88f8e08577102cf72947e27bf086457bf412d76a4432871fd629e00ee2977e62

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Size 4.5MB
Sample260814-ssa9eaae58
SHA256 88f8e08577102cf72947e27bf086457bf412d76a4432871fd629e00ee2977e62
MD5 f2b0623775cbf3a9f70c8d473e5050c2
SHA1 6c41ba9f405055e8b76c5b416395fd1bdad25977
SHA512 b8f043af65d5bb1eb15a46d9c5bae744044c87c48493f49c22a402f3f1a8305fec29dac66cc9fc0c3f29d0022b5fb6efc3d583987939ffca0e72c0d0a30c63ac
SSDEEP 98304:M1cyy6Sz2c/dhSw9IzMwh9o9b2nU023W:MmyVSilw6yinp4W
TLSH
T10A26BF11BA41CA32E091517E4AB5BFB9465C7938AB3C0CC7C7D03EA545362D32EB7E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4552	elevation_service.exe
4716	elevation_service.exe
2744	maintenanceservice.exe
3084	OSE.EXE
5304	PerceptionSimulationService.exe
5168	perfhost.exe
6108	ReFsDedupSvc.exe
1016	SensorDataService.exe
1960	ssh-agent.exe
2472	AgentService.exe
4316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aa3fc7d75387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bc38bd4002cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b2afbd1002cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbdfebd0002cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042661bd1002cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0529cd2002cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026fdfed0002cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000074acffd1002cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000219ee114012cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000546af9d0002cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4716	elevation_service.exe
4716	elevation_service.exe
4716	elevation_service.exe
4716	elevation_service.exe
4716	elevation_service.exe
4716	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2336	2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
Token: SeTakeOwnershipPrivilege	4552	elevation_service.exe
Token: SeBackupPrivilege	6108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6108	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2472	AgentService.exe
Token: 33	4316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4316	SearchIndexer.exe
Token: SeDebugPrivilege	4552	elevation_service.exe
Token: SeDebugPrivilege	4716	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 6136	4316	SearchIndexer.exe	100
PID 4316 wrote to memory of 6080	4316	SearchIndexer.exe	101
PID 4316 wrote to memory of 5416	4316	SearchIndexer.exe	102
PID 4316 wrote to memory of 2672	4316	SearchIndexer.exe	103
PID 4316 wrote to memory of 768	4316	SearchIndexer.exe	105
PID 4316 wrote to memory of 3420	4316	SearchIndexer.exe	106
PID 4316 wrote to memory of 4632	4316	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f2b0623775cbf3a9f70c8d473e5050c2_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5168

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c1ff79716d77038039721743dffa3722facb6e683d3ee34378871fc1ad61b09
MD5 562100f23011267ae5e5dc79a023e059
SHA1 9c13402534f660c4619f23b06b01db778a1614a5
SHA512 df9a279de351cc48344bc4e72061539244f8d12d0b06128af7ae3c6aea0121c8a9039f5ce6da71dc66bb5a5050a6e3840a506ef8c574da13006561a1827631d9
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhe30jaNf1TWbdz:S3q6HjBsU023W
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6f720b62ad17c16b0d780acdcac964ca64d5f8962e1ce790851998183bb92c80
MD5 8188785d1f6ddfe0c963b1a4c563463f
SHA1 60c959540c57ffd2f34c60d79d99836453a3a563
SHA512 b72fb05ff0dd42f9dfbfa8735ba632b55cf2d0c5b1bb9f931b502407905c7be758cf6ffbd7d92291f56f89b98e5221fcf2fad80d8b4c827fe67b7c3b3e8f56b7
SSDEEP 24576:wXYfDtczANgXe4i7ojhsP5Lgrk1TWb4AN5:Htcne30jaNf1TWbdz
TLSH
T11065F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cb0e8ca0b8dc9abcabf158cbbf48c68598d23451747a73152ed921b1bcbab4ea
MD5 7b78aeb5543b1741f864115b4b08eb87
SHA1 db5a7ce66cf24d86c33e77c37e09f03c21ff952d
SHA512 8b2ca64b46e16bdacd11708640e0b968cd94b117d56389f79a873b9993bd7bed6b77ff8d1067844933fabb369187901a822c245676facebfa8d7a162baaa9fd4
SSDEEP 24576:a0Le5ji0hmxirMGgXe4i7ojhsP5Lgrk1TWb4AN5:aPji0AcCe30jaNf1TWbdz
TLSH
T1C185AE16F6748775D073C0B9C5D2A79AED72308217308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f5f708c1dc4d4e8bb2cc49f605f1c6c59a2ca989331534a1d7fb9ec13c386b5b
MD5 a43ecf19c9dccec11e927f16698fe677
