b6eb6a2e58e99aa38a75d1b10438103141a0fdedf19e0a3366153436a693a053

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Size 3.7MB
Sample260930-appzaaxv9k
SHA256 b6eb6a2e58e99aa38a75d1b10438103141a0fdedf19e0a3366153436a693a053
MD5 5a194be6a1e65e68279949687058fae0
SHA1 9c60017c884fc9c74ce88f08576b5d9eb1d77ef9
SHA512 5456e7cd6e1b6d04727cef46b73bf77ee8b1d151ae4475499008b93220c546e774b62b7a6b9bc3c9641e41090a7c7785698cd5faf80c890d574e74faedd09b0d
SSDEEP 98304:TC0Uq/np6a7MwvXlUvUF4hGFogfJ4km7EqPb7r1:eq/nAoV43GSgfJ4J1
TLSH
T17106E112FBC2C1B1E59302745566B73F8D3DBA34672889C7ABC11D298C316D2663A36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5600	elevation_service.exe
4400	elevation_service.exe
5556	maintenanceservice.exe
4744	OSE.EXE
948	PerceptionSimulationService.exe
3916	perfhost.exe
5628	ReFsDedupSvc.exe
680	SensorDataService.exe
4496	ssh-agent.exe
1884	AgentService.exe
6032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c1a27889b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2768-0-0x0000000000400000-0x0000000000DD2000-memory.dmp	upx
behavioral2/files/0x0001000000009323-46.dat	upx
behavioral2/memory/2768-49-0x0000000000400000-0x0000000000DD2000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026d6b4137250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008fd8c3147250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9e0fc547250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531bf1137250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005312c7547250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2a21e177250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
5600	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe
4400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2768	2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeTakeOwnershipPrivilege	5600	elevation_service.exe
Token: SeBackupPrivilege	5628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5628	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1884	AgentService.exe
Token: 33	6032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6032	SearchIndexer.exe
Token: SeDebugPrivilege	5600	elevation_service.exe
Token: SeDebugPrivilege	4400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 3348	6032	SearchIndexer.exe	100
PID 6032 wrote to memory of 3196	6032	SearchIndexer.exe	101
PID 6032 wrote to memory of 2396	6032	SearchIndexer.exe	102
PID 6032 wrote to memory of 4260	6032	SearchIndexer.exe	103
PID 6032 wrote to memory of 2276	6032	SearchIndexer.exe	107
PID 6032 wrote to memory of 3292	6032	SearchIndexer.exe	108
PID 6032 wrote to memory of 2640	6032	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5a194be6a1e65e68279949687058fae0_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2832 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2872 2888 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2872 2888 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2832 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5cfd5517ea553910573cf345cb28cdbcc31a28a8fa402ce0310ef73fb4620322
MD5 04b33092b59b1bb2c3d83b3497f69b67
SHA1 de9eb634027eb141cae3fb05438884a5c5b78c49
SHA512 57d3b7463aa21034a64aad331a204eec41481a629d047cc7007ce8cc985d951c51e9f9ee40ac7fc28be119ae26c84b047774670945ab815ab82f8d68ba723b9b
SSDEEP 49152:Lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnfJ4klKXnF:Z3q6mjBMfJ4k
TLSH
T1E2D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 606337919471765f34e5fff60cac53a0c9f9eb0aeb3243caa0a6d02a67f9d75f
MD5 fa145c2157f6f4eb3ad5f12724ff1950
SHA1 32f26c8bd095016e6af38a1253f02cec10af600e
SHA512 46182bd180022e6e91cf5fd81406b31f48e4686035d64808dafcddf26ecd6788d93726b53b80bb80835b62a5a124a4b020e4a19b734422d9f76905f67e1debfc
SSDEEP 12288:Z1XLsswWkxy2lRq2czAQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:3XYfDtczAQfJ4yL/tNCJPXUQrP5
TLSH
T1AE05F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3ad6fa6320be8e6ea75be2e30484d5a8915e70e5e3f618cb4b6b474cbdd3606a
MD5 201628d9f296cca9dbc1c40f7f6d0abb
SHA1 c1f6a70c25461b0bd3070df2ae8cb63f9f881d65
SHA512 ced104810d09da67bf16e3fd8de90bd86c83554538dad65ff88e350acef902319d351a67cb5ce48a9c03c61239a306e343b9ffcab309e9ccf29ea32897086bfe
SSDEEP 24576:Q0Le5ji0hmxhrMPfJ4yL/tNCJPXUQrPf:QPji0AzufJ4klKXnH
TLSH
T10435AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39a1ebe6449c76440b050c74ee6354099654df773a76980b8679346d58bcc5ed
MD5 6664e017444da2e15e9b396bd18df892
SHA1 c057330e430c9a79538954d8fcbba152bfb27622
