9fa26404adb6c781997a688bf4836a75726c2e19930d05348b8e1d55b48458fa

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Size 8.3MB
Sample260930-deandsxt8k
SHA256 9fa26404adb6c781997a688bf4836a75726c2e19930d05348b8e1d55b48458fa
MD5 3a615a0ca37f40e823924311e2598985
SHA1 d057d4c2f4bc27a1c159049d57b81e17a75a0866
SHA512 658faeba4c3a9866489a7e030d3b604b0db372c1ef159f7ca75fac9cc8fa09349619a91100e98ff4ef41a6080f87dc6dc3db5b1a6b23f7a55db9da7ba175acb0
SSDEEP 196608:TIV0GxRtX8tIHvM2c+tQasnAVQC2L4k/QBqjQHV0fJ4:EV0GxRtXiIHAnAl2L4De
TLSH
T11196CF11B390802AF4F701B586BE866AD9747E301725D0CFA3C07E5E6F716D1AA39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
1256	elevation_service.exe
2868	maintenanceservice.exe
5936	OSE.EXE
2092	PerceptionSimulationService.exe
1968	perfhost.exe
3904	ReFsDedupSvc.exe
5508	SensorDataService.exe
5608	ssh-agent.exe
1084	AgentService.exe
928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
	\??\F:\	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\655b41a025f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000934e-351.dat	upx
behavioral2/files/0x00010000000093e6-354.dat	upx
behavioral2/files/0x0001000000009cff-358.dat	upx
behavioral2/files/0x0001000000009b93-359.dat	upx
behavioral2/files/0x0001000000009cd7-357.dat	upx
behavioral2/files/0x000100000000a1d5-364.dat	upx
behavioral2/files/0x000100000000627a-371.dat	upx
behavioral2/files/0x000100000000bd4f-370.dat	upx
behavioral2/files/0x0001000000006223-369.dat	upx
behavioral2/files/0x000100000000a31a-368.dat	upx
behavioral2/files/0x000100000000a305-367.dat	upx
behavioral2/files/0x000100000000a2c2-366.dat	upx
behavioral2/files/0x0001000000009397-365.dat	upx
behavioral2/files/0x000100000000a0cf-363.dat	upx
behavioral2/files/0x000100000000ba3f-362.dat	upx
behavioral2/files/0x0001000000006215-360.dat	upx
behavioral2/files/0x000100000001b97d-356.dat	upx
behavioral2/files/0x0001000000009953-355.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca5ea1228750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000905aa5228750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a96155238750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ba30c238750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6d6f9218750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000610839228750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008b503688750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8316f228750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2056	2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Token: SeBackupPrivilege	3904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3904	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3904	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3904	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1084	AgentService.exe
Token: 33	928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	928	SearchIndexer.exe
Token: SeDebugPrivilege	4148	elevation_service.exe
Token: SeDebugPrivilege	1256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 5152	928	SearchIndexer.exe	100
PID 928 wrote to memory of 5616	928	SearchIndexer.exe	101
PID 928 wrote to memory of 3148	928	SearchIndexer.exe	102