SHA1 e58919356821d300637fe165c7b030baf95c79a1
SHA512 520fd7d2ff918657ab3dab2627fe2625029cf3f73ce540391b72e4cecb8170cc4b918fe623a895d8a35eb6ab43405e88cffa8f75b73e68e20456cab36c32c6da
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuQgXe4i7ojhsP5Lgrk1TWb4AN5:E/ezSC6vUzPvxHjyue30jaNf1TWbdz
TLSH
T1A1756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fd07c405295e7264c8e18a22a4ff18ef31d4e7d99731ab209dd038391d4decd7
MD5 a612f7ed5e2a04c8aac25a22646aa1a2
SHA1 4b873fb00221efe94fd8da55feee4d407f718e09
SHA512 72fc7d0887860c3aebea22cd36a7c9da24e913ddb7f0fee25dba6f1a48a0029b35e577136ee61e9212ff30e8fe16b69e05707672929d826b427341a7bb81d867
SSDEEP 24576:HVbqPb88hv/l+6BgXe4i7ojhsP5Lgrk1TWb4AN5:HVO88hXl+le30jaNf1TWbdz
TLSH
T154559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a5c524b1aec66d2fe0b3614900f76e84930785b96a58ef6f8c54e7e512d64119
MD5 858123e431c0e198dcf803abe61806b8
SHA1 cd521690e09f9f1d0a9888d94d397164c290ea1a
SHA512 04f5b30739226657c7c92573bbd188a0977a56e8da554f09e28815b1535bfabbc2a8cf1ca702d22671f39fe62cbd16c664dd54bd2ce3bebab9a600f5ff914372
SSDEEP 12288:7Rt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7R6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B4523929F5409C6E38BC3F0A0F7CB91E9E11EC175444E6B47E0FE9319BC8A9DAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 face57cc747af1a2bc843e0b54c9d8e2a4a4b5d4793dd590daaf50cb2da7ed6f
MD5 49ca6dc5100edffc11671d9cbf53b636
SHA1 018add3c31f7233a655c6429c3f45c42bcbf15bc
SHA512 20366f8dd6053251f3a12853f8b6c1707c1a77adcff52dd68fa936b7a37fc435e6d37f4efcab5f2a9aced7a00c1d21a69be2f619f2cc191e86cd21c1b2dca1c1
SSDEEP 12288:UeBNUbTVO86UY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UJIUZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F065CF7BEE28FCD2C27A8DB85691C740E7B278704B5293CBD164C20E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 02c5dba61acb56d48b809abd92c29f93456cbcad22c34b7985957c4017981285
MD5 4b112da1d196f3d3f7850a0c2a9f3289
SHA1 b8cdc0ecf79553f92fc97c4396f44a39403f7a3e
SHA512 27e7f73010520b88b9bc1a2f23e7ce3dbaddf65dcb2d5493b603bcc393fe6adfeffd123626f119f649e6300e67e032423ba0783fac81710947abcdf7d2fb5e1b
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:XQvGAdlCEL8c/yRNw5CHU023W
TLSH
T16F267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4c921d5b6b7e6fd96a92e5b057cb54e6b8a14cf9d943ed25529fcf3eefa28752
MD5 4240067ce71f2c51054410d7990369a3
SHA1 109f83c9edb60b4d10bf32ba67f5c66e34e62608
SHA512 aace4a76aba745d502d9f5ece1739ce405194f2d34f7e802303461ef43b3bd895511a2d8ea19e5327b95d176287f6c1107731c9cdbc81763d1069a2346daf601
SSDEEP 24576:jdewsAjLgXe4i7ojhsP5Lgrk1TWb4AN5:hljSe30jaNf1TWbdz
TLSH
T1D675E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5934f361b1ff0233437272be428ea4b4811fd0643605e0c85759429d247f066e
MD5 0c5badacf890680e77006106e0bd2e94
SHA1 f14a9161e88197b69908e83e5c0704402ab16785
SHA512 61b3db8c7830f84caa81c63a7a829e3fc6b6065df242fbc89a85853a77588a58ac43b334d32d2a29f8b92b97635305507d51043771d3e737e69f329b76cf876e
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqp4W:dUEtQevvqc2W1cpV2EI32S4W
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c41ff10878fa46e5fd399291e40b9d01fb7bba5f2ca31a29c062dab7edeb612
MD5 b8ed63fa54d7bb2f1de80881c4f52c23
SHA1 3e15c697ccde3fafc290785defdc0060564cbb87
SHA512 08e238ff6f3a7499f444450cf74ce5c29e1407b7d08969d17c659f3011a8dd00fd60a305553b16fddb0a8c99a49285b541eec27027181ab37258535e83cb8a80
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/zye30jaNf1TWbdz:eoqtVjnmDU023W
TLSH
T13CD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c1d388524ddf7b225120e0b6bb366624360ec5bc0362481103d16dec2a44f002
MD5 bb76fe49b7cea3492df80d51b8bfbc4a
SHA1 3dd9d033a14e1a6aa4ef79c0a76c7560c2a11279
SHA512 afe5af4581c6a889c9493ae247afc44ee9ff1598826f47483b16c4e48d6e5b295e934b7d996de0b008f94e91f212ece005ce102d884770b7134b6d36b90e2c7b
SSDEEP 24576:tAhGLJIFoiwtA5l7S53sgXe4i7ojhsP5Lgrk1TWb4AN5:tAMyFoiq5Te30jaNf1TWbdz
TLSH
T1A0359E81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e5b704a3449145935bf86bdcbf444008a687d95ba16346b2aaa2653f542d51d7
MD5 07b5183a68f41ffa72386faf8059c04e
SHA1 f5a335e8ead5623fd1af03701c1d81e21e92e912
SHA512 3194c954802e55fcab03903ad6d0ca9ee5bacb0e34e9e48109dea0eda878b949fa2e95c2a6e277c6cc94bcb1e5b01a3fd03a2b5c7c43f88af592f25bde9ab3d0