SHA512 805b94f637a1da02e07f24bb9d18c6e1703880939451512d6d6b3244f3092bc634e7ca00642611e4229154c8035eec4b4d6cd1a9435ff649c9c7f8fe07e54a3f
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyuRfJ4yL/tNCJPXUQrPR:I/ezSC6vUzPv+HjyCfJ4klKXnp
TLSH
T17E756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f1aff389086abcd645ee4abe9417f00d09237eb7c2a2d32099b0b76efd892b8
MD5 37ea8d94138fa23d73f89d1d196ad629
SHA1 cee241359bb85b97abad03944f5f92372ed0c9a2
SHA512 ceea3553000aa5d47452db2df385def76285652e4acbea1c62016266094fc509c13a1b94b05afafcdbcff0ff5240411800fd26b8d54f188821d1fa1bdcbd39ac
SSDEEP 24576:4VbqPb88hv/l+BcfJ4yL/tNCJPXUQrPO:4VO88hXl+OfJ4klKXnW
TLSH
T16A559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2ffc05adc58988b83cb5b77fb7eee396013f1596a18ada2a55a60f2910b9a99a
MD5 c9c5ee3ad816f1c77e8f31822c5d2e87
SHA1 5dc0eb98401d1e61970b6f229b4718b5e2d27efe
SHA512 62c3d9e9274cb21078c6ca6351ea835c1079c89ac7515c8686c6f5d8205b040ec37f76b49d93d1a2d911a7f93f579770610e2439a94b4331dc0411a82d428517
SSDEEP 12288:sGbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:sGbfJ4yL/tNCJPXUQrPy
TLSH
T1E1C423E751849486DF6687F82A8CF001C304BEC5562FA2F6CE82B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39e245e20a8f70a9a6acf03321206148f478601b45dca8e8d832058379f1d114
MD5 aacc1961ba180c12755f6560e800ac38
SHA1 19757229bd32b3cc63b6a7f62c176ed6734fdd72
SHA512 6fc4fc1c73b55911af176b982b9243a7e59d433919161edf48d6e1c995d1e59e06705b470662c5300494dcd98f1213ad12d7800663ba6fc974916b640ffa348d
SSDEEP 12288:DeBNUbTVO86UEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:DJIUEfJ4yL/tNCJPXUQrPZ
TLSH
T11F05C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2e1ff533aa7163393beeb581a65edee129c1fe05070b3b4c51d514b8d815d320
MD5 9e58c94cd1b8aedcc31a669d834f7adb
SHA1 f79a3bc640d8e937c5ce9242f5a68d5536060180
SHA512 1400a224c28ffebcc9b523df0f37563abfdbde821045b53582dff8c441ba116808f8d38bcb5005de8d46845a56bd5bbbf862b03e7404d72c8856f4db9883c885
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THQ:MQvGAdlCEL8c/WRNw5ChfJ4k
TLSH
T1F6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c751a3799646ba8946443e267ebf7f4f8108a9b2d3a3ba9c3d344b526a1dffb3
MD5 42836fe035d338634bf707e4acd46839
SHA1 4cb89031f256fe60e7b175ff29c9000f581ea94a
SHA512 09c9123e6f89aef7ca80f99c3c052745410eb1df4ef16b65309cda01bf640b20a619ac9d9e64c32b96df61e805ffa6c997e56b67bc6dbcd478ebc05983f7a9e9
SSDEEP 12288:DAwSfxL/2Dc3mDLLmt0LDQewsAj+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWo:8fewsAj+fJ4yL/tNCJPXUQrP+
TLSH
T1E315E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 38ee61e847ca8a29561e6ecdf23e13b2b931c7ed32c55a4d9586e94c071caee5
MD5 1d5218b6dbd570005540aa830f450821
SHA1 9fb01c0bd8f8ddad3b70dfbfd3c7e24898b89614
SHA512 d0782bb9a8a4dbd8749f50a559bd66109e071c9845fe8dad0bb2e7d9abe380194ee5280a835e579f19d6ae06159e3f1c1d606eec2a1f4cdced9e9b5cb096922b
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHWfJ4:PUEtQevvqc2W1cpV20I32W
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 95ddeda63b75b624d3a42197b963217f5dd4c4a446bdabeccf238491ba76a5d2
MD5 700a7f836a609792a2b5d7ccff88e44e
SHA1 d63e472590ebe07d0682072823faf37b176b2153
SHA512 51c2c4076b0702c92de74cbf67c061007e0fbe26e38889108eb650fd48bb896861afc94abc7a9ffc311bb2219bc5ea8122680109277a350066a0c74969d1b31a
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/zefJ4klKXnx:ioqtVjnmFfJ4k
TLSH
T18ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0c89a6cd953236ed913a97cda6c40323fc6c359e478e61d13114c4f0d9378ec
MD5 f5743de2dcb97c50af6ed210b5736367
SHA1 ae963e60aedd27cc8a3644525a471e3142702e7e
SHA512 4af16567a060904a7f779b7081427815da6aca9defde161fdc1e498954dfe50b6a85011f0c87fd3fe664c96bd48e2f786c323fe47996f55974d4d3f7ed47d9a5
SSDEEP 24576:bAhGL6IFoiwtA5l7S53lfJ4yL/tNCJPXUQrPm:bAM5Foiq5VfJ4klKXnu
TLSH
T14A359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e264341c81b6d07468a76f7b06c538a339520fea6bc986d11587d975f3117dfc
MD5 bd7796ab1d57bb146828d8db7fb5a149
SHA1 21fb9bb5d12e16ac127aad71a56afb56a2b8d992
SHA512 07c1f38c96e6651d3d05f834cbd2cec714325584b92cc7b521a38625e4a7f79906969b7e3c11aa451871e0e7d44e4be85cc28dc75072ede5cfc88c2f3c18a33d
SSDEEP 12288:2mw5HEjsChNEBFgl0WDm+CxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTE:vwuROWifJ4yL/tNCJPXUQrPI
TLSH
T15005F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d0600e5d2e9540b9698bfce7d55759059843e6e3ad7d816b9930c9bf7f087be0
MD5 04beaff10749030ca02d2b030c6aebe7
SHA1 5ecd9ef95cf78ab2a0cfbee21771fc172b04ccce
