93f8c113f9271f458765a391dd716da39bce81c06aebc1e759485228900bc662

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
Size 3.6MB
Sample260919-ppvxvsfd59
SHA256 93f8c113f9271f458765a391dd716da39bce81c06aebc1e759485228900bc662
MD5 3f1b76bfa7b101e6b159a579403a89c5
SHA1 a183a4d990d3a18b1c3f760b438966df867fd10d
SHA512 c48fb556c68a565d70813980ca0b95f2d2015be65883b690462e0eb221df70c033362cd23d0c0e430f2033978274c07a7f7f6dcff0ebf700bd619523e8a2af51
SSDEEP 98304:5I4kvKvHx15RFAN4z4gGTpOnHNQc9xQrpBAigxAX:5I4kU5RFRz+9OnHt92r//gx
TLSH
T12706BE17FE418471FAC2013B82FD5FBA8D7E9610132DA9E3669539B44F702D26A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3336	elevation_service.exe
2756	elevation_service.exe
5200	maintenanceservice.exe
2560	OSE.EXE
5768	PerceptionSimulationService.exe
5360	perfhost.exe
4984	ReFsDedupSvc.exe
2744	SensorDataService.exe
5500	ssh-agent.exe
4196	AgentService.exe
6020	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aa6fdc8db68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\UnlockCompress.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000221d97be3248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a77086bd3248dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb69befe3248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a19e8fe3248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006496bcc13248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	236	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
Token: SeTakeOwnershipPrivilege	3336	elevation_service.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4196	AgentService.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4984	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4984	ReFsDedupSvc.exe
Token: 33	6020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6020	SearchIndexer.exe
Token: SeDebugPrivilege	3336	elevation_service.exe
Token: SeDebugPrivilege	2756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 3924	6020	SearchIndexer.exe	100
PID 6020 wrote to memory of 108	6020	SearchIndexer.exe	101
PID 6020 wrote to memory of 2632	6020	SearchIndexer.exe	102
PID 6020 wrote to memory of 3312	6020	SearchIndexer.exe	103
PID 6020 wrote to memory of 240	6020	SearchIndexer.exe	105
PID 6020 wrote to memory of 2720	6020	SearchIndexer.exe	106
PID 6020 wrote to memory of 3492	6020	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 51d9a6829ce5176d54b82158d3feae55230d4de6af84e6fdaff2edad3c41de4e
MD5 02a9ba0c9904d547beda44596b05a1da
SHA1 81055c2fd19a04f36a916cec7774ca2fb7361616
SHA512 e906bd01c62a73c6dbc12d781d98f4af01d4d0f0f8b7672446c87d5bd205bcf91cc42099b661d1cb39d1ca8a23905f98d59449a425312ea2c36a8d1e7734e5ff
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnrKA3/KcQQxpylDeo:k3q6sjB/AigxAX
TLSH
T1AED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 dc59104509adb187dca629f6a773bcd3f84f7ac7668cac036e30c9b4829ed632
MD5 c26e7b2a17e926be2f25558842d83888
SHA1 909ff8cd4a38258164d916c9a6ef3d8144c9080e
SHA512 f57940da6747cd5aff5dd14b0c94bd1957b8bd192786fd9bd1e5e829e7d636bc2840f420d0a0168f6c9fae3cfea8f7f79ca64c483bd373f5dd26eb0b6b036e9c
SSDEEP 24576:pXYfDtczAeKI6k3sbIhKcQQVOORv3ilDIHo:MtcBKA3/KcQQxpylDeo
TLSH
T16785012873D408F9ECA7827CC8A28515E673BC958760E79F03A899251F337D45D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 50de735a870dcf0c643a188dd2837ce22d6fe31350722e4723aebacd8ad57e07
MD5 ef8cd6d0a08e10e3b57f39c088e94f09
SHA1 f4320394e1058fb62021e11d13ee3af855db110d
SHA512 3cb05512e5639f50fa8dece54a1231c8b49f8f2a1a704a3cd5601a2bfccdef4687d37ceb6f553edb0dc017905d921b5edf9be224b8af03711ec6d1f992594b8b
SSDEEP 24576:d0Le5ji0hmxSrMDKI6k3sbIhKcQQVOORv3ilDIHo:dPji0AkAKA3/KcQQxpylDeo
TLSH
T178A5AE26F6748731D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7198852900e7e71b9da1eb683364655239fef3a19f1c634e0084c5eb1973f636
MD5 d6f1d5532c8e3edea610e37e36ab0b2b
SHA1 e6d74e159810cac352f860347aedf6f3c3793a9f
SHA512 735dbb5654af10cc74c228b3fb6194a173e566df32baf096221dc9243ee0d3a048d01d1877b1ad75d2717d5d5b1270e5de93461df1080d83a2b23ee77ecae0f3
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyuxKI6k3sbIhKcQQVOORv3ilDIHo:I/ezSC6vUzPveHjy0KA3/KcQQxpylDeo
TLSH
T199755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 07b3603e6473a7af24095101077f55e9491b366f00c83ded6fc330051b861260
MD5 1ef72ab2bc4232890ed55434a1658d69
SHA1 a5662937dc6f19a74793c274bb0c0a37a1369658
SHA512 32c067f5bceda07e6e56bf66e3c38596d1d554e18544c0975def8ab9d0441588eed8cd393b5089334ac1acd7c3329c22845687ba46ae80898f67de4f737301d0