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+Cz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:nwuoOWngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AF65F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a2e31132feb99011c70dd48f5961137b44a91e2bc5513a2725ad68cfbe751173
MD5 ef727d277d1769a6bd0ba9fcae051208
SHA1 1a5585515b45d0a3fb5b1d9d944463ead7491513
SHA512 8e2198c61d0ef5ec1f7ce75ee42ee14c76943043273320a9a9cc28b1f009101fbdf6837cf4973e3e40c7374d86ec91c072a37989c5378d88a4d8423948e68b21
SSDEEP 12288:eBZ1Iyi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YZuegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14D551296379421F9E2978278D4F28B41E7B23892333147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ce6361d4be59653898884fb16d55703176d4e707a6bd0ceea26e940fede687f
MD5 0f83af9d07ce4224e63e27fd624f632b
SHA1 e642a2da675aec05712fc04750fd3476717931bd
SHA512 a1b609f13ba0a50922362113391a339e9f636da972d9db3f000da3efc455fc9d507a11470b9a1b51450a9bb3b9dccf374045a6a043b688f56476be78f92084c8
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:HQRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T16A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2d2648e76ad910622df2ecf12548907c607f60da5a9ac16d9dd6084dfd4a5bfb
MD5 5533899b34c6b9dfb4a02a7ed39488a7
SHA1 0c6bbc464502250373a41141b9b4f77f054fa9ed
SHA512 04a93e559f24ebc52ad27033aa320afd1316ac52f3d774a5ffc6a592bd6e90bf417693578446002c683b60fb4a712b99fb6cea802a44cda47d3710d2b9d50d25
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uk:5QRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T165667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 30c2e36b90185464202657a80a4587355c2288e4bb645546f6ecbc4138b0653e
MD5 a39ce0a11f2409dc2d1e596cfe423033
SHA1 09249c2e18c45a169c66a652ddbaf3469b0581ed
SHA512 73ed3cbc175c9ee37f8a22c3c506b9daed4052e6fdea9f40a6969855abbe8825adbb224ade94171a148ee046564db395e9a83164133b415ea8e57955f55df0ee
SSDEEP 49152:F68Qg55nhheWu7PNU3/Ce30jaNf1TWbdz:TthWRc/CU023W
TLSH
T186B54933B2F60099C04DE1769F4A873196E27C758FE0E7DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 343219e05a3ac80e435202ad29618677739ed8e1a6275ff5c50ca7cf54aacd64
MD5 72590e937db55bb02f0229d0cb7b2231
SHA1 710ea37600fe081694c35c07d980237dcca6f3de
SHA512 15f94cf738c50eb006dd4af6a8e49cabea20cffab051105a832981a3e785ab2e790dbfce2b100435e33ee6ecb04b1231ceb601e51ad3e72f8c6fe2e136fd64e3
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Ry5112gYy5azzVvL69nLKnhZ9U023W
TLSH
T158168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9db36df9206828cb135ff0cda8c613dc61cde3ad8693da83a2bc37d222426682
MD5 bc2bab64bbc050eeba2b765bf903463a
SHA1 929827d5b17eecc820a57e458fde3a59148ff0d3
SHA512 cd1e975f2bfcf5449f8df43626a319fc34acbdb057ca9494c465944662ab81e9dde2efa7602385837fc700823d51f0109c0f6f034fba1add50e434cb20ff07f3
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfe30jaNf1TWbdz:Zu6JmVxd2dfU023W
TLSH
T113D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c7dd11c680ea272c5a885bc1e9330c34e554ba38e0955d327089d81aadf54cea
MD5 2db97b5fca9f83a095e6bc877c4db71f
SHA1 ba32168ce69faf198efa522109bbddc273f6fd7d
SHA512 e02f1fb33c8960130268e34f9437e3e6d73bf63366ca80da2a46c156f11cef4223f3f12b6973a5b1cdfbea3162f2a0e2be8580dd7a1694bf69c48510977e67f2
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xEe30jaNf1TWbdz:smifPbRDU023W
TLSH
T1ABB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7b5f4b374af5c3d388bc02495015dd10f339d4b7b981c93eb34090be1a3454a5
MD5 bceed0d7079731fef1c1c241449631f2
SHA1 063613f0d0ee23303a658ab6cd84e490ff6ef5cc
SHA512 067b9a5da0fde7a59cbef013963b66d9bc3e4c0f371e5541338c2002122824131cb5b0e50f3e234963f46dcb6b8b03e1ba82df84569c4a5325c58492b258402a
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqxe30jaNf1TWbdz:N5dKTi61xU023W
TLSH
T1F2C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f6692ac92d99f8537c3063b07a38faf338da1550b1a40376b6edeb60e103c14f
MD5 929642a394b6cdc10c359fa3d7f89f0e
SHA1 bb00b642b3f4e46555c718198e8a5deaf4194d44
SHA512 ebf6ea7c651266d3e855580d997e8151b84ae4a71555382fcee99d33735edab2344d1bb3cd5c5ce7da317a678c82a3141fc1ad81a972e9f0fc2a484a9536a885
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wIe30jaNf1TWbdz:xX2iyphfU023W
TLSH