SHA512 589f03d5fa692fe304f4187954aa442008994631cf0b9f7296ba305ebb8d67cf62f130b408ff8ba461a26aa23d5214a9780aafc74a8d01060d6ed04029ade270
SSDEEP 12288:FyZ1IyOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:cZu3fJ4yL/tNCJPXUQrPv
TLSH
T178E4129B32D460F9DAA782BC89D4D101D3317C92273A83CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bfacf38e57413aa10f5f6d662e53bd2541e69e0806ff37750f58745e1d28a9ed
MD5 c57ee62ce5afa6118e280894061fb324
SHA1 f811c9fb078f5402f73a74a415f23732299de530
SHA512 73d202ff1c6c00eb837096f11b8abcf42c34bb49f8d5b6ff0be519cdbaba51231d68be33b66892e7d1243854ef185c15ad60909d57aa5f5a1058eca346ce1490
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U2:1QRQyi36YOcPDLvw2gAf+PN34fJ4k
TLSH
T157667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7094975f2101ef2240e0b28333deeb66bfd4b16018cf1a7dda6c51f979f963d5
MD5 276dd92d309b668287483eeb8955c1d6
SHA1 7d95235981406a357013b19c0a252ddbf48b8b0b
SHA512 e12dd2f6bc3887d38c453d70f6bc76ad4de9ff8abf9aaf823b8dcf235c297ccfecc8734a4f94e661f1148a71990367c58d933e9c790d6b5ff71b6298ca0e1e7b
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U9:1QRQyi36YOcPDLvw2gAf+PN34fJ4k
TLSH
T1F4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2806ab8073b690bcfb402419bcab75d3b6a46f70014decf0fe1451e43e4578e4
MD5 0f62e65c0a742ea7dbe2d51b34ec34a6
SHA1 f97fd5214188fc0dff0943922da212991abcd261
SHA512 22c113aef891b4ce72b24b91b7a3d63ee1633c564f64660520c2be7bab4cadc5313bef10f8edaee467618ffb3c6bc3ad0ace503501ac32a66833361ddb09314d
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0nfJ4yL/tNCJPXUq:e68Qg55nhkeWu7PNU3/ufJ4klKXnF
TLSH
T1EAB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73653825d3a5a45d4c67dd3a3b0de5c5fe30a61b7ce6d43b135f734536da42be
MD5 5023cc8e0edcdbad300a8f99f6901d1d
SHA1 64dbaaa3c2571252bc22549f97fec296c154d1b3
SHA512 9a6d76d7b4b7e2bcb67aae07d69ae63e1c52d8b3220c846e34dfcf3bf17e0b47e2c5d7ff8a1bff23bc9c86c2c70ddb8bc99df931c2a1e38dbd4ece1920e4606c
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99J:Qy5112gYy5azzVvU69nLKnhZbfJ4k
TLSH
T11B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aca19c96eadb0b6bb51e438875d187abc9db5294e4bbbde48db924e42e36f443
MD5 8b903ecaf58511b77cc48e5d4bd4b8f8
SHA1 55211445fb68719065fa6d95382f8cfbb5fc3e89
SHA512 50bc23b0affe4de1d115d0c69b8ace5e09f1726cedc31711d9073e7cca948c0cc7f84b3eed3af85bae4949a2e972a9a96dc3d29b44b0edf60ebd297b4b2454dd
SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljfJ4klKXnk:wu6JmIxd2djfJ4k
TLSH
T169D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6bcbd2a4450c026868c6acab483764b81800b1232f905077dfd79b51de114afa
MD5 a62cb95f6108b3a264c3e8251981193b
SHA1 8bfdd5c47f39dbd68c1225fed866278b6c4d9091
SHA512 c22f1250da1330303472c9111f8bd5b7c64b3222658bdce51eba2ec6d8b8a1704e1acb3165a68a4459016ce22d03ef99c0ff6b47148c18ec7b4503302aeb4a52
SSDEEP 49152:81hpsNoJpF1A67U44CwH7R4xkfJ4klKXnw:8mifPqRFfJ4k
TLSH
T118B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b5df3d734ef1bb6473d7321742b6b650d4017d530ca546f669f41c00aa301328
MD5 da379f2c736ae293ee4b780429ee0929
SHA1 04c4cade76deede65f53c495ea4ee16379751d47
SHA512 6367aed4347b5e116f0abf08c4877e3175127c79c60c5ef08073cb06f6c60b81f728e39e3699d171a44a78661e64d9e84b7cc1fe58fc4920ee04b5921ec009eb
SSDEEP 49152:MSuZQIY0Be2KkRVtOnks6NMHq3fJ4klKXnb:u5dKqi613fJ4k
TLSH
T189C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f0f6b0dd92f6b427968bf842fbb98c5cd10328570804016f49b9c0d1329a6cf5
MD5 2a4b34a26715d541aca9dd7b1793fe8e
SHA1 3880991809318ff449b35aef46534d97dbbc9221
SHA512 2574d5aa5951b9741a06a97d44cee4ea7b796522a131b31da946fb3a68c70befd045413efc1958cde66af47a671538530830f8d0b868d74e65b8d2a490ba85b0
SSDEEP 49152:RhtSn8EApI0figjgiDn0AP5wQfJ4klKXnj:AX2iWphZfJ4k
TLSH
T15695BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ebd1b867699f78d7fd0118ff1da10270c9b431294668aa286b74c010480f2d3e
MD5 7576074b2cb6564f61fb226d7aa2c4f6
SHA1 545ddd7b70d3bd8a7fe36e279de30625f7803847
SHA512 fa5cfeff2074f954039787bbb1cfba0ce4ebb9734e20194e46e1ea5eb511da9ae8fdbcdd03a26b3f16cb06355bee2ed7f65a739f688b3c94329ef8ca303386c2
SSDEEP 12288:uDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:uDfJ4yL/tNCJPXUQrPg
TLSH
T154C423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1e45398c14738540f443edf75cbdcbf8cff285605c0ac76e91b0980a905dc3c8
MD5 f03d76955431958af14265381baea7fb
SHA1 8205bfde280f757640157373cb1c2d8a39fd38b5
SHA512 e2047734bf49cfed82f8e3723209e39336ca3b286c800bc049485b62763bb9af58a45db9646bf559ad1a521a503cd8376d0dc406e1ed7443690c5f135d68fa1f
SSDEEP 12288:I6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:I6fJ4yL/tNCJPXUQrPg