PID 928 wrote to memory of 3164	928	SearchIndexer.exe	103
PID 928 wrote to memory of 5652	928	SearchIndexer.exe	105
PID 928 wrote to memory of 1304	928	SearchIndexer.exe	106
PID 928 wrote to memory of 5368	928	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3a615a0ca37f40e823924311e2598985_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5508

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ce966b3248f287255a192d16b2326e943540ccb90ee861b63a740cfd2c5b1212
MD5 b1b365495ec451a6829e6b6862a7f156
SHA1 7843ce95805481faad2f63df29eeab1d17c64ded
SHA512 835dbb20695782a033a2387fabe5d41adcf0261b402a37b446248c4d36694016fd2f48f922fe0574d558c617164702f447efcbe1eff7b77549f6d584ad162b36
SSDEEP 49152:bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6fJ4klKXnm:p3q6mjB1fJ4k
TLSH
T129D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a631dcaf179903c0a366ffcbe69833beae726d68235e77bdd84c0865c76e4940
MD5 34a03c73bacaddd20f3563aea7bd67cb
SHA1 874496e3aaa4bf4d2902455234e3075920c925cd
SHA512 6f65e514caae75aa123305b0422734453eca7a6fdfa113dd12665663047dfb0ed8e40d53d934dcac23fde88b81fc6e734de5306c0152eb03270d737d958ee4dd
SSDEEP 24576:/XY7DvczAZfJ4yL/tNCJPXUQrPs1TBt3byAUHWreGf+jY+JqRp5fl9NJn:avc0fJ4klKXnU1ltLyvH88YzRp5/NJn
TLSH
T1EA75126963E004F9ED6B823C8DA1C101EA32BC854BB5E79B07E095656F733C92E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 fac1b79eda94f42d8b9b867ea40dff14d6dd724618e604e8648f2af5e408c73e
MD5 3e3e50062ebc55f16ed4868afd996790
SHA1 f701b4c32ebb51ba25aef9ba2d8cf564e7fcc6a5
SHA512 e34c317c7b33b134e7b6b26427a9390a490106fa640d38cc69d1a072af4bc66b354b56e25f3039bc25bcd364feca54d442c05e068c7c0d25df4cbbb38d2c9093
SSDEEP 12288:d1XLsswWkxy2lRq2czAZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:TXYfDtczAZfJ4yL/tNCJPXUQrPs
TLSH
T1F005F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0251ba8b853a98d34c7d6c477cb23c168fb080ac07c9b88b855470429aad1034
MD5 fa2c49d3bcf1ca99c7cfbfcbe74da3c8
SHA1 8fd26614f39d3fc9cf4a2abd98a78d7c5b717ead
SHA512 550f361954c84aa2a2312f6c0ae4003fe044ff90c95f393be9fe0fa78d92985d8c2f96fd0f65a035be600d4a42f9f35637a9fe3fa86884549203a359f9f5a8d9
SSDEEP 12288:UAwSfxL/2Dc3mDLLmt0LDQewsAj3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWf:pfewsAj3fJ4yL/tNCJPXUQrPV
TLSH
T1F015E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 21c27abd2197f58ad4e05db047366eedeeb6f81f4e261bb90d7ff3a89a4203fa
MD5 69495c3ee06c3816db095c5a1d3bd205
SHA1 0b543c4c3972939a89f462fa9870624046251d32
SHA512 09ff342b997695a6250ecdff0c5321367a08c1461b6bcc807bdea91f45a6fca6696755069d6d3b79570446bb17df57fb8a9d2159ff32394681be29cf386996f6
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPfJ4:aUEtQevvqc2W1cpV20I32P
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ec6673dabf1dfef4d46dc2cb2edcce24f3cd045177097f50a3149152d3703345
MD5 ebfec617bb8673aa30ed4262db1cf6b3
SHA1 d5e3227e16781d8e15db58d68225a775fb3a4266
SHA512 4d4a1ac0aeeeed2073429e346ad0da5934d8b4b1995a289f87180265904a3f4a4f0d2f1f7cc83b77f8d98435f75b2bd554b4298d8d434cd0d9e70680275b27db
SSDEEP 24576:MAhGL6IFoiwtA5l7S53ofJ4yL/tNCJPXUQrPA:MAM5Foiq54fJ4klKXno
TLSH
T1C5359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7feb046195cfbabac463d73c2607394ca9fcad3f2a9d6ad078adaa19601de2b8
MD5 b5e62769e00151ab150e0842434a0812