T1D395BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b29058c1ee88c33ec3d5449031ea787a6e167aaa26c1753d023667156820e145
MD5 720ced3b346f2e06cc5c4787a2925b62
SHA1 d1238539c919b53ae9d56827139e368833772d89
SHA512 c96bd6d4e8300e5632f523675234f118237bf0bd160e7ad905bf6e9b33610a8ef8c68169cb023412c4203b539d129f7c7c89cdd112704ec2689e9fbe39568d30
SSDEEP 12288:9F0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19F4523959E550AC6E34BC3F0D0F7CBD1E9E11EC672404E6B17E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 349899704d9ac3c78b56cb4a0a576e619c16b7084dad9a89f393279b78ea9e82
MD5 89149b419472c5c70e75c0d7e096a880
SHA1 c238591d65b9a0794a8ef79fea60425728e52595
SHA512 31bb44a44d7e7f9fc7746aa6f15e6acf9d97b84c688d529dbfcba2086c8c9629501a28de823e4a75967a60ed05a7cbbf746dd0671d403bd6d0d02fa68ce33e67
SSDEEP 12288:/20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/vgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC4523A5AD5509C6E34BC3F0D0E7CBD1E9E11FC672404E6B17E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d1bf66dae3628e9f909f07d78337b25ad5a25c2f08138ab928bb0260858cdcb2
MD5 64f36e2f23a7cda4440dac551c183bf3
SHA1 f1390dd2f5373af02ecb4359b55cbaca12174a34
SHA512 e880b1ac5696a650130997dbce0f4b5ee1207dd30e9791a066713c4080b135c2d21b709c18c48907a9a1e2a49e2f448ba2f068a5334bd6713189fbfb1d69c319
SSDEEP 12288:Aw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ARgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13C4523A19E5509C6E34BC3F0D0F7CBD1E8E11EC672404E6B57E0F95319FCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0688322858195c9d6b617c5e8e3574eb36e024212dc65261bda71131903b7ed4
MD5 9708bcd9a672af27056dd064621abdcb
SHA1 962f97cd91ebeadc3516192921fccea4fcc83ed5
SHA512 a8f402534baa01e6da542da82b0208b69431936d08c70b3a5d1a1a082073b2966a86f39f0723620afe5d28b034a16a7c305dbc2fbb45e8fc71f0dd62e5744691
SSDEEP 12288:gVf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1434523926F5505C6E287C3B4D0F3C791E6F13DC173114BAF47D0A9530EB4AE8AEA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2865f29be6f1245687f312d7c1c2516cc424006c6e4be5a45eb9cd4cb657b24f
MD5 9ab819eced8650ee52c95853dc6c17a6
SHA1 4f31802cc6ccea3ce7ae7f14151f924ffa2a4bf3
SHA512 22d89015f136b617bdf1023bf998c05085afc3f3c5ce852a5f52f1fe341c46415f69854e9fa05aa7ec2720532c4f2285f9d3a20eb7f746f2ff6831c2c317a14a
SSDEEP 12288:an0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:a0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C9452391AE5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a6650001dada237976ef5a077eec33fbfb6372764e813b5c4e85b34caaac4abf
MD5 4c176c1febc3c1e746c2842f1da1d3ca
SHA1 75785f6faf3ab1af142fc9e16d6b4dbcba38e92b
SHA512 d57c3af9b205de13ef59389a7c5bc3da19262ae04cb7c0346bdf815ffc4f1e9bd983f9cfba205fcd1159d54bf24c345ea69e9ae98fd877ea2e46aefb77ec7263
SSDEEP 12288:JK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE452395AE5509C6E34BC3F0D0F7CBD1E9A11FC672404E6B17E0F95319FCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5dbaf5c1d8ea8fa3237030113bc3a15254f4908c9a6b21427c0c15895cc10344
MD5 bcfd1974388fb4e3ecb64f9f330ba76f
SHA1 56f41f28143f707fa5c43e9d076d7d42f575dac9
SHA512 043c6b6591826ac81e93e8a35ce3850230cc3f70771d388aaf449a0957003663ec6af43e97c670783eab16bb34657676b0c98d458e13b4f9b4519d85ee19a5d1
SSDEEP 12288:P+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:P3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F84523A59D5509C6E34BC3F0D0E7CBD0E9E11FC672404E6B57E0F9532AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 cbf511f11eba47fbda1b9ab8ae4ed4c7712f4474a8d65a0a18efcb551982cb25
MD5 2fe02d8e45df4413a695ec34a4fdc521
SHA1 c81301994b46a18bc7a25ae06135bf0427ccaedd
SHA512 4acb79c0662f7afab9b21424f4458cba3e02bfd89309f0dbab9c95c2eccd8b9ea899a7965938c620826bb5e59812cad470b21b15840bf375e7c929cfef9299b4
SSDEEP 24576:vZMSzFVSOPgXe4i7ojhsP5Lgrk1TWb4AN5:vZMSzfKe30jaNf1TWbdz
TLSH
T122650195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 63ce064c064cdbb12b63e0a3024c3c638f4f292b77c486529f877048d749b5aa
MD5 e64a1707fad2d195e908898fa8069333
SHA1 93536e810d0005ea8cd2b0d99418f3554c6556aa
SHA512 7141368fe05c12444bb06a477a1de47d563eadf6525d268bdab927d93d041c555e3d04a4c374b8f0924f2763561d823fbcdc69514ac1d9a752749552b34b2268