SSDEEP 24576:TVbqPb88hv/l+YKKI6k3sbIhKcQQVOORv3ilDIHo:TVO88hXl+ZKA3/KcQQxpylDeo
TLSH
T17F559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 a5c61139930ba8bcd533932a29641ecb543b9dc81c8dcb04c73d9eb83f3f74fd
MD5 2f831b7e9b5ca5a3c5336162cc92cf82
SHA1 82a5b1b9bf29d8d052ffc146373e3ee241f61867
SHA512 43b060aee0d717595a904baba280859a2d51e219319ddcc1e5fa26a7a718105635b0991d8a222d80ef0198596a87b8e635a3b0e5f1c603b936a6cfdb92352ca9
SSDEEP 12288:OwJ2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:OwPKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1617523A6879C08D1FBFBC2B485D967D921E5ECFCCA45C71DC12E3E52403AA70D46A983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7619609bed898cd0b21c64893967b2e936f8e5e4801a5fa0210f81330f58ade9
MD5 3e7f62f235b6598cb9e6f48f0b6808c3
SHA1 7607dd891d1c723a8bd930af4a2d0b70ec883a03
SHA512 e8607a1ba6daa69d4db265fc155a9a51dc8f501186285d1aac453aa7c09c34d51600e3b760c4870e77dd613366b7d84430d7007a2a3334d609c211bac85f1e18
SSDEEP 12288:GeBNUbTVO86UO2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8w:GJIUCKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T17785CF7BEE28FCD2C27A8DB85691874097B278708F5293CBD175820EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e5c0ccc9c803cbcec2ae489a25167cc781ddccd7fb721dad26e3bd1116df5f80
MD5 c136b1a6847fb99efe08a9cd2ab289f0
SHA1 0548b58069decd2d00a366a0a2559e2db8b1bef0
SHA512 8c1373a7fd8c6386bf41b1f09ffb4d8a8a72874f5933b78c2a64d86425ee9619853fceaca424c8db54986356fbdc0d584d79456a556b86e9ffed5cbdf0538668
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:kQvGAdlCEL8c/DRNw5C4AigxAX
TLSH
T1D0266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ca7af8784d68d5bd7dbedb866f45968d8a8f794cc518b6d9f61cf7f1bebb7769
MD5 815b344b6eb46bcefe3dab0669cfdb11
SHA1 852e0dbb4ac120472ccc80fd0dd90f0f43536a16
SHA512 01c2cb14d177e99d68f48ea8834fe27109ddec09da010fa694d11b26ab6fb16dd4bf82455d54d6b26d5334f99dfa41ce19b9f6155e91c45f3adf421ef0f974a5
SSDEEP 24576:R1ewsAjwKI6k3sbIhKcQQVOORv3ilDIHo:PljwKA3/KcQQxpylDeo
TLSH
T14E95E031FA74E432C2BF0DB21B66C716147DB9608F511AC3E3A89E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 24175d4ac4e4c156e66efe45e579efd2dab4791c79a1c7c58a9183405a57aae5
MD5 1801a83d67265c37679663cc92b6addf
SHA1 4cf7f2474228a3fee52c2cc4d7ff00e39ed769de
SHA512 f1e38d941ece6a7b6002c0090c36d9f03fbe16db6f7ca26b68ec8ae07ff1c6ae57c4be7fbdd6fdb96193f3fc0a915105982c67d0fa048f986f67032ab1473e65
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5/gx:fUEtQevvqc2W1cpV2tI32l
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c115b66fb9d74b0994923ee3f76d5fd79dfee1219f20e1f5094243f88bdfad6
MD5 ec3ed6d70269a123f1709fe7ad535872
SHA1 140536ec4db58909f1c3ed3e0981dd3c07883e0d
SHA512 0f43ea90680e82f4adc5f2891685be99bd9095a217dcbcc864d8680aea2f22f58f073365b0f0b7871db329e7074992f1704ec437d9e1b4efe6049d7861837622
SSDEEP 49152:CCbRquA/m2yL5zifFiV+XenmE3/zQKA3/KcQQxpylDeo:HoqHVjnmMAigxAX
TLSH
T12AD58D0976B8C1E4D1F6C77886A2C647F37178158B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d031ee309345b27f4f7921499800ce63c1e77937e6401d89ad8561429d4cdb74
MD5 602bf9f14ee9febe2d991adc5d8f82dd
SHA1 4151c9b806baed6c40fabe2ac80077e3b12ec350
SHA512 5d93976403ecfc2724eaab1bf94db4f876c7d6b31facc717774b3aed409eb56089c49c4f5a65c059fcc3771d862a3aa0cf8b55f6dc05451185fb72ae55ebfa99
SSDEEP 24576:sAhGL3IFoiwtA5l7S531KI6k3sbIhKcQQVOORv3ilDIHo:sAMUFoiq5FKA3/KcQQxpylDeo
TLSH
T137359D81E7F945D4F5B3AAB899B69170EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d3be7174aab319285bad3ec56e5974e52d9e3de4c6576f2cfa5b7cf600312c96
MD5 62b4433fe006f878ccc12d4d29568819
SHA1 3ca84048b381b321a22df50f0d82fdad50d62b09
SHA512 8bd3cbfa594bab0a63e2dd8d553f0256215f4878e20908a4b4a9ca63e6cfbb622a22191bbbe5179f45f74fdd0f8a35a57047eb9eab4efbf65a9bfb8b9f52ab02
SSDEEP 24576:CwupOWUKI6k3sbIhKcQQVOORv3ilDIHo:CwGOpKA3/KcQQxpylDeo
TLSH
T1CE85F14A73A80CF9E9A782388597C136F7F2BC552A25C71F4360C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 4b32701d643997543308be89caa3d18ad5c9ad127a457d884a86aba78d37a9ee
MD5 8b50572516502ab9d7535a6edb0b8df7
SHA1 3be7dff8673343ca4d9829a5c06bf00032c1b02a
SHA512 d55b63933b305bfe09520b2ef53906c81a69c20bd7803a5c62a1c90fff5077521b0794486dc2f7ddddb5e3dff8744c4ce4c997e6c24fce038497fbdbfa7e4ccb