SHA1 bfb5ca0877423ecb35a8a4fc363cb246c2be07da
SHA512 182a68011aa226332905482fb7cd98b1550d7ee94e65885c04706725b764e38eeb25313bd7bfa4be070fc71a9ca1091fbd7fa153d8f26aa1741474c4dc2747f9
SSDEEP 12288:Gmw5HEjsChNEBFgl0WDm+CEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTa:fwuROWbfJ4yL/tNCJPXUQrP2
TLSH
T1D805F14A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d53142f3314a02e4cc508d0d078be38637b652b50c5705f5752a4c3511e18274
MD5 55584f67ed4b9454a173d64546c3193e
SHA1 779d83f64301d9df3bdc84ed2e51c0bf886f1a62
SHA512 0eb48490f314e2ca6a23d6cefda3c341c2a04b7ed3c4a99b07507b4a198132960f48f7c38157c62a9702a180dd8e7a52dc2c508d0d966c84d8cd5039822c4c5d
SSDEEP 12288:JyZ1IynfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:gZuqfJ4yL/tNCJPXUQrPP
TLSH
T125E4129B32D460F9DAA782BC8AD4D101D3317C92233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 96741826fd4125fcd8d8323a4dda8b74985ec09f5f3cc57052ff5d2a7f925aa2
MD5 8b8d8fce0f2dea10d2bfa5fa52184752
SHA1 b278b5ac8e45536a05cf944590843191c1b3f4fc
SHA512 822e449e02bca0662db173d5e38fb536cec0b14489c119b5600d3dce55c030e9200954254d6850f3049aeb9c01e871df8d98772603c7ee02a50f773cf1e0a0ad
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ud:9QRQyi36YOcPDLvw2gAf+PN3hfJ4k
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c04f889397b3d85b1e70249601a7010c1523a96c13ec88a3c732bc27f8161684
MD5 226cefb762b1d00a4d4b71354db1d01d
SHA1 800bd91935755565ab6171638b8e8f6601a7db33
SHA512 fca8cc08f1cc7cc7b49bcee84c687b5100655012361a4e27ee6560735a1d523fb0621d383fd15599ca1fb12941687e282d7e862706117c0cb866bbd4fa357d80
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UW:2QRQyi36YOcPDLvw2gAf+PN3hfJ4k
TLSH
T16C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fabf28ac9428f939d13f9b64af87dd6e4cb9d264211bec0105aa6ecb516f6128
MD5 3a7a88fa92d69dd639942310d930076d
SHA1 12172111cc372373ff474d2d538cc9a296cb8bd2
SHA512 40d7970c22729bb97c7bfc13b74a8d0e204667b69cde212db813a058fa725893750a496bc0225899cbdd369e072b9080a17921440d75c512ffccafc23bc31186
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL06fJ4yL/tNCJPXUB:U68Qg55nhkeWu7PNU3/HfJ4klKXnW
TLSH
T15AB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 07ac3c774c71df4b79e1875d6c87eefe0eea82e220ac04e00408e1d4196dc365
MD5 c523c0b853dcc682213d2c8269e5f92a
SHA1 53acda8c113e13940bdd58311fc892f8671d0951
SHA512 07d020fe9496a858e2d9ccc7939188a203cb84b921e8bb5910715baa185a0e2bbf69c8f5fa7704f9988b47b1f526a7edb6ab9a43ad2b4b982600266dc3a99519
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99L:Oy5112gYy5azzVvU69nLKnhZ+fJ4k
TLSH
T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d5200da39f5be351af13516bb56a64b8525af07a17ed3d72c3348e30e1e2a1c2
MD5 35db42d8709a0077770f08b0d53532db
SHA1 c43753cbe8f69a4400260beeb5b0e8e0ba113caf
SHA512 10aaf09cdc7e1f629da6328ab288404be7ad321e6c0d307b96f407f767941b3e060e9682e87a4696e2e82d1acd1f5be3dabc5ce38ad1b330037d498022ea3961
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpfJ4klKXnX:lu6JmIxd2dpfJ4k
TLSH
T119D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 410950968e57b341d68346405cdfb348e91633389892b7b42bbf4ce05ff607c0
MD5 d8dda434991a1b1acef0942b368b16eb
SHA1 1857245f0e975f95593f838f5fa309ec3fba1477