TLSH
T1F7C423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF42B4827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 800aa9c877fa0da771526729e0f60a3e28da98c30c8e6b441e94cdd7b7f38f10
MD5 8777d713576eb3b2874b738d24480247
SHA1 f7a2b200959e7c0de8c8dec3450a3382dec4993f
SHA512 4a6cedf9ec4223db1a42dbefd345cdac0ed9cccf5d551cd3df03b2906c12b79002c13c60bb9dd09ab812e9fcfb8343d01808f2e199127408ea6e2891418424d5
SSDEEP 12288:HMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:HMfJ4yL/tNCJPXUQrPn
TLSH
T1E1C423AB60D5948ADE5587F81748E000C7047EC6672F62F7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f86a2f2793874081ec86ab59a59ce1f2de2ed64dd8a834472b3cdc0f99cfaa42
MD5 a22d9b769f9f6b63722c251f2afc68a4
SHA1 a346c095d313d0e450586d261906b50f5fd8bb67
SHA512 e124ce282533799e0330bcb6cc6ec0ba31ffeb9a2bd522d3cf541e237c816207406c858c14a007719902da7cd36406b46f3887a09579c29567cd9a6172647c86
SSDEEP 12288:BVFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:hfJ4yL/tNCJPXUQrPA
TLSH
T12FD423A7219480C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a85509e226d56c80a061a71267098771f21d6ecdb78489eb6f2acfd9c2c516ec
MD5 a2a46bc0f2ec4560c052206850a399d7
SHA1 954b5c907cd89a3de73fc992071cbeed5e7dcd75
SHA512 685012539d9cba0cbdbb6941bb33ca755035f6d4ed4a105be9ef4d54f8997faca3c6c7aa082d987cdb0388a499ea088fc0a81ee48b1344ae478b2371e882b251
SSDEEP 12288:y9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:y9fJ4yL/tNCJPXUQrPY
TLSH
T17AC423EB60D5948ADE1587F81648E001C7047ECA672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c91decebb712bc171baac4507fbd57bad7e1a4142c19db75c129e8e88e3b4961
MD5 adb660034c1827085f76a886e9c30561
SHA1 7ee7482ef579549fb1175a7cb665d839c0f1ea24
SHA512 fd682f85a685e445ae46d840479d5a81f9630e83b6858f6cacb1c173fa4718279c5bcbc05b2a886ab72b2621b191d01b8759b7d3f2ebf48d96230f2d149abf4c
SSDEEP 12288:dmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:dmfJ4yL/tNCJPXUQrPa
TLSH
T1ECC423EB60D5948ADE1587F81A88E001C7047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 186b5fd7554b2ea61c20b084124b77f8925fa59be8b28dded405c0b7f45cc84c
MD5 20e781866ea458cbd43e0e67a4e3be99
SHA1 13721bf75f2e122c772e23adc0b3a51e87215cdb
SHA512 10ccb9fd78c6dc0ca4da0870fac399da4dc2a9aca6cdbae2c54cc12d04fb7e20418790f8e6104ecd5927947f972e6ca0ad8b94638bc9b23529f89b480fdecab2
SSDEEP 12288:fSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:fSfJ4yL/tNCJPXUQrPi
TLSH
T1FFC423AB60D5948ADE5587F81748F000C7047EC6662FA2F7EF42B4817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 99b7ed2397ce1ae2a661d2605794d1fabe9638fbc4fb71a35f3f81229945d53f
MD5 2fada493f7a7b1cd1545a821283eae42
SHA1 beed938b75f5cf90f84b4d5da6da2d76fc1cc78d
SHA512 590debd68ea5b6fc4c601286475646171ee6ad93c027ba93c4c7c484e20688f7f149dbf015e65f70962afc4bd23ce119f7f9e2a496220ab784800051df49dbcd
SSDEEP 12288:+iZwbDzzFEoS2cPvyafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:hZM3zFVSOafJ4yL/tNCJPXUQrP8
TLSH
T19D0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b7f31a8602f7b2d67999bda29627f94ce4bc24b9b9e04312d3fb00f8b1693176
MD5 0e4038b08dfd7b61da04e40bc55742b9
SHA1 acf802e792cd2038d34775c86008026c077dcb31
SHA512 db77cdd4ac008f920aac0d4aa0758aea1f00d479a87daf82160e73f42e544400825032bd448dba9803900f42bf9b087d61f041ffa190a99805d457aee01a6f74
SSDEEP 12288:/HfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:/HfJ4yL/tNCJPXUQrPP
TLSH
T141C423EB6095948ADE1587F81748E000C7087ECA672F62E7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1d4575d7fa8222b0672304536c41f891917ea948a25d7dc666e9e9e5a0604acd
MD5 44c39470b0d60768e9ec912a1eb5fb98
SHA1 18271ad82118538dbebc5de6781a5f300569583d
SHA512 bc04141f343c99c4b2a3571dd5e64de60f21297f5dd7001c3c7f539b8d5c11b71ee88fcce977d0f8cf1517f61e5d445dd61f88106b5a338c45f77e4df9246d04
SSDEEP 12288:qrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:qrfJ4yL/tNCJPXUQrPP
TLSH
T1A1C423AB60D5948ADE1587F81748E001C7087EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e3913e35666f26bbd3c3465b9278398b3f4382be393622797062cafe938343e2
MD5 8d1dcaf70d87e0789ea63ca910dc0a16
SHA1 94416de8b6532599fdae15d2555613f4d08a2f01
SHA512 b9715edf232deea53397a3003c947a5a80b3417a6b61e6f7f1cb05c456c04030b692be10fec9fcdd4638295059be6f823b88fd34b67ad80929c8201b69ccbb75
SSDEEP 12288:qyPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:3zyOfJ4yL/tNCJPXUQrPs
TLSH
T1C8F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 50cc50ea6fdaa402b7a4b242ec71fe89aa7d7401818e9249ad1d10cb7f17eba5
MD5 a07261c57ddbc1ca27b572ef1f6dff15