SSDEEP 12288:pRZ1Iyo2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:jZubKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18C75129A23D820F5E1F7827CC9E45749D3B2BCA5973683CF42291A561F33AE05C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fa241cd3ac88140aad4559abb04f9a4f650b4ac7cb916e39f264cfa769751d66
MD5 63470e8bfe3be5a634e7779f834fba52
SHA1 d4668a0d9dcc28cc71308cf03ee0198027cff2e7
SHA512 6c92de8cfc88c0022851dc43f69a3b11933b4259ce3be61eb75471908f802b3b5d62f03927b5381bbf8f29e18972cbf5440031557de24fb4e776631c9efa101e
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:kQRQyi36YOcPbLvw2gAf+PN3rAigxAX
TLSH
T1CE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b6f5a34799e718b4d359139aa379756a8fe3fc05033319d92b5a54047134ea63
MD5 0e15131b043c0c74b8d1d0a44400abc6
SHA1 2554939cff375c716a5a87a2e32cde3686cb64b3
SHA512 6954ab93b60923f9b3218e5738e111bbcfe592d1eca287e74af8b668a36f4b20f59567c65cb578d2b436c7de303f5a8069d706b6719dce3f1969e863f9186cf8
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:TQRQyi36YOcPbLvw2gAf+PN3rAigxAX
TLSH
T1DE667C03F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2e97617a567aa726a8222d6366d210e7fc60594b4aad7ace82f8b8388049dda5
MD5 385409a7a056a935e1c06ee186ea66dd
SHA1 cb273f897dbe68e2ea20c0cbabcc6747eeb08dc6
SHA512 9e9bba0f601d46229a834feac12a90dccef7b610b9d04abe2b526c0af824f38548ab5e7a8dc11b4155f821ea2ddf02e1c75704b58cdbe8348868d962e1d30488
SSDEEP 49152:868Qg55nhceWu7PNU3/AKA3/KcQQxpylDeo:2thLRc/xAigxAX
TLSH
T1EDB55933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 193a3fb6135b11bff916b38ab891706d43510c3827aad3bb9272d3390ef9df9f
MD5 d687f8f1c6d66f34eebfbab33ba71c31
SHA1 680b76bdce83d80ceb98e83fb61af79819fa8817
SHA512 6034ef0c1e9fefca3571830791d1f45fae1defa67d27ab023ca6adc02f42ef2294aea7e8aecf421c2565531d6221130c537b178fdcd30e78ac248983c05da860
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:5y5112gYy5azzVvt69nLKnhZCAigxAX
TLSH
T1EA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 86953cc786b290e471dd42c2bf7b9b087cc9e729c3498ac302fc4f7e056482a7
MD5 2ca00e98c301608d6f09b6dc2a3dc5c6
SHA1 8eec125abf477299ddbfc1f6d93120311d2d33b1
SHA512 4c6dc14dbd60597b8e6f011b1dfce302b2af0054751cabe3ba0a9029faef567816ca801ea488060466136665d67b331d98918f9b9bcfcff20d924f4044f01ebe
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gljKA3/KcQQxpylDeo:zu6Jmdxd2dWAigxAX
TLSH
T186D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9210e56c329f9b252ee56dd9d2d3922ceb3310fc22205185350a1846246f8da2
MD5 48a1c7530623a005f291a84cfb96fd09
SHA1 f9d36e591b649229e9c2859c2c87e35b9f703f51
SHA512 a692d58080916d2f275c5648d63bc44c4b5387eaeaf493b9e687ae9ad01581469d1a342177a2fe259052b4aca7dfd9ead91eac6b5e089e1c255b5a542554de0d
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4xiKA3/KcQQxpylDeo:cmifPWRMAigxAX
TLSH
T155B5AE13F2D800E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b0297609ce49d627e58523f458b3f2c501b6dcae9dd6d5563a05c6010fc5fce
MD5 6db07f8fc9f56f66ed325d4d3ebcc005
SHA1 961281a89d3e463d4ba384f165b9d1735d35df35
SHA512 5996520c7d9216323b50674b9d2b340c0f20393ee53285b5eaebf64c260ff2f4071171f2590e6f1ffed59ef51d1e1195b0d539e4983133b71c1eaaa1bfb40423
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqbKA3/KcQQxpylDeo:f5dKii61eAigxAX
TLSH
T10EC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6716f85a90b272f89afd9638cd88191008864c2e427ab49bc26b732004a63504
MD5 fa0fa534f9b6791c61f212c9d3754ba1
SHA1 3317350dd5b25e063f287003cfd1cda66135039a
SHA512 aa31d0b4bc6d7eded6031feffce9299b767a6b1aaae36f5bca7242da99c4066bf2d4e7a763486ca6a9b50d2ddb156f79967b515b6deab9b53e461b21fe356ac2
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5weKA3/KcQQxpylDeo:9X2imphQAigxAX
TLSH
T16995BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 fcaeb56509ece0edf9db3ca954019cc9cebf5e19fca193ecdf58f7f50395a2f3
MD5 5cadac5ffbc402afdf508f82e57f7883
SHA1 a70c0a2c3b8f600ad422a2679a01bf9f6f46c0b7
SHA512 27db1bce7224b8b4b72c196e337c61dd587be943f92d3965be2ca9a88df46a36b19c09fb0c5cf170edeac5f529fa3251933202db43287a04394b59e84eb13777
SSDEEP 12288:rR2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:rHKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18375236A969C08D1F5F7C2B085D967C960E9ECEDEB46C31DD22F3D124237A70646ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5adba30b17b7b4bab426168efee406fd23c1fb4518cd8be93ec0fa95d518e8cf
MD5 50650b3c7c00b77575efa53bb29cc55c
SHA1 f6bbdc5bf39af17cc4acf802538a3da029daa621
SHA512 69ed4a10401e82ddabf65ca92177bba4ccf94bc5fdde04997c5c9b8ef0473bc4c696d61ae38eec099415c392a97f007f123cea9fd6cd24750bede8a6b17fd3ba