SHA512 834ade2a32a0e1cb0a6db33a2764ba72d01217849638abd5d2329ea7385f5d73eb9a712dbdf8951af6311e5e21770c96057221da39331165b02bd5c09532a2e1
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4xNfJ4klKXnS:/mifPqRIfJ4k
TLSH
T19CB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 33148468afad254c570c41313f4a360664d29a3cd7eca04bc0b6eb24149854ab
MD5 b32cb37ee71c83f9f09a229c9ee79201
SHA1 430a78f9f7bc642cd9ba4218d09f835be1674fcc
SHA512 a2bbb5d06589825bb6df4eb0d597a635815be736e80f4fd401c06cd54732b344984a47d69d7a28ce5dbccdb67aa0af80a9edae8c4811754be05408bad5b998df
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqqfJ4klKXnB:H5dKqi61qfJ4k
TLSH
T1ABC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 33413f7c203c9dd08a9beb5298d8ece40bb370812beafd2d9c146c5b9a03ea7a
MD5 8aa3888f030840af304dcf8a6195729c
SHA1 11dbf7360bc188c7bb6d61e65239d8e9a019d2b2
SHA512 782281b46804c87238cbcbbf14a07c6b80caca6c4224b99728c75d132b810f2968e89c122474ef1b2ad043db212932189359d4e6ce11121a4bc2c226902d7bf5
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wZfJ4klKXnG:oX2iWphsfJ4k
TLSH
T14C95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6fe9dae15d1218996f633b5dc60ba5b0c5e0932868feda1a128611736b581aa1
MD5 7d00a32a0b91f78da9baaa55bc2277f8
SHA1 0c7f992f535d1becf78e2f4e335eb628b102bd0c
SHA512 7949f91186c2020d7aacbf965e8a72ce9869ad5aa6684c2b86fe3d3d4d6f9b563e1a08c155517f49ea0b96c4d2ac3bf3a61160a74547bfca17a0fd1eed0da7cb
SSDEEP 12288:lmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:lmfJ4yL/tNCJPXUQrPK
TLSH
T146C423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 cf2d711045e1382f21d07c96dbe8f927c52d32a354b9da495aed9e79a58714b8
MD5 b4d1ec32e12f5be47a9e4a8005057329
SHA1 b86951c02396f30fae83b96fd4611cf506028bea
SHA512 fe9de8105bc49bc0ccb8fabbbd41253eec1e3728dda1ba24d672ced17657bb71c9f0740d6e0ecb9d820a22cf22120ec2d64738c1a7e3457d67e853123039fbf6
SSDEEP 12288:bzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:bzfJ4yL/tNCJPXUQrPz
TLSH
T1CEC423AB60D5948ADE1587F81748E001C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d0ccefa5cf6a37426d413e28e2ecf7fd68e38740ab99a52ba4e6f3c981b340ac
MD5 51eeef114abb7a76f904e0239cef7c9c
SHA1 fce7a9a17abb2e26811b52ab4ecd7805de2ee523
SHA512 df4a3cb05f203ba3838b68ff9b35181a135b5752fc6ed25c4d2c841254779db4eec00f9da2aa0a88c7ab85b38ed920025d8b007462bd64e4cab001761db05854
SSDEEP 12288:A1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:A1fJ4yL/tNCJPXUQrPn
TLSH
T1CCC423AB60D5948ADE1587F81748E001C7047EC6672F62F7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d2d988e759f36bce16b6307ccc2050e17b7ae5f7ba2cd1c644673bbb5086fd73
MD5 6ecde957e435486bc3bc1028d6173e3f
SHA1 3f3283c24ff115928999b4c8e1002c42c721241d
SHA512 93adeb83bfa476e3ac7c3a1dd668f0db11f96ac089e6f2a70611d356b4eeab8792517f6760a4f0f590c491fa6cabb32951de2009a11b8fb9d6c5e290dd21192c
SSDEEP 12288:NVIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:AfJ4yL/tNCJPXUQrPY
TLSH
T1F8D42397219580C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8764252039ce6eec41ccfef4f2430a04e87da1bf4910d00202173bcf7a1fe6ee
MD5 0f3a507e0ea80d089c10035b34ab113b
SHA1 435ee3800dd43debde885da1c9cca8a99f0eb734
SHA512 40cc7be49a6de2aa39e39701b57ca21cabc04e2b162a817f765eeb4b677bcb3c42d2f8ebbcb786a012679150d2b03d098a01e1878d07a56684d610cf1a021179