SHA1 0537933175c4668c86bde690fbe0205dfbb0f9ce
SHA512 2c2789f39d8db29e2924d1ab66ed9cd777d197e0d12d6731e1027f559fe3165910b8559241cc57ec160a317d5122285ab78d94452e58e9010dd2db1fde544f5f
SSDEEP 12288:JHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:JHfJ4yL/tNCJPXUQrPK
TLSH
T1F7C423EB60D5948ADE1587F81748E000C7087EC6672F62E7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 daa98abc0aa5989d67fce568beff0ea8158418330294b940a41615759a3983b8
MD5 b31b2ccab3c1b026c5e62cbf208562a4
SHA1 5cb67fd80a135124d1ed119aef0b70e20e4000f8
SHA512 3f15ab64f5db2be40658e76a11b4f901e6865439491b95b55dab89868ae8ed084a846222c01d0ea49b559a3074eaf8b4db0f7223f377f4f6168c961507f819f2
SSDEEP 12288:xHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:xHfJ4yL/tNCJPXUQrPA
TLSH
T18EC423EB60D5948ADE1587F81748E001C7087ECA672F62E7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 90cb67d7db5d5ad5f3ce3aa51db8734cc281e892a9c840e5bf3086c6c6bd1e3d
MD5 93771ef0d97d5236e16b72c4a35cf102
SHA1 a9139d8031a935a632a40e4c9decb098b6679d5b
SHA512 9deb2f7aa2ebad5c56d3a76819e2386419e859490679f775951bc875404855df5103562bc0268044bb232dc67c3364fcaad7a009de0ebffa9eda72f8395c0ac3
SSDEEP 12288:iyPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:/zyOfJ4yL/tNCJPXUQrPC
TLSH
T135F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1d638f6871921a87047d9c7ba134ee9b0461af7ac009e9f8ea1240e0c5850292
MD5 416486a38f254f8539035d66cfdf34ee
SHA1 1fdc49811faf0e7a09e51f378746358adc9c22b9
SHA512 9aa1440e25fe6b458102ae80eae1269fe17ede113a2e6215e023744d7a82d8edfe68f28ae6801a57427975b5ccb3ec39071eb03846b99732a578a8396ed8e9b3
SSDEEP 12288:yCd91WYoaLHF3z0z04PDvh8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTf:TT8aLl3z0zD8fJ4yL/tNCJPXUQrPz
TLSH
T1C10501A5B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5c842929e4c7a8fc098382a1cdde95f5b2872b8226f7f85c685451c1cc8fef27
MD5 218f41efb8641a5b08b733997172d95c
SHA1 c3a8176a392a04381f4c2db9f08be0039b33d694
SHA512 2d7d94ee002f05cd36ac1fe9ca2635ad6ea8584cd01de1a8a56002f999abe5b4eec970adc341808f8b6f82f6085e0e171701d4d7ea05cca610c02b8668b811c5
SSDEEP 12288:Ki4e7+RdTfgwCHKy7GLbbdIvpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GG+:K3rd9CHKy7GZYfJ4yL/tNCJPXUQrP5
TLSH
T1F525CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4255A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 63a27e9d681e7b99039fdcfbfd3827bd85923b754a46c48b6177a1f95528f96e
MD5 353de06f662d70784803b93d5e4da9d3
SHA1 14ce7fe811922433f6f1e5a88b0b8362317cb5d1
SHA512 00efea370008904733a9f83c1c72bde613d78f958c3d0bf9048410bac23c20c10dd439bcd4a7396584b980b47c47f6059a1a2bc3ff81eda94c46f62b51364563
SSDEEP 12288:QsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:QsfJ4yL/tNCJPXUQrP6
TLSH
T159C423AB60D5948ADE1587F81648E001C7087EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b1e838af4368c44ddc544f6a2e15d20db6132789f600546a65683a3aa94bb74c
MD5 5fcbe2f454fcabbd03852f8a6a6de033
SHA1 dc8836392a26ff4057c4b9f23089ffcf135b0ade
SHA512 7d6f1a174e87cc277340b1d061f34af58360ec04214671d0f926ebcf7c75351e4c53e194bca8dfd5a28d74089eb3f1446b8a6a5d93542a447349c765294a4cce
SSDEEP 12288:6ufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:6ufJ4yL/tNCJPXUQrPG
TLSH
T1F2C423EB60D5949ADE1587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ed205e4ba3eab8e881eeb1f0fa955c28c28a54c294f9794c128509c229dac398
MD5 e5e49eae10a6ccb2435316b034bbdeec
SHA1 b9b69d675d2f4cbb9db66300170930320bf6dc72
SHA512 112c2e2c35a035117df7d2d7242e59acb5d2a1b32078fbcc0a639968d02d9ab503d27e9f5cd9f9fed9659d7526ae6fc950701635121f77924a2a8fc86bb5e85a
SSDEEP 12288:IpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:IpfJ4yL/tNCJPXUQrPB
TLSH
T177C423EB60D5948ADE5587F81748E000C7047ECA672F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bcff714c31532a61d02bdde13d3370cde3e1bb08769da5177e3d35fc3f03e4b7
MD5 56b1c72706dbf4972ba3cce2a40f0a46
SHA1 ffa66c88bd6797da1cc1db1042d039e88e999c1c
SHA512 392c3b7cdff61fe326221c6538c38baba91b6e9b67bdaf0994761c8063c8361be2340d2e9eaaaf989e24804b18909e02d4e535a17ec08ffa149161d814c2b371
SSDEEP 12288:aHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:aHfJ4yL/tNCJPXUQrPB
TLSH
T1DFC423EB60D5948ADE5587F81748E000C7087ECA672F62E7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 bec972887c5153be86325338a824157825bdcd756d0daff96b4033d7141fab68
MD5 dd6930bb7ae029e71b68026d3f997822
SHA1 4b92d9c1923cb30c383e962d2e18cbeec16ae801
SHA512 b1cfe3233cb54d6553ff94304d7f9132b20d4d3f9e816490c8575f68642910e6546b499f76f327b71e698e5a06481544c678ab50f27d65a452b25b7c8a128b89