SSDEEP 12288:G82mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:GcKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T13075236A969C08D1F5F7C2B085D967C960E4ECFDEB46C31DD22E3D124237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 ae874a9a80821bf8f9d492e306a2f7ef81cf9b9669ece6d1a0d44e4352c12747
MD5 d27c014466badae263437e78a7b02b78
SHA1 1dc0f9fe3f8ae7072b442fc5e9d922ede16cbaf6
SHA512 925bcd880b822da6b7a1a812355910c8b4897236a075e75225e228dfe79f06e9a1e2cab9edd22cc13f513c64c8ab532ea0dc4bbf5de51a990f88d1c939b6ed65
SSDEEP 12288:aW2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:aaKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1FC7523AA969C08D1F5F7C2B485D967D960E4ECEDEB46C31DD22F3D024137A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 cbaa14f76f9f384c429975fb3d86f73d89b8a635ab78f3f361ea5b17acab87c5
MD5 4fbf3c738854c407355cc1919a4f8c4f
SHA1 183489582bd9199f993645abe781e5da374fe910
SHA512 345f18f08ac20e3d4e98508d57846f9627f388e38d7ba20911a1cc198eeda5f58fe245ec523e482dfd56deef06a159661ee1fe92708ae273f288f0fa9a44792f
SSDEEP 12288:CVz2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:EKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T145752356539C04D1F8F7C2B4C5E59799A2F5FCE8DB12835FC61A3D020A727B0A839E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8b156db4630227b20f3006ace28439e2a369c00ceda51289b085c0c9b106e575
MD5 84c52be5da8937a3166ca21abbacc2d8
SHA1 ab976b0b0cd9a6ba2fa96f9254dde72f3f5bfa1d
SHA512 e9b5eefc34d9d15eb525d3809c1feb092a840ca5f0af4534014134bc928ebe7549c3edd20eff10f400ba9563360faf0f612743d9822ac58163bb3ec199e57a06
SSDEEP 12288:qL2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:q9KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T14375236A969C08D1F5F7C2B085C967D960E5ECEDEB46C31DD22F3D124137A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 7ecf5303afc8e97a34e29338e89b798684b96fb5903127633008d084553f075d
MD5 4e8caa9b540c4bbcd22d26a744d0003d
SHA1 a22be17b5f3b2b9b15c3b39a056ea4ce4f203c27
SHA512 fc7527837542944b60dafea8f308e091216a5b06836ee21767496de31d1398cfdffde04aa38c031ee892b53750b85bfe92500e94c24f780f84e26339e04d2185
SSDEEP 12288:pg2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:pIKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1C175236A969C08D1F5F7C2B085D867CD60E5ECEDEB46C31DD22E3D124237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f75b6d5dc78f8c2d34aaa1dc41d0df6652ff49aa5337e275b7fd921650502626
MD5 392a2698e609a8e98f75ef97a865cf6c
SHA1 9bdb9d353675276673608f73b35fabd75abc8df1
SHA512 1373b5c0ad125904eb06a8b3fa71739a826d498e1ec042c253a93f63c22e8818a35d9721c8f16c22bc106db223ece23a2c0bec28e7271dc48b407179d69a7d80
SSDEEP 12288:R02mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:RkKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1A075236A969C08D1F5F7C2B085C867DD50E8ECEDEB46C31DD22E3D024237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 b5691fbc01f3352c1c8563409a67fb205abb5a21bec84e070de2990f83cddd01
MD5 55ba436878af10dea73e1262544d63e2
SHA1 7fcf05240c134b76752b09190ae6b62d69e0b335
SHA512 e44b354fa81d6ee9e2877912705b87db2939cfc77c8b08dba1331419fb2f18b8481f0e7f98ba167e71df00cc518d6b91d0f18c93e68d0d0900da262909e2bb53
SSDEEP 24576:fZMIzFVSO8KI6k3sbIhKcQQVOORv3ilDIHo:fZMIzf4KA3/KcQQxpylDeo
TLSH
T15A85F195B39418F4ECA7813EC9559A46D2B2BC694B60C61F03B836275F333A11C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 0d9dbd93eff238512f3a518bfca302509c67137000f16cc902732f4a7d8ff543
MD5 d0d63e28d91b5d1a8bcbb469232940cc
SHA1 17bef3d702c611b5636d42d0d1150cd5982e2e01
SHA512 926216e60afa0ea445c5e5562a55e87144c3af9d383f2af9120c5a55d2bfc8f81b0eacfa747b9d577fa4177d5f4ef2375d2670ff8709dd0b4a63358789c4e242
SSDEEP 12288:R92mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:RLKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1957523AA969C08D1F5F7C2B485C957D950E8ECEDEB46C31DD22F3D024237A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 5b4ec4e120fb6766849775e6372ff3940eb23fb941ecfbb2dad779bd11d69171
MD5 4f570434928fc8dab1c8f98b81c7e38b
SHA1 33f9e3eb6b0d371eebc26fce5c450ab522d39edd
SHA512 5b07f0be711a3ed17eef9fccc742837f65e968656fb15c5984ff2253cae205fc0a555cf299a35d79b66a2447bb64c322df3ca6bf97dfdaa0acc8669ccf313bde
SSDEEP 12288:q52mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:q/KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T16C75236A969C08D1F5F7C2B485C857D950E8ECEDEB46C31DD22E3D025237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 03f25cfa57e9ab56bb22451787053f468c6c2b9d604625ed7072a7203f69295b