SSDEEP 12288:HAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:HAfJ4yL/tNCJPXUQrPO
TLSH
T16DC423AB60D5948ADE1587F81748E001C7047ECA672F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a833912c352613602a9ff9eb5102176ab077fdb77e7053355cf35db5b90e4c77
MD5 a4df5c3039146c143670e775608829a2
SHA1 5b72cb3dbd6db81ccd596acbd480926941efc1ef
SHA512 42ebe2875e854af13b7f53a38e31d4c39ac386b32ab2ebbe2d0ec7d978544e0e8e34b024a417347ce7daf9322c33b44119f444d14e209bada909cdf51bea430c
SSDEEP 12288:V/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:V/fJ4yL/tNCJPXUQrP8
TLSH
T102C423AB60D5948ADE1587F81B48E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4c40805600172a112fb1695d1df97521cdd3b499f8eae7286a142d9c8f27d3b3
MD5 6c89bbf5cd065a29b14564f3e8891884
SHA1 7e55ecee6283b7be6056dae6d28cf8510c142fa6
SHA512 6de200172fea6aff3e6d1cec5a719bc643febff6900dbf6001f54a6da27c9a10250545d9709ca99fc56a0279497f072ed3ad27436f10bb98a89dcc4f57136f3c
SSDEEP 12288:brfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:brfJ4yL/tNCJPXUQrPm
TLSH
T115C423AB60D59486DE5587F81748F000C7047EC6662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4335f5a1e949419fa451134babc2190e42c77bfef1b78d894e0470ba8490b21a
MD5 1c5ed8ed7d43a3b8155557ceac049d35
SHA1 fb56a73331df25dd53647672b7011f7c6a1bd684
SHA512 1f11ce3aec863296736490cd26d2de58a4f9284f831c544b29de5b9d5114915bd9560a6edc37fb81cf82209e6ad2cd2da8cf40bcb3816520aa32f159b9aa381e
SSDEEP 12288:riZwbDzzFEoS2cPvyTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:WZM3zFVSOTfJ4yL/tNCJPXUQrPw
TLSH
T1DA0501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9c2d4a6d9b8e96eb3bbdd11752fac2c0e02e8e5bd6d659dd8089be8111e2ca96
MD5 eb46f7049828eee465a645f2aadc596e
SHA1 55b3a17ed4d56a484b329573ec49c014ab5a2545
SHA512 fb834ba458ef5013247e5a83f12e727dafd0ec40971a95e965838bdab20f39e1961c0dbbb32488c9931ff7839d9cee0c624c42aba03fdbe3884f38114bbcd394
SSDEEP 12288:6afJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:6afJ4yL/tNCJPXUQrPQ
TLSH
T1D2C423EB60D5948ADE1587F81748E001C7047ECA662F62F7EE43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 937ae7aad1a3ec627f2625cb3853f77d99d1270c88859f6d4876a95b20ac8fc7
MD5 0cbe4d6d7ac8df91de0c6266e3b75493
SHA1 04e55cc9ec8bd2f5e3782795a6a5882c6da71d6a
SHA512 f3b069d6e65a21d5187c236d10a615af10e86687e99910f8e2c0aef40f6670276c275f3fbeacfb408c9b0c73c9f22d957236963d24bb7ddaaca31d6cc33f746b
SSDEEP 12288:eufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:eufJ4yL/tNCJPXUQrPJ
TLSH
T147C423EB60D5948ADE1587F81748E001C7047ECA662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b1ba9d5a060afaa18b63af3556084bda888cebb56a9cd955318be5357e5e36d0
MD5 ee98f3da3def7ed4dfd8cd5adea51f35
SHA1 8081700a6beecfa53d61739590ef287812d19bb8
SHA512 7df276691349641a7742509a130eccdc1d1b0d0b56fe9ce66fa903e0507cc9f59249a1da6477cc2bf37cf3c15f6fc48b0b3a60daced978deca46b7528f6f1c5f
SSDEEP 12288:2yPz5L8nfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:LzynfJ4yL/tNCJPXUQrPQ
TLSH
T13BF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6b3efc0154ec16eb68a47c1e227ff36ed74680d22b5976afbdb6d289d36f693a
MD5 22240b4ef00df64b47eb7fbc0d66eaeb
SHA1 d82aa66213f9042fc65963e1cefc06dcb06963ff