SSDEEP 12288:Eh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B452396AE5509C6E34BC3F0D0E7CBD1E8E11FC672404E6B57E0F95319FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 52861152829a7ffb96d9eb763cae70daf5a12394a772cee55663edba39479d11
MD5 5ec563213945e670e758409607dd4841
SHA1 a322fddc92b1928b164985583c742e905163a219
SHA512 140457533ddb97f8f42747e3c23509cba2fdfc29d70fe81b8d36676137293a200dc7a2208fa85e9cffbf50bdd7569d13ba13ba255558c5bb4d8680e82fc41a66
SSDEEP 12288:s90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7452396AD5509C6E34BC3F0D0E7CBD1E8E11FC672404E6B57E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e09acc69fd0518362a925feb1c37cd64ef90c288dabca4e1ccb77b1d45b3bf78
MD5 ff3312745a15137d709fb4ad1387cfed
SHA1 381f61856f1188b4524055773a0bac808af24fc7
SHA512 ebd3a3248c8346a211b6aeba59ef3ca55d4f430e7d17942bc8f373df87c4377a7e63c04436b66df83dc00ba7d3a06d50d6bc3092d01c2c3fbcaeecfc6e8758fd
SSDEEP 12288:KyPz5L8i0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Xzy7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15755025777A120E9D1678274C4E24B41F7B2787217208EAF13A057732E776E19E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8f9f0a992ba30f88f57f6efa45a3a941ed1e032c7f552fe37d4ea7f693bb4b90
MD5 e2871c95f99a181049ff2a166651f095
SHA1 b8435a104b70ae49be2394d77a7c86a61390668b
SHA512 a23da5a1fdee13f2510ec6e209d99a011dd64306cfcd21c17cc5a7b5b05d532d7ff56d5f5a92db91ebeb2ecb00695c7b09b65699a70a9e34f9eddc33cfaa5d5c
SSDEEP 12288:ih0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:iOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11C452396AD5509C6E34BC3F0D0E7CBD1E8E11FC672404E6B57E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3540dd8b71389362569427fbc10dc4cb802302626c32d649ea325a6859d402c9
MD5 72b3953e5e701d7efa59b11fe2f1e2a2
SHA1 406cc7cca578e3e373ad4935f25f9985a2c175d7
SHA512 6ade14a14a90598d48f5835ad3af8b10b1c7e4513365233bbd5237c5e88cb8389a2327cfa77aac9dd36d2a7eb9f581277faba80391417049f2649b7706d730c2
SSDEEP 12288:yh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E1452395AD5509C6E34BC3F0D0E7CBD1E8E11FC672404E6B57E0F95319FCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5dc22346d154a224a7c49a20e825eefca6967f15f113cbb906cedfa8bf19f81e
MD5 7f7eed7da997e2ec7428ab5e3b0b69ed
SHA1 853beaf0e64c38c84cf912803362866bfb9b5c2e
SHA512 3478303cddf4ed63cef9a79c24d6bf87727ad206c53cd561daf6cafdb88dda37065a2aad30bb1da551175df2984565bc07c70f13eb2b283f018f1f12323924e3
SSDEEP 12288:LyPz5L8i0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mzy7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C955025777A120E9D1678278C4E24B41F7B2787217208EAF13A057732E776E19E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 67dbea42e1ef4bd55a71f3878a15f2df2ecdf79e3473406a038648886ad6f29a
MD5 5e7d0851b6d7cc047b21baf04cd54995
SHA1 b0b77745162048c3aaca8c46c34318db6ced6726
SHA512 daa78b0a997b40453fd5c1165769f945e104bd5a3229dcd1b9ee1d23c75bdaf5f309922c58c4bbcad091f1eb1303cc6c75c735dfb20a5141219cd9120496db6c
SSDEEP 24576:lTHaLl3z0zDhgXe4i7ojhsP5Lgrk1TWb4AN5:lT6Llj3e30jaNf1TWbdz
TLSH
T18F6502A5B3500CF8ED67827EC8A68A02D6F27C561760CA1F03E436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8028d9001c35ba37cebdb930c0c5fc3461e95fa0d3400a11446850706bd4ffdd
MD5 e1570b63863e571079c274241f6127cd
SHA1 a27d1086a1064f88fc827d93c7a64526dab7176c
SHA512 72756eb0bf87416749c6a31f1440b762794ae6606cfcea1736955174255a890c8a91cdeaafbaaafd6a126bd1cfa459406d1856c1ba69bd2dd6baee49c384f9e9
SSDEEP 24576:f37d9CHKy7GZlgXe4i7ojhsP5Lgrk1TWb4AN5:v7d9CHKyaKe30jaNf1TWbdz
TLSH
T1FA75CF90F3E414E8F1B7CA75C9764511DAB67C9A1B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f4da6b0febbae7f647ceded16cb3c5094ab88f273d438681a772b58348cd6c8e
MD5 6401dd01353d242d60cf167da5fc7f6e
SHA1 2b970e7cab046e56e6864b876da239713ed4302b
SHA512 578f30c0bb9ed6e59b53e97cc1bc6c67228d7590aba05b350f3f672ed276476133e2a95e9aad048c4e652888bcf1c2254bb0d7f9f665006bdfd26b0b5473993f
SSDEEP 12288:JQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1794523A19D5509C6E34BC3F0D0F7CBD1E8E11EC672404E6B57E0F95319FCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 eb35c0961bdd228037a99b488576701d616146e21038d22f34f339ca4bd9780e
MD5 272e80c7f913bc91a3d08a60e50125f1
SHA1 867736fafcb85e3fa06100d5f21a590940c909a9
SHA512 bb52663deeb604baa8a27da5c04150d57143698d9f428624484f3a5b69e455f43b9ec6400b04d1819c7ef355173ec31ce76da8fa9f79ca3eb747c85a6d8e647d
