb1da53e80005df353
MD5 a9de9567945bf41f507d301c5bb0d326
SHA1 9896a25870f5053d7a91ed12acacdecd78f737bc
SHA512 3f44b91168990990a188727589398079875e1b4c6cff2711ce7afba1bb0c7bee42fb3009a347e148ffb01b19c3604871425bd67f6ec086bdfd316aec1e00aa06
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYcvhVPnpr+lZxCBTEhHyPU:5gb4mBIBhGFRB+lZxYTEdyP
TLSH
T1BE65AF1E22EC02F5E0F9D2B8DDA64417D6B278165732D2DF1250422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2b551a1660d5a544f1f26f2ef64fae7222389849216110c73480f99cd331d0f7
MD5 86c6864211189be5bd3f5e271c2d3516
SHA1 75725c11cad95f85dcfcb9bebb86502ecbaa7761
SHA512 0afb2f5af64c0ca4972192d535829e05ae9cfd28660ef6e44a311a6f47547cb8580b08e92a8941d20182bcd1db618a0411f8ecf0a4a02ab14dbe92e66764291f
SSDEEP 24576:pG88u8FpJqH1vzria7/mRvhVPnpr+lZxCBTEhHyPU:87ZFPqVya7/cB+lZxYTEdyP
TLSH
T13585F16567E101F1D47BD13889824663F672B8251360EFDF0BA88B561F33AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f35fa957b270c9d2c57d622e0be206e1a3b72bca5f5faa1b3bac5735c653b7ba
MD5 bc6ddc901105e48c060b499f63eba3fd
SHA1 e28672442d6f2d0c8d03b82c18cf863e72e4da0b
SHA512 f7c7790da63eb63ad8a741083b60c744b29da6043562a6bd939ee26fbf7409111b3e4f94b3e34a3d10c81877e1abc8aefbb26ef02bd24d744785ae45ce830db2
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNB+lZxYTEdyP:FG05lO43bxnSodyP
TLSH
T159D5CF6E62EC11F5D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 167cef0279fb2a22f5c61d4afabcb60ce09b4aa9d34056a45fef233ed44da954
MD5 8b372125a7421f99bb7c723a9f828906
SHA1 c1bd5dc86b70162138c57887d62800ebeae672a5
SHA512 9c00fb41153c2d342534f33ec7303a38c25810edf867b41af0e5cb2cc511b20291710a9152ad43900ff674cc424f844c7593f242f43a6f7fbcd94af31b67b906
SSDEEP 24576:cfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7vhVPnpr+lZxCBTEhHyPU:Ea5POZ3lJt2pasx2+mVB+lZxYTEdyP
TLSH
T1A765AF5EA7EC01D5D579D17DC583861AF5B1342653329ACF022082BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3852a164243498c100cf8fb1768d34d4ba2fbb6f44fdd388119745d5bdef1b7c
MD5 c334166fb436d1f8173997ad49961899
SHA1 82205586fae03d0a36b8b71bcdfe2d35981447d2
SHA512 e0c92a0dee5fd647b37c3a653566532063de456426ea7c765302d379f0c122cef022b7029467301f0881d2be3af09ee91aac7ea8fa3554f4117dc166ba3cc486
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkJvhVPnpr+lZxCBTEhHyPU:7Nc/zEOVHF8B+lZxYTEdyP
TLSH
T18F858B5623E901E4E1BBE1BE89779546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b1c21a23a2da6558b8903d928878ef6f97e89e3f34aded01cb14dcf40107e30
MD5 154066c930761d3c91c8635c5c709a25
SHA1 f966850f4628280de7d5f1d982e3718b985843bb
SHA512 055871794417a57c6c810ee64e621782dc9b41a8a63c3422a3814cb813afd10954ef161592cad8af860f0b8829ac3f9bde595868f081835d7bc7e949900695c0
SSDEEP 24576:IzkNvNnaFeYhJNtmZBmnvhVPnpr+lZxCBTEhHyPU:IzMwBtOmvB+lZxYTEdyP
TLSH
T1D655AF6EAAA845E0D1FEC6B4DD238512F6727861073292CF5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9aee668e2021f70dc7c209d9f47a3c80f845288c7de75f37ae873972512eb5f8
MD5 f7c8aa5d152c733471150fafa0b6fde5
SHA1 e1e1ec05f9511c31477445bb332ee9e9ad134320
SHA512 978ef949a4fd5f4c0713d62fa3c99653137843b27a972307a2c1f5b1aa26c8aeacf1f611b6857687a182d3c4ae8fa9915a52d37b7792f32cf6a06d51eb03630b
SSDEEP 12288:oHvUrBFrEjwaQt7Ig0KvNh5FlJUAfXLDpmF0+LtSw3Z40bCBZKKWOEyMHWbPU7Q:oPUr+NQVvhVPnpr+lZxCBTEhHyPU
TLSH
T1B365E15F269C18D5E67AE17C89824609F772B8665712D1CF02E0813E5F77EE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 07cfa56ad025b6fcf3a1f42c8308c824dc34b26ee9852d055826cb944a1544b5
MD5 db3dca9246fc2f95148f5de7f8962506
SHA1 80502cffc7bf502d3a800d01f25afd44bbf5b500
SHA512 68a625a972f06b5a9d4499a2355e3bad9dc254257693c26f6a30b780ae3ff3f3270c39906834b2de6b1c19b680ce6354e50fc5030758eb50d0b9258fdbd4478d
SSDEEP 24576:4D3FHshBIYQgAqvhVPnpr+lZxCBTEhHyPU:4DVHeBIAAqB+lZxYTEdyP
TLSH
T15175E16EEA5C04E4D57BC1BCDAA38906E77138AD432265DB06D0817A1F6BEE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/420-516-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1336-107-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1336-549-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1336-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1336-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2480-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2480-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2480-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2480-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2480-119-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3336-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3336-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3336-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3488-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3488-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3488-440-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3488-54-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4060-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4060-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4060-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4060-553-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4372-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4948-7-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/4948-79-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/4948-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/4948-0-0x0000000000400000-0x0000000000784000-memory.dmp

Download

memory/4948-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/5240-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5240-552-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5240-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5240-550-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5240-548-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5284-564-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5284-87-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5284-566-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5284-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5284-81-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5284-533-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6088-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6088-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6088-477-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6128-39-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6128-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6128-45-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6128-49-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6128-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download