MD5 3b799247027063cdb1a1f960ce7717fb
SHA1 bd8647d016c9c0284fa4812373f63efac35f42a9
SHA512 642080f6fb2eb62fb56d29c6db2375bc5baea44efc5c4d28cd60d70fd977e2241b0c8a8ae2cadb923e51dfc0af2e3563fee94b91b44c6c296cb66278af2a56f6
SSDEEP 12288:3yPz5L8o2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvI:6zygKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T14485025773A420F9E1778238C8911A46F3B1BC7687208BAF53641B761F376A09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 7e6a96f198024cbbce9d9e13b95927188d0729fe8926d4ad8ee8c40696facdb4
MD5 58f06f7be7c6fdf2aa667b1d7c2ec4e9
SHA1 92b6328268c08d12db65fc34fa9a672b81f1ef23
SHA512 2a026e3def8c7ccd835eb9277025ff839ee4dd87a0b810b84f6532a1d76d5046e29b9f4d4a4ab663698e4b516e6b15d35b15e5c1acd1922edf3a2bbf07667da6
SSDEEP 12288:c92mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:cLKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1667523AA969C08D1F5F7C2B485C967D950E8ECEDEB46C31DD22F3D114237A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 30e76b954abf55ba25f6b9c9f48646c65cc5c9f22e4d2693e3ebb7a378d6526d
MD5 95a2706115374c853462613722a267ff
SHA1 2a28e3ae4827cd375e978d1c0d14dd7770d7f8a5
SHA512 9384b8e89f291432ed5ea72f3ed590d100f64379939dc25f43df3ff1a07879ac3a935b41a4149051a3aa1e298f33546d97341df7c92187a34a008ea57c4fbc69
SSDEEP 12288:p92mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:pLKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1B87523AA969C08D1F5F7C2B485C857DD60E8ECEDEB46C31DD22F3D114237A70686A8D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 51f3ee78e542b36a52ad5c0d8c7b4f0001e2aed70e4632b3dbcf29c803d24106
MD5 b3605436cf35c68e59fd64a611e9b7fb
SHA1 714006057f8a805072c444e0d90a0cd326f6bd03
SHA512 8a4857eff1f7278cdf2cb0795a4cfdb42cb28add1d2e88e9c3ab91489262bfc3a5e1f605d0b87d06885dfe1e1109db4b2739ce6cb84c67745ec5db5f86854597
SSDEEP 12288:pyPz5L8o2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvI:IzygKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1ED85025773A420F9E1778238C8911A46F3B1BC7687208BAF53641B761F376A09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 6763891ea41593115be7afd25bdc1068cae219508d47215f8d22835824fa1a1e
MD5 92c094eb2951e2e6f552cfad88156a91
SHA1 8e65d7a9a1e211e3106ba96c8a762cae385f7a65
SHA512 8f13caa7f8366298cfa0f9af770609e977305dbefdd3159fdef6ed15ef25db41ad596595201eb01cd24167ec2ee06182d4dc99356ca0e8f90ae71bbbe2aa82d8
SSDEEP 24576:BTmaLl3z0zDqKI6k3sbIhKcQQVOORv3ilDIHo:BTlLljxKA3/KcQQxpylDeo
TLSH
T1588502A5B39018F4ECA7817EC9558946D2F2BC6A4760C61F03A836675F333A05C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8d0d13bca041810149eeb665f3d0653e2cf7a09a1972249c159eb12b29dc0549
MD5 a506e1f241c1ac827dd8f623bc2b3f54
SHA1 8158d5986a8e6137b52367f2fe8318f4bd6824b0
SHA512 ee2eaa8b557df8de4b276bb81726c219c73f099794cdf05749ee8fe467b196bb2f101dea0ae1afb0f6a396ac935373fe9177733dcb836aea6b2f7031bc32c9b1
SSDEEP 24576:j3ed9CHKy7GZ2KI6k3sbIhKcQQVOORv3ilDIHo:Ded9CHKya4KA3/KcQQxpylDeo
TLSH
T1A595CF90F3E814E4F1B7CA35C9765511DAB67C995B21CA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 41a216b0d1e23f5a42f8c2a1c37727af1c6f5771a2bad5ac754191f506d115d9
MD5 5080e5dec2bb07d92069e0ca8642bc55
SHA1 a395608e22e86b72592fa588ff954301f0c39ff8
SHA512 9c05b152f4e4e94f548f9a374b6c6d0af985e08c5aaff5084374897f460c96cfb303eae15713ebfc860c78e8d209dfa97cf97add627749ad402e58801c81ea8d
SSDEEP 12288:M22mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:M6KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T15C75236A969C08D1F5F7C2B485C967D960E5ECEDEB46C31DD22F3D024237A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 d7c9ac3c4eb38ad8524b093da31a04f3b2f934fba137461b104475e95e3c5d5b
MD5 40fc56e51c9b2f0c10ab5094e0a9ee57
SHA1 a4c89234e634ee9255bc5514854d11a8481c7063
SHA512 1dde2791037a77542faf48e8c0977854ac6c90f1d9691d883a8482c79d7ffce5e76c0330f4e490f227259c6267555681eb93092c4eaac70687385ddee7f24720
SSDEEP 12288:oI2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:oAKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1DD75236A969C08E1F5FBC2B085D957C960E4ECFDEB46C31DD22F3D024237A70586A8D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 8e90eafea4409e2a5ab1b0b10bd240ae99bb3be4832a0ac47b7cc869562b0a4f
MD5 9839e6979d65262cb15e9e152a054e5a
SHA1 c7c042dc72118ed7147ec518cab8390db6285d1f
SHA512 6e38d93fc475699e8ad72d0a8ca834da107b271851f62f08050301fafe62d8c0519282a895aec4351430c39535994e5418f16110ad3cb75a97ca41e1928c93a2