SSDEEP 12288:2sfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:2sfJ4yL/tNCJPXUQrPN
TLSH
T1F1C423EB6095948ADE1587F81A48F001C7047EC6672F62F7EF82B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 420cf9c9daff85404bda278a3d7c6d9f87745bdc237c9c9dbd6edfcb3653be83
MD5 e9b3a2371d699624763a16dd830be8fa
SHA1 c80182b2bfc27ffca1e93dec5392bc2a3ad7de88
SHA512 6e8c3b3f21949ab87ea87860490c764ddb76121bd1045e236e0569adb041fc47c829044edbf862318c761cabdc2a24f5d4eec9df44af2660f357bdabb75cc77a
SSDEEP 12288:O/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:O/fJ4yL/tNCJPXUQrP5
TLSH
T19CC423AB60D5948ADE1587F81B88E001C7087EC6662F62F7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7c617a9ca1cee0a447ea5452d6c8f9eede1eb79df982f81adbad7a457ad6f77a
MD5 7f1ff7b530008306b26b50cec2402f19
SHA1 1b16f68987c07fbb5faad677589d973ff862b39c
SHA512 93c8364a10c55b74e015e5e69dc23b2161ee3a44981922a26c66dac122d02bd70d38de896f6b98aaf640d1567ccbd8c0c9e0bf2dcee4ed7e14977cac8ad4613c
SSDEEP 12288:G9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:G9fJ4yL/tNCJPXUQrPN
TLSH
T167C423EB6095948ADE1587F81B48E001C7087EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 99c2c0bbc85e110f3be86b5493c8d21cba0d2e743a6c012b595e6d50339d966c
MD5 0edb8ca8738ef21e93b290dd661258fe
SHA1 979b70a26dd0827d3167f635268b568ebb3d99c4
SHA512 73c1741d5d71e79b58c04f7ad329354b48bbeb81f5f5c4e5bc4dc52f8e5503fa66bf94a7a0f4f3f603c1d4a072a2fe77cd59a2102e41393280e129f921d094f9
SSDEEP 24576:Qfwvzk9RX6wkyAI7fJ4yL/tNCJPXUQrP2:DMnYI7fJ4klKXne
TLSH
T10335D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 35a96d8721b4790d6af41d38a6023b54b2ea8efa2a1e4751c71c758355c35e9d
MD5 6a5f184395f0b5ab33d0ab3f79eafbd1
SHA1 3904b2a143470acb25f9d471eb3b2870ecac5f92
SHA512 db1b0a9d4657bbe7dcf651609d621daa487c3d91b288b26c59a0a88769d99caa2d7aa67b9bc32a3ae1764665682af3ea51ba2f1ab261f1290d9ab9283e914307
SSDEEP 49152:yYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wfJ4klKXnU:dySzPYfJ4k
TLSH
T137066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a2446714da7d07d2cbfdc1e8f1a7762072add65bcf5a0ebb10ee0688a62513f6
MD5 28304b5c116e30c07367ef607ede84f4
SHA1 4a1377d09df045844c7d4f5af7e9432c7c9d0adf
SHA512 3e3936036f8273b9d5254fc8efa6284032bc3ca060cd744df6714ae42e890e7dfd08e580ad51380a73f1fcf5e80739ed3066c1ac31620ed05ff87a133e11b04d
SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYqfJ4yL/tNCJPXUQrPl:l47JUQjqirIhCnDHUPfF/AfJ4klKXnt
TLSH
T13865AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e72a6e39733487522e131ec7e5ca519c44dd79c053ca0af81a9fce7223931847
MD5 19e2859c9f0f462b53847b12cccd6326
SHA1 0588fb671e74b358c893effe39c2630bd13edf45
SHA512 0d7dc6224721f142243229e8a76052a99061471bfb8d4fa195f749e0056d2874703a826d18a6eb297b0dc5a79b6d8cf752a1ba65bc589124e137827944022a61
SSDEEP 12288:bpsf3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:s3fJ4yL/tNCJPXUQrP1
TLSH
T19EE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4f55c7d3f47ff9bc06071e6847708a53e5c542b7c43bb6c358f48002fe4fa3ed
MD5 fd6227f269628db24dd8f33883d7d70f
SHA1 ac739f9139a9fa901bfdd17ede93f13fd66892d9
SHA512 f3587675f26fe18a3c59842f250a8ead40bf2b00fb56a64bb581c51c8201a9008c4fe63810230f12e000d95cba7dfb8031f57b093e4844ac546099f3f02d5f97
SSDEEP 6144:NcsBC2naq1dlYCOKXGotMxAzgUFYw1n+PNuDDoImZ6iRo+M84HDVHb6J74Df//MW:vcCvYu2IoIERo+476B4DX/M6rATFI
TLSH
T1A5353800B666DB4FC56940326E33D5CCAB707D01EE45AB0372C9973FC576A58BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 82a8c8710260c3d6c5d5162e6ba79b4f82f73f8cd7770253bce8b4168e2e3019
MD5 d4d5e3f86d33cad7d396dbd6239d8074
SHA1 562bd31306637cc89f56aa4ec5fd523bc8e1deea
SHA512 fd0b7635cca208a366af47ff8c6763797232050e2b815fb6c6dbb74cc825d19416ae5a786c298c2d604fa021b3b31d8f579015da11c173499f239e423a4faabc
SSDEEP 6144:PIm/8SzU91N1eaVzxqoHuaC8YdxlRvsJc16yoeLtMxAnSd1kqUNxUIQLtMxATMJH:PIm/8SzUaZo1HbY9W1rI
TLSH
T15955E7419537E68FD1B62032072A9F4D7B64EC07B7099F26B3C9453ED82AB55A0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 70347ce2ffe135a535e9f0512d098336326d132cb9c1f1c0a081e9d23a1bd7ee
MD5 abfda5c9fbc0ac079f8d10879cd6dd93
SHA1 e64f6d15b64ef81fa72d4720a151747270ff414a
SHA512 f50e73a40018e5b2d61b804600ee498c05a81a23e24aebee59020d58ff8fedd5b3f327e1d2fff52686453f3476a38bab0f19d23644ec8ce657f53acbf65dcac2
SSDEEP 12288:bM7vfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:AvfJ4yL/tNCJPXUQrPW
TLSH
T172D423A751C49846ED7587F8164CE000D309BED51B2BA2E7EE42B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6667e7872be0654570cee607f2a7a341be017b8dfe39e0afff6524c5420f5ee5