SSDEEP 12288:FC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1214523A59E5509C6E34BC3F0A0F7CBD1E9E11FC272404E6B57E0F95319FCCA95A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a714d7820544c15af6047133b8af7570099247b66874a2631a21ca051cae30d8
MD5 13860985f7a9381578000cd37c00578d
SHA1 ce0106a5bffa4c495167a1975285ae546239bbaa
SHA512 02a35973a819f81d1e0f598c996f05ac0dc4ef1e6628b9a15a6cbcc84b77513bc69fa725af0bc91d37b188a4a3f996547a1f3f1eca4a57f9c9ba358ba186ef8c
SSDEEP 12288:8b0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8YgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1624523A1AE5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F95319FCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 298b6562ab057433aeea81043d3828a72863bdbc98bf44ee7c3c72c2e208c41e
MD5 283d7c415526a1f521578a9e861c3209
SHA1 e107207d09da16b22e71b4de4e4622c114841633
SHA512 63bb5af914e947fcd5c0c4617a3759228c09e01d15e8fd2528091deae0d7d1eeee65eec799cdccd7835c7ded07ff120cb85769623bdc519e9513c65995fea7bc
SSDEEP 12288:th0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T131452396AE5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e9ab2a52461e73e0511b30d63c24e51eff0b2abd5353d35f6acf0e06c08a5c98
MD5 4866e15148bde0a3fc18ab1a4740bddd
SHA1 380f452db750cc34c3f9b67ecd17bc61dba844fc
SHA512 cdc98fbb3997aafae9b0b19e3cdecb4714915f832d175f4eed32783c8e75e30ce6e5c814cf15a151ec033242aa1b5c5595b701b25e8cdeec04dd0626decad652
SSDEEP 12288:JQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B4452391AE5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a4180d84fff02ae38be0111765535767aba108f319adc286629b62b3568a8fc2
MD5 ee182517c20868c9124ba6ed49e42149
SHA1 3057965f812629112dd12133f6eb3df8b858f026
SHA512 e8d5d0a0e867ff12513098c1378d4f83e41201c613f4183f7a6310245d673ffdff714d079289fb4c8719ec105133682f4cc87870c8df2a302db639793e5646d9
SSDEEP 12288:vJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T127452395AD5509CAE34BC3F0D0E7CBD1E8E11FC272414E6B57E0F9531EFC8AA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 72bc2826bc66f958bc7ba9a6627996f8e6b819b392c51b7b26130853d4a878c6
MD5 84f6966eec8200633402d7feedacda57
SHA1 3cd61da57b81c10a0d9cc1bb8dbcf6d61f564bae
SHA512 035d97d204a3755c181366ae01024a035cbd777e592d507b5f5961cd035c84f7c5ecc454faa6edc5063de8f834bd0cfefd54787fd8387f8ea1ce064a2725ec18
SSDEEP 12288:Pn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:P0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T121452391AD5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2726a37003afdd3109a2302d5ba0c9f40b781c0a6cc3258db816a3895e431772
MD5 4a2ba3ea37a7920c1e447f19523f681d
SHA1 e1470a60e392898708ce01c3e3cd8d5ff0ad9d4f
SHA512 37160b80852b33d13b97465bef2f7d2876bd0b366c1de1f5aa7f91b6fdecd73cf58eb63fe4e4f8ee504237db1f811a57daa3ba33858c7b0c8718298fd70ee7f1
SSDEEP 24576:Pfwvok9RX6wkyAIagXe4i7ojhsP5Lgrk1TWb4AN5:pMnYIde30jaNf1TWbdz
TLSH
T1BF85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7a1356989d0fbad46073d1a875e2c734ffc882b4c8cc1f497e922e5d36b704a1
MD5 9d1efa397eeef88989cdd3736bf898b8
SHA1 ada0b38e36e96f94b67cefe9ee75461090132173
SHA512 5a44b656d18324db994fe5e331dae9fe4b9aae1566775717b0d59a00f032e1f310ca67152ac756fa40f908564b2010480e311900f7ad1c3f0eea2e10315e2b47
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oe30jaNf1TWbp:YySzPwU023W
TLSH
T163067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 de8f0ba8d60e899b650ee97189214a31b82ed5b41294c1233476701012a861fc
MD5 43131cf02ca15b59337e76b22e1aca3f
SHA1 5c8ea367ef5a6abd9890e6e4a904bf972dd83276
SHA512 818ff0a0d1cbf708b2b31ced72b6b21fe2b6f42b3b62455c187c691048fe30bec8230e37fa9332aa89f159f42e36dc9791b035b642b762a0dec9ec42adf6d371
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/gXe4i7ojhsP5Lgrk1TWb4AN5:y47JUQj1irIhCnDHUPfF/4e30jaNf1Te
TLSH
T1DA65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6c89a932e72b76953fcc3ba1abb6a9b21914b8ac6a3085e54d1d55ab16a7d1de
MD5 ed20c396d9a134bf652294f09d084b92
SHA1 f26c106523d34c3ec1fba4fa86e4545d4c236dfc
SHA512 193fed9c9b925b88b6e778b344d8d220b858c9efe4268cae03a3a2007f510862ed70128b551fedb6b2506743f146d17fef4906ba44ad0145603844aaf6f867bf