SSDEEP 12288:yP2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:y5KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1847523AA969C08D1F5F7C2B485C957DD60E8ECEDEB46C31DD22F3D014237A70686A8D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 f7af5b99bcb11185548ef21f3cc85f50cdbb01c0635ccb47cb64e6b55a8e2af2
MD5 c2897e4566b46992415aae44093ac70d
SHA1 5c3e1274dadbd86f5f399f74396218c114ecc717
SHA512 5422c06d30a3d39f06d8a242778a9a497efcc55b7655968f0ca8616da7295f43e8f80fbbb0d1d479eec11f442b608408b06e93942596cad1c82011881198a19b
SSDEEP 12288:Q92mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:QLKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1967523AA969C08D1F5F7C2B585C967D950E8ECEDEB46C31DD22F3D014237A70686A8C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 60bbbe78ce7093815d20660846075c111fd4049f4a26976af86eb0bf66077980
MD5 ae7ef657834566d4d3d7b8012e2de091
SHA1 df35eddad63f16e3f81b2b4c17969cd084c0e4e2
SHA512 8caab09ed5d0f806ea30c0568357c8c1b573dae3ffce58d060d08b2d8b597c793475ea226b8d10467711d39843b207328d3a620cf806458756ff73d7e5c4386a
SSDEEP 12288:622mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:66KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1247523AA969C08D1F5F7C2B485C957D960E5ECEDEB46C31DD22F3D024137A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 885daea069420e714c25e37c97dc07d9c97bfdc955f25417982ecbdf54c01622
MD5 bf2551057955bd35bf740ea6a2ff2514
SHA1 2ce1a227d6a25660a08e3440f868d489957d76d2
SHA512 88b11c15e8343e13320977ecd5eca6e157559dd15b803dd044ce83fe413d3a48d49cc8c3a26074c0939fd60ec3d84001fef2a49ca2c6f8a6a14adbc230793524
SSDEEP 12288:Z12mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:ZTKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1097523AA969C08D1F5F7C2B485C857D950E8ECEDEB46C31DD22F3D024237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 7db1cda981af9252061437a3a9232f6fb9ed0cc5d9a29f90656e1b868759e9df
MD5 78b0b414030f2a1e6b4c8241eadc0e5c
SHA1 59f4bf79638f76c1ac1a312372349c9615a98027
SHA512 91427dffe9f982cc3680517464d30a66b055f7b82f080a417be30dd90da5ec110925c550d24d64b475ee51c6b7b6be4c2fe0d6486e3de943bb870c49eb1024af
SSDEEP 12288:1L2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:19KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1DF75236A969C08D1F5F7C2B085C967D960E5ECEDEB46C31DD22F3D024137A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 6b5b9cbaee2d8da52c0b59dfbcced0715bb5c661d8af4972d77a216e92161539
MD5 3e99fbe2a990e4dc937952404076505d
SHA1 ddd65f42bfbc2dd9167799a24f6d8a35afe5b262
SHA512 1e3b1fd706ea10f0746de3c5ab7d6ce52079244a8fa349f031d874d4b4e4ad5bee9da280f4a27c9871f4da4c537b333fc8ff824fb1422ef1d45688028eeafde3
SSDEEP 24576:ofwvkk9RX6wkyAIvKI6k3sbIhKcQQVOORv3ilDIHo:sMnYIvKA3/KcQQxpylDeo
TLSH
T188A5CF29EBDC04E5E1B7923C89B7460AF2B178695B31C6CF025A536D0E37EE05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f51973c50cf5e87eec116a243dd2a6deabb728c528aebee0db7b7fe5e4100629
MD5 60edfb8baad8ce59068f271b5ceccd57
SHA1 67a142f52ee26bb06c2731143cb95163ba13a8b6
SHA512 a6138b5188d263bd629946f9deb6204565b9720e3acf8d8533b456545b18d760a9ee66f15dcb817ec504a4eab956b2d773e8a355a76442a54d2be2fda544ff50
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+KA3/KcQQxpyR:dySzPLAigxAX
TLSH
T10F066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5618291c508bd04e230abb8a0699a6be5807fd45fb6f954925bdf3f51a636f3a
MD5 5129a722828678015a1ddc3f60963364
SHA1 97f6955ac0c0386bd854fabd3168107ca3124137
SHA512 50fb46be28db63ddc8dc35a554a4b58e52dc3b31c0387caf07b7a99a5bf9844e3484bee1bc1440927710ee3fbee7e85f32cd2abcd6b334d197cedbadc094888e
SSDEEP 24576:v47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYsKI6k3sbIhKcQQVOORv3ilDIHo:v47JUQjTirIhCnDHUPfF/uKA3/KcQQxM
TLSH
T19865AD1EA3EC01E5E1BAC27885154A5AEA71782E1F31CACF1270837D6F23ED45E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9ee1f139dccdb3eae7f537f91f05b9fcd1b6b121458bf9b479d35837b7dd6e7c
MD5 a46818fbdad145ab9a6eae9ceb0825b7
SHA1 397e4d45daee805897ec8f86ed77d8e5abfb966c
SHA512 c5692d94c21cfdcd6a6494084d4a2899c1a78108f20024052b46762ee192c8dbfa55666c4d937f43d370b2fa7ce080ab8efbb96e845eb1b1dbb7916d9eb367a3
SSDEEP 12288:F2sfN2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:HbKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T15685011AD29801E8D0AE9275C7955A45B3737C6987E1C3CF52D0F93E0F366A09CEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 322f7eeeecdf11d291e40817722ec9b794d8ad30198eb5a0ea1174c9fcd81107