MD5 2649927c8e9815609c788bdb2998f4f4
SHA1 c74f9d03e270ac8c1dad8596ecd0f99dce362f64
SHA512 f96db04a76f537113c5a0178642074793de5ab9d3e75e3eea931edecae35adcedb5ba49812a7c963504fec92f1e0bde68de40e0dbc0b3aa06afffe9ae69fb96b
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYRfJ4yL/tNCJPXUQrPm:jgb4mBIBhGFqfJ4klKXnO
TLSH
T1AB65AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 83ec219ec8dbd602e4178eb75133b760a8a18899884bbd907d4dc51a3d61f531
MD5 95ec38d7c6555d16aa077beda0fcb0b4
SHA1 cc5e25f6af408ddb16c11ad33fd9c43d6cdd3d44
SHA512 0b736f420d8eff285dce8a9f561ecacd25ae6f49f0519503bba1ce01dd9876c44cf3132e0e2832cef9ea8b9b256d9b9d07f49fa8db87ccd89dbc771603ba6f85
SSDEEP 24576:QG88u8FpJqH1vzria7/mafJ4yL/tNCJPXUQrPl:D7ZFPqVya7/JfJ4klKXnt
TLSH
T13D35026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 869d4118ca13a9606b356f3fe4c7812e36f549bb38c9cd9f4bd215af1ab10949
MD5 2b25ac557be926e546cc4de192904db6
SHA1 7c6572c2fa449629b803c8c583cffc52c36ae64d
SHA512 33389352904be3983883a2c95ffc7537430844f8501fd44ef15566d43ad261a6abedb60e73cf819ebe11c5facbb86176d2c8ff0226481869aa99d399b7299318
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmfJ4klKXnN:UG05lO43bTfJ4k
TLSH
T1ABD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ef804fd1f7156584eef7fcda2436bf8fe80f7a51dabae915265547302433835
MD5 a23c36f4f2e98797d6607c04725b0e04
SHA1 0040fee7f85307bce5ee4c38bd492d91de76ae10
SHA512 9cfb6d167a4349dca257341554884f15485350b32fb072c2ab3b9bf68391dda5e6e9e994c3527e938e1691d8e15a16804f0e7512289c192e51714fbbedb9a271
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnwfJ4yL/tNCJPXUQrPe:ca5POZ3lJt2pasx2+mufJ4klKXnG
TLSH
T19A65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4e08ead6a7da25569ba3ae2e5a8fbb6ff2e4d76d36f66ed1d1308f9f0a96704c
MD5 08f7b28c54c135660f75a76a3ee917dd
SHA1 c1c9804226068df4d4fc1dfe844abb077bdceb18
SHA512 06e67ecc622931e73731b005bb1434fdd6e181f5bece87787bb41622e6af8a10737e23038ce7b3c67d0011d7882cce350400f0ef4ca01b187bb33a3bfcc4a805
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkCfJ4yL/tNCJPXUQrPb:GNc/zEOVHFpfJ4klKXnz
TLSH
T1F7858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 4ec39d5cf9e2b52260f1bc85f6d9d84d9aa5bcdaae047c70d6acaa8c89a246a3
MD5 e19ab5eea3798b7422be920b2ef603df
SHA1 657e8369548320a4297a3952ca0bbe6393002262
SHA512 3b26b5ee32c299cd07de166f493906fd78d8920bcf4bc3aabf7f84326ba9224322c58fa2a1309d21164357270fb44dc0b44e868884354399f436e96e2afe33c1
SSDEEP 24576:p6DII5b//32zbST44VkeLGqURYG7rYHxoPNZMn:p6DIm/GM4EkeiqEYG7rKau
TLSH
T17525115C732B11F9E06BE07E96434511D2B2B47187125ADF07A4C8BA4EA7EC9BA3CF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1df42a86d26279549cd72b8a000d9bb317a1a9360da925c346849476e3757c5a
MD5 39655dc34d2dc7f877e690591db6345b
SHA1 77a098e7f567169db95fcb1e3529199fb1735196
SHA512 7ed37c0dcc068f72291b259360b72453654b9f6f48adb06a47a1f4772ad0eb865a4255b02c6e00151f06a836693bf22d162db3ea1110f59a6215a406330c88c6
SSDEEP 12288:uHvUrBFrEjwaQ2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:uPUr+NQ2fJ4yL/tNCJPXUQrPX
TLSH
T14705F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 055541daa38d62c3ec7384aba8b5f90fd72e0260823e859b30fe4ee6a6a220b6
MD5 599b6419f28f02fb97b3a890e21f794e
SHA1 f4bf5059a198da0a771a61e71de477c9f058933a
SHA512 c5f420abf82a5bed1125109226826d76859256d20c9ed57383bd4948a9e1c7d6920b3dc30d2dd9a1cf35894ae027cd00e134a681bdf843b46315087e4439bce0
SSDEEP 12288:xQcMxWDXN1Dp/fshBItT1IQgAjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GE:ND3FHshBIYQgAjfJ4yL/tNCJPXUQrPM
TLSH
T11625E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-124-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-130-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/680-336-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/680-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/680-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/948-97-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/948-331-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/948-92-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/948-89-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1884-157-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1884-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1884-155-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1884-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1884-149-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2768-13-0x00000000037F0000-0x0000000003857000-memory.dmp