SSDEEP 12288:VNsfR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13B55F15AD29802D8C16E92B4C3968A81F3733C5193E1C7CB13D0F93E1F79A949EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4b2edb8025a93af1cc00c4c626e390a532f47622748411023c7e4aa74752a2a2
MD5 5a1525e376020fad635dc93f4aff1378
SHA1 58eeeb3679d39469e75798c7ac68edee01d35fd5
SHA512 c83c8383c3086d5a00222b1d123c88bfc701f6902c35bbc791cbec714e1b887cbb7f54059a979ed77d05821d3a0f9d693c2340c9f2df695d6c81d17c132b8b74
SSDEEP 24576:xbQZUPp6WOFEm4WPnh9yDrtprF6W94kM/:aZU/Wvh9utRF6W9jM/
TLSH
T11B452840762BD78FC6A940325E36D6CCA7707D01EE05AF0773C8873F9576668BAE5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9379772e6b953cbdb3dcca6e573621b47e9e2392274b545959d096b6789c7ff9
MD5 3794a3d3ff28e7e23c40fd4f019ca7d8
SHA1 7a7d0f9ca01ec2c814f9c2761bed3b38644314f5
SHA512 27d3695309d515b084f97a427380a4ac9037a284174ee60d92547df1d499107aa498ab36bf95cebb882513fc866af43b8fbe90ebdab380a40250238115a3929a
SSDEEP 12288:9AQLW5AgjpvskAT2jFyiEIt+w6WZ2rS17A2NQpjOQBzjgeDb7QfzA/kCGtQUe:9AQLWO0tXo6UOegeDXEzA/5GtQUe
TLSH
T13E652A40A5B7E34FC9BE9037423286CDAB745C06BB453F0573448E3C5866A7EB6E2396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc5e47a78b3e232b65cb7e723b60e2727afe278575f57236065bb2565156b9af
MD5 ee25e108ab3726930cd8f998aefe6f3e
SHA1 1749da42eb610b6ce0a93996abcd4fb0b6b4eae2
SHA512 97b1077cedc5863e5995f3611e7dff5db1fa9499de2c4871e58ffbb077ba4896b5c8d0aa735a06e0cada6ae3ecb44c871c9997d86a478764595006875d1a5da5
SSDEEP 12288:CM750DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/mgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14C4523629F580DC6F29BC3F090FBC760E5663EC1270089EB56D0B69319B8CD99EB851D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dc12c6b259bb9313da3f50011e5688d0aabf85d758696f9810c85a86b3014866
MD5 2b30b7b499f8dc5677b664ed49838dfa
SHA1 6d9e724bb3366a4c9d7e0f1e05160e22ad859769
SHA512 3b08a6163ae2db981131f805c77235e62b38277c8018f530d55ce49ff1adce25224a2c2a05f9e055c209621c06c9206eb11791301676f6fb45a73e0f05df1c8d
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYQgXe4i7ojhsP5Lgrk1TWb4AN5:vgb4mBIBhGFWe30jaNf1TWbdz
TLSH
T14165AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ffae045b9abb04b4505974743d6ed5f61245818d246b134f8ef1ed3dfa0a6980
MD5 37731649d1fbc706cc4f4e85b7d6e19e
SHA1 e06c5392d8fa6e2002275f51d0119a8b01df8ce0
SHA512 b72f648a9b766d7c9d48d2154f9c26895794e40d7e8c9ef780c385e6af629431d1eee8bc00a77dc380fd3e133cf41418420285636089973838a561a1553b8088
SSDEEP 24576:rG88u8FpJqH1bzria7/mPgXe4i7ojhsP5Lgrk1TWb4AN5:q7ZFPqVea7/Pe30jaNf1TWbdz
TLSH
T19E85F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8db5f829e43e53914deb9461bd417c9da5bb92924dbf96fd835c68e89a2a5522
MD5 136b0ed86895d209586bcabbd3c1c143
SHA1 a27d121288e8e8cc0ba67f8f1b535b69ea17d3b4
SHA512 acf079994525ecebd8c7f03e869ba657eef169fce3a560c7b50e9832de85188e13ff1a6f20da9ed04d760ff9fba7ddb23caabaad6e0964f78d79d8b1702c5e9f
SSDEEP 24576:oPUr+NQzgXe4i7ojhsP5Lgrk1TWb4AN5:oJQKe30jaNf1TWbdz
TLSH
T1B765E12F66A818E5E67AE17C85828719F7717852131196CF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5604091ef5e6867296e717617340444a95a8dc40811d491797c57ab37494c4f3
MD5 d790a07255c1bc32ed78077a2ad9df5c
SHA1 816f0738085383a533f0f6fc86a149c306298c43
SHA512 3ff54ba807fd295a1c28627c0fe37b31a8f5961f6461cfe4bdfaf1175874b38a0826dd50285e45f947760bb5b21bc65b1d2f546cfe020dcb450fe3c877563332
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6e30jaNf1TWbdz:0G05lO43b1U023W
TLSH
T1C5D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 188eebe4d542a69db9415b05a719d08217213f28add5d93fdcdb50cb3790fb3f
MD5 d0a79437d4fcd702c68f6553b23098e4
SHA1 81b6c28392b23192a38420d3b5dd9f7b7e1ab81f
SHA512 b102f0e3a904a9785968c9ce4ae76e46a9f6e9ffe4191f3a0dd95dacad79ddc12321752b392863d3283248c7b346a59870c241254fc46f26cd1caaec8eaef8f5
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidntgXe4i7ojhsP5Lgrk1TWb4AN5:ba5POZ3+Jt2pasx2+mCe30jaNf1TWbdz
TLSH
T18265AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 739600eb5dec1c2e1d74d04fae469949c4948225e6b070fb264c88e51e8fb9ce
MD5 66af6ec42a6bf74cd3b7b4f204008188
SHA1 27f481777eab998595a54e04a60b153d5ab87ffc
SHA512 f7ad94c06bf917f555c5b7d38550ff156a26cc7a2b539fead4d6db7a857d25928e8e1e0ae195ee9e8ef761d17ae4f9efd285d3a0145564ff39e113568b44b0c5
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkHgXe4i7ojhsP5Lgrk1TWb4AN5:kNc/zEOVHFve30jaNf1TWbdz