SHA512 732724c37fcb4885c8716d54e15169aa80a0fa384469b03b3ae789412b08bdd8aa4e63ac2b6561b86a5733f4ab99d2a0f6fedafe0db005b3372eea0989395311
SSDEEP 12288:/afJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:/afJ4yL/tNCJPXUQrP/
TLSH
T1F5C423EB60D5948ADE1587F81748E001C7047ECA662F62F7EE43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4221e221124dc425f36cffc532452050d3330c40952dffa23dfe880fb5547f75
MD5 8045f7e24c85a5fa148a050ba091b6a5
SHA1 e5f7ff9bdc356e51678c37fc78ce60ab14205d96
SHA512 5752a62156e222b74984eaf85b52d90688183c2351288126270d8247c487301d7cba2f5db3accbb6229426dab88258ef3106d023456d378945d5760b8bd1c89e
SSDEEP 12288:MafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:MafJ4yL/tNCJPXUQrPa
TLSH
T119C423EB60D5948ADE1587F81748E001C7047ECA662F62F7EE43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e4cb3b077051b63135fd1d10f384e4fe6bd8da9293ea369704f5df2b9add2b71
MD5 c7a12ed81a7cd54f38f1c74f6ddd5c2c
SHA1 6522be77f9ed4b3295171d30b1e7ee82586361fb
SHA512 e62c23d2f9d4b5d775c6758ce834c400ee8594b11ab66bc144ac1182c8e07dbecf7bd99d85760ee64dd18731b366a54a5d126cee08c25eea58836bdc29b6c1c9
SSDEEP 12288:DyPz5L8nfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:uzynfJ4yL/tNCJPXUQrPN
TLSH
T189F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 caf57a8a76d0456797e70e009ddf73dead52b13dddc836319b395e4c2bd58da1
MD5 f14a90c171fce7f86195a69887f5497c
SHA1 7898fb2738f4ff1839d39e3b810fbbdbe61517ea
SHA512 ca0b16687b0ec0b872dbf4573b1b8fa771a3ff9eb20f41e59385a5df277425a098793f588af762a0035d6bdb9b844767bd99ad403b4b03d2e6dfb13ced23319e
SSDEEP 12288:RCd91WYoaLHF3z0z04PDvhFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT:sT8aLl3z0zDFfJ4yL/tNCJPXUQrPM
TLSH
T1250501A5B39018F8EC67827EC9549502D3B27C9A0770C26F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0d372b8f1a7682b8f4f53147ab3817b9693d8dd7917d59de2b4c886e5b36b6e7
MD5 fc94fee421cd3983ab13f929275d7088
SHA1 d73d7dc22aa103f27607f5334203f0717c263842
SHA512 360c192161c7ed817ed5992429c84f1c1077356686c86a0557fc14d928e80d396cf4a608b2a0095858f6468aa899a5bea4a61b6ecc948d31b8098cdaa04a6cee
SSDEEP 12288:Qi4e7+RdTfgwCHKy7GLbbdIvcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGZ:Q3rd9CHKy7GZBfJ4yL/tNCJPXUQrPO
TLSH
T10325CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3a8aee31472d846b267cb0f8f8127ac06da29956f4c154ea1775bd59fb0a8d1a
MD5 4dc825a0d8085f6802972b8d814055a7
SHA1 1169d60e91e4e773e0f9bbfc9b3a7985fee957aa
SHA512 40f9fd0febcd282f479c882bc9997dae59e90c705ce0498cd937eb9ba70c59a99314e9c86893799381988f89bfbecbece94fb3447ba666a5599a8e05cc83fa38
SSDEEP 12288:PVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:PVfJ4yL/tNCJPXUQrPu
TLSH
T116C423AB60D5948ADE1587F81748F001C7047EC6662F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f6ba8040b7678fdb5520903dcbeb0d3a4a52ef158c6c523b35c11fcd1be9a491
MD5 2805bdd640b561b19f7e45487512e499
SHA1 6b064ee894ecf4ba6cf2e8c9c0f568618041105d
SHA512 6c9ec2b9cf845d27d6bbda2dcd7e1c6275133ae54809a7e3846e9ca182fec470acd482a506d6d2c26ed645eb72141eaf86fdb10ddf1fb529ea17ed94a6f3c96e
SSDEEP 12288:eHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:eHfJ4yL/tNCJPXUQrPM
TLSH
T126C423EB60D1949ADE1587F81688E001C7047EC6662F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f479199df3fb326471a48949516dd07f498c22030768afea40b0ac3bdc213aa6