MD5 eac8422387481cfa7f4680e9925e645b
SHA1 d470e7a47067ab6323779f76f750cfd4f7d58ee8
SHA512 57367b0214d241500a09634c55c83235915c80e14341e5bac8a67f97eaf1c9fdd4dd7cd08aa8496c5cf7abf040a88c9c75c12bcaef0345b352ccb59b62aae726
SSDEEP 12288:+FAPtA2pJ1hk0V76IxyWBCXB6odqCU4RUn+tdxM6:+axXKFaf+BJqERU+TxX
TLSH
T1C83506117666CB4FC66980321E32C1CCAB707D11EE45AF0773C98B3F8576659BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 74dcfe6eb6b27717d6b9805bf7aa2d7f90831a61ea3243cff152430da01caf14
MD5 7a13fe089069a93316d6155d98d7f45b
SHA1 d2774fd6b6557a980c12709aab6a2503557b86de
SHA512 1468325b5fe5f42dd44055f4a5caa9cf8eb1313f6d9fa0ede2d9ce5b615ae946e6593f9a1d9c95cecf2bea22507e28db028a1f945ebd79f4be20ae1f98e6e4a5
SSDEEP 12288:2tNaPZuPnDaRlhnQlD9wqs0FUqld7bt0cBXhrvfpkRoMmLPa9uKVKHKYhtpmH6h1:8awPnDEgbZBn1l6TgqpAVL
TLSH
T1ED651A816136E6CFD1B76032072A5B8C7BA4EC07B7095F16B7C9453AD82AB11A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remcom.log

Path C:\Users\Admin\AppData\Local\Temp\remcom.log
Size 352B
SHA256 7a8ddc5fd2f038079f532884e8113d08350938a1316ad62204a056c4b4887b39
MD5 aab3b0b871e81c5411a4efa34a6d363e
SHA1 36c3fcdf8830e93c6f60547000e31bfc2629e88b
SHA512 14e4f3a3f8bea027e4d8b78aa4ceb9021da02f5adffcdac997d46958bf2c7f7dda410c9889a1c8bedaf17228cf1912c3d59098171e37500f7c6e178e4c5fa4a1
TLSH
T15FE04C2F4AF18D660D5F610E10BA9AF1B0663EF16289C65D126BBC42348E8BDF780352
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2ce6e5270c60b2b729681034141e50e0eaae3ea89835fc497cf4b82a937da96c
MD5 7888cbee99149e2ca68159b18dfa5a93
SHA1 65bc239736b6bcf00d533c608a5da88464c671c4
SHA512 461954ef2afe51845c043340b50617b77777270fed3e09a637827b1460fe7befa516da386d5be7a7e2504b8e6666215e9115a9a5c332fb7bbd7104f6199583a9
SSDEEP 12288:a47F2mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:XjKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T185752366839C0891F4FBC2B085D9936921A9FCFCDF05C2DFE11E3A525136AE09C79987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bfdd842c2de064c10c2c2e43da89e4c9c360339f1c4898dd41271af00fb5ae9d
MD5 febfd9227cc263ecf8f68dcfb6b76811
SHA1 42a02c85acf97ce7758318761fc69c4fe54500bb
SHA512 33fa742eea41451126422f7d6b182d5ab24a4265b9b471c39e6bcb8cd087a4c7a1b9a5a80d95a8b8e08900b915da6f7a54cf8749d4f58683848d6cc4c1d94938
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYxKI6k3sbIhKcQQVOORv3ilDIHo:jgb4mBIBhGFsKA3/KcQQxpylDeo
TLSH
T1E865AE1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5867fa0fb04416a3d5c7dbf647e3cd1fc96d7c123e7fbbc06826a5fbb42d9ed6
MD5 fe62a93b1c3a33471c7a37abd34ce009
SHA1 d3afe5e27c438fe7915bdd9435b520c02a943c09
SHA512 da223ba3b9be4771e2337c22e70176ddb363e3c967b31bbb3583206a9744ec317c134fbffdde23050a35f1003ff3e13c0a3ff9cb2670a9ac94c10d31a6eae735
SSDEEP 24576:rG88u8FpJqH1Ezria7/m8KI6k3sbIhKcQQVOORv3ilDIHo:q7ZFPqVTa7/ZKA3/KcQQxpylDeo
TLSH
T1B5A5F16567E401F1D4BBD13889864667F6B2B8250364EBDF07AC8B511F23AE04B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df30289256fd57c35461b7fb24e9d95eaed1bf097b9846a61b640b418bdd72fc
MD5 a617472e56f030cb45c3418a8a5efa52
SHA1 09e3792efa3208bb06d1589f7db4b670e5be0a58
SHA512 64f9bf80cd38a0bcab38f3d929f9a5bda047b00bddb5630b110c82528d2b38980552fdd9ba55a69a247494bf6d01fea5cd477b0094ef053f37a132558d67fc64
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIKA3/KcQQxpylDeo:jG05lO43b6AigxAX
TLSH
T1D4D5C06E62EC11F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c518fb52edbb28972e19cde8811ace420d47f23414ff2be3839b9855f98e79af
MD5 567a74da3fee6a90632b614599c35c86
SHA1 cd0f100b1d323f26cab02ed8ca080b50c67aa80b
SHA512 c05dd8cf0114140e20b49a8a24d760105df3dbf2818136e45e79ca64b407d0268051ca5852216c087901a559432c7e2e4a1e7ca2d32f84db08cce397d9f119ae
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+KI6k3sbIhKcQQVOORv3ilDIHo:Sa5POZ3BJt2pasx2+mAKA3/KcQQxpylX
TLSH
T15365AF5EA6FC00D5E5B9D17DC583861AE5B1342553329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5691a9a506711f31471402f2ee3328e8f4cf655cc0fefc81d49e2ebcb5d0fa74
MD5 79d1d19c07780e93d5c7766857b71a85
SHA1 bfc3d3df4f405849ed6b8889bb959d72ebad7c77
SHA512 b4b73f4dbec888a1d6d13c7a1c2fe762f0779d223fc68bd49d39f2601af3f3633787ba94e943f643a4c07f4232c275c46baeaf741c32ba7c424aa43d2bc5c13c
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7Fk0KI6k3sbIhKcQQVOORv3ilDIHo:ONc/zEOVHF5KA3/KcQQxpylDeo
TLSH
T134858C1623E801E4F5BBE1BE89779546FAB17869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2b77bd27aafe3bf470c9f3ff9ccdf29312ae4dd30a9bbca7bf19f5bc0db517dd