TLSH
T1FB858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d59476ea123d92e50e01163ec6df2dc0eeb2822560cb40c24568aca02ca798f3
MD5 3ae4ecf57f90b3f4a0dbb87d1f89ff88
SHA1 ae7c4691b965f3a52b1bc2eb481549f35e55871d
SHA512 9ad53a3f9b49779b04fede36ef266e083be529c142fcb00441878e9cf7d22c2ebaa510dfbd7e128647b667a0789a1a98a8be675f690a70bb6b77593c2f8fe042
SSDEEP 24576:A8kNvNnaFeYhJNtmZBmUgXe4i7ojhsP5Lgrk1TWb4AN5:A8MwBtOmbe30jaNf1TWbdz
TLSH
T19255AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 971802a5239471d0d1140814cca840992aa7050ed620d234b54b60356802e635
MD5 0a6e408a7352e38da1e977e981cd5a79
SHA1 dc5ef075c745befe5c6f64f06040bfb8656564fb
SHA512 d0a5ba73e8aa9bd297b4a65fb1ad11f9578006f8f66e00bc8e9130e6a36ee7bc873487a2da827dd9b9e162d258f34be5eb7c8e95b8f13c9deb02e5b191a5e57e
SSDEEP 24576:iD3FHshBIYQgASgXe4i7ojhsP5Lgrk1TWb4AN5:iDVHeBIAAFe30jaNf1TWbdz
TLSH
T16275E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1016-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1016-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1016-114-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1016-319-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1016-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1960-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1960-127-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1960-318-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1960-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2336-0-0x0000000000400000-0x000000000087B000-memory.dmp

Download

memory/2336-1-0x00000000025F0000-0x0000000002657000-memory.dmp

Download

memory/2336-7-0x00000000025F0000-0x0000000002657000-memory.dmp

Download

memory/2336-6-0x00000000025F0000-0x0000000002657000-memory.dmp

Download

memory/2336-32-0x0000000000400000-0x000000000087B000-memory.dmp

Download

memory/2472-140-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2472-142-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2472-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2472-134-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2472-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2744-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2744-58-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2744-53-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2744-47-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/2744-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3084-299-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3084-68-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3084-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3084-62-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4316-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4316-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4552-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4552-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4552-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4552-25-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4552-24-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4716-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4716-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4716-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4716-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4716-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5168-91-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/5168-86-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/5168-85-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5168-315-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5304-74-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5304-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5304-80-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5304-314-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6108-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6108-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6108-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6108-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6108-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6108-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download