Download

memory/2768-1-0x0000000002C10000-0x0000000002C95000-memory.dmp

Download

memory/2768-20-0x00000000037F0000-0x0000000003857000-memory.dmp

Download

memory/2768-49-0x0000000000400000-0x0000000000DD2000-memory.dmp

Download

memory/2768-0-0x0000000000400000-0x0000000000DD2000-memory.dmp

Download

memory/2768-8-0x0000000002C10000-0x0000000002C95000-memory.dmp

Download

memory/2768-6-0x0000000002C10000-0x0000000002C95000-memory.dmp

Download

memory/3916-107-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3916-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3916-101-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3916-102-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4260-420-0x00000234BBCB0000-0x00000234BC330000-memory.dmp

Download

memory/4260-350-0x00000234BBCB0000-0x00000234BC330000-memory.dmp

Download

memory/4400-59-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4400-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4400-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4400-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4400-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-335-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4496-138-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4496-144-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4496-137-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4744-316-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4744-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4744-85-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4744-79-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5556-74-0x0000000002B90000-0x0000000002BF0000-memory.dmp

Download

memory/5556-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5556-64-0x0000000002B90000-0x0000000002BF0000-memory.dmp

Download

memory/5556-70-0x0000000002B90000-0x0000000002BF0000-memory.dmp

Download

memory/5556-63-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5600-37-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5600-43-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5600-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5600-135-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5600-44-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5628-119-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5628-112-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5628-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5628-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5628-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5628-353-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6032-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6032-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6032-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6032-339-0x0000000140000000-0x0000000140172000-memory.dmp

Download