MD5 eec59c4d71a513a988c2c4184d7c3ab2
SHA1 6e4df68ef74c1e0a732460664a84b1f0d7a20eba
SHA512 93a5148b3bdffbf9a66940a600ebd5b13686b58f8776df151d4041b8d8f8331c4a527ef6ebf17c212fbace3343c49be7defa9d25e5d8f68a6b384f5172b6f60a
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmnKI6k3sbIhKcQQVOORv3ilDIHo:FTMwBtOmnKA3/KcQQxpylDeo
TLSH
T13555AF6EA6B805E4E1FEC6B5CD238512E6727861073293CF5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 fd642be720d4bd48837a058a74caffa30a5a36aaff1b56ae88d6dff1eed221bc
MD5 229380ed7b5c8a469f66330ea64e153e
SHA1 f816595dcadaff69ba5bc1461263f845d52403bf
SHA512 64a2be1e9d0cca0e23bbceaf079276c60f4c5dc45e1183709f83df20d07f17c0195a6d94f38de7526365732f8d4bbd9f6f72581c7f04eaa5d54f5a96f75c06b1
SSDEEP 24576:TPUr+NQ4KI6k3sbIhKcQQVOORv3ilDIHo:TJQ4KA3/KcQQxpylDeo
TLSH
T1C985E12F62EC18E5F676E17D85868709F371B8664712D2CF02A1817E4A27EE4BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 84ef15f8414f9f9e6eacf82e82c69c91b44616e363b1f23582fef5059aee334d
MD5 1e1b4e458441cb3414fc12f252efd48d
SHA1 3e022e81981a39fff1f4d3541f05f9a384ed4514
SHA512 a559907c42544e5082487d9210619cda5d83f2a058d6a3cb4b58a2f35d4c0e2fb6657cf2422228a38cd44c7df6996274ea8c577fd3c237adb78ce9fc6d4161fa
SSDEEP 24576:5D3FHshBIYQgAnKI6k3sbIhKcQQVOORv3ilDIHo:5DVHeBIAAnKA3/KcQQxpylDeo
TLSH
T1E895E17EE69C04E4E57BC1BCC6938A06E37178AD032256CB029491B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-0-0x0000000000400000-0x00000000007AB000-memory.dmp

Download

memory/236-15-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/236-1-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/236-22-0x0000000000400000-0x00000000007AB000-memory.dmp

Download

memory/2560-73-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2560-67-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2560-66-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2560-290-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2744-323-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2744-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2744-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-113-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2744-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2756-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2756-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2756-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2756-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-32-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-31-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-25-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3336-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4196-146-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4196-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4196-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4196-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4196-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4984-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-339-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4984-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5200-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5200-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5200-50-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/5200-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5200-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5200-64-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/5360-320-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/5360-95-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/5360-89-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/5360-90-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/5500-132-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5500-326-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/5500-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5500-124-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/5768-77-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5768-307-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5768-85-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6020-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6020-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6020-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download