MD5 149c0242cb8eb423e47103c78cd723ba
SHA1 286467caa3cc3f26d9a2bc9990071ce63de974a7
SHA512 888094cc5c9d2ca51606188ea7432098248afe47c50a7add5ed051dd75f2c7b7eacd3ada06ed439d3690eb914b6d07dbd8af3a73572cf44955a112485f1bd005
SSDEEP 12288:scfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:scfJ4yL/tNCJPXUQrPZ
TLSH
T10FC423EB60D5948ADE1587F81748E001C7047ECA662F62F7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c06bd0fc141a4cc6db20e0cdd4d71a0abacbe8b62c3925ebf46862154de2fa22
MD5 55042770a1a82baf8c8cf69692b58c33
SHA1 af152c7b2969ecefa04f9a00092e96bd7778d151
SHA512 56ac33dcc0fbf3b8e9e62aa43901ccf8376dd9781f19cad8b19f3dd0fa65fd3b4f857ecb1cdff5cd11407000d63fd76545a554ac6d80403b4eab136e0c6d3448
SSDEEP 12288:gafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:gafJ4yL/tNCJPXUQrP/
TLSH
T18AC423EB60D5948ADE1587F81748E001C7047ECA662F62F7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 2d3becd658d155de8c6277abce2011bef91e5ac918be891071239537b3cb2280
MD5 b3945a938342992867e3f72d4dd516df
SHA1 e95a37205ef677b0308d6a6eee26eef45b4dfa37
SHA512 ac58b0d453d512ae5fc0d9ee605f409a8feaa2443ae520db1f533092ef9a9d48ea7492dc9766e81b2ab5988cc1a5b9ed7f8c8eb3886caf4a3ce9dc028b22affe
SSDEEP 49152:9MnYIefJ4klKXnWaltLyvH88YzRp5/NJn:WMfJ4kwrGvwb5/rn
TLSH
T12585012AEBD804E5E177923C89B78206F6B1B8591B32C2CF059653AD1E37FD46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 057f434cf73531c02afa4ecab0ab7708d5e27747a96d9205aa44546529c4a914
MD5 80587e43a7e8bee231faa60812a6d043
SHA1 6beb2c6e4019bf5990c009246b0513098ffc9d87
SHA512 16ae64a762e1456c853657919b45559ba517b683da878a9a88f16781c5cd75bf4e12b509de7faa7945665de183a2af39ca37be500e8811780b9e6cfb942021fa
SSDEEP 49152:xYZzNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05fJ4klKXngBll:cySzPBfJ4kZrGvwb5/rn
TLSH
T129268D97A1A801D5C1B9C1B98B1BCC17FB7134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 6dcb1928d58ef1ff1f1e8736cd80b1e974b6d7aa9037bbec823842593cc8b779
MD5 b8a4a072abfab03f9da984846995d913
SHA1 39ecd1c2420162f19ae716c29d424bd396baa94c
SHA512 312cb11b400da9dcba0f44a70880a9cdbe5c6e49a059b5f280f416252a8848979aa05230eb0d36716a1c5152957e5d9e3da236e29cb085033185c0412fec853b
SSDEEP 49152:D77JUQjAirIhCnDHUPfF/pfJ4klKXnljltLyvH88YzRp5/NJn:jJiglD0PbfJ4kMrGvwb5/rn
TLSH
T152B5D01EA3EC01E5E1BA92788515861AEA71782E1F32C6CF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a913aef53c85fb869c546e9dba1a41b92c5eaf71d14ddb96a224b5b65827f345
MD5 d00c03a0a141b591b4a9029a70dddbaa
SHA1 8a48553f12528fb22800feb8cc17a98edd89d45b
SHA512 58e9d68f35617ba33d17811bbef8519d140c626c5af249822a57854cb9f760877f60af4c5706103ef1931900d89666cb83a8325187ff75d633fc6a62d2eedd6e
SSDEEP 12288:jpsfqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:EqfJ4yL/tNCJPXUQrPf
TLSH
T14BE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 980KB
SHA256 eaaef37e9cfc48091218e4506f2f282c0c7fca271f98f34be0f773edf32b02f7
MD5 4d0af89ccd1179295562cb51c13d369a
SHA1 5305719425cc5afb77a79f26050ecdb465769436
SHA512 92997decaac06e184bbeac23c7617a26068d7d6f9876575a52d06f9c51301c8d58af07e6fe0c2ee9718943fe0a8344fd132abc2a34ddc3147f55c0e9eddc264c
SSDEEP 12288:pJGKU3fox/WtraQqAbrDHmKyugDD5F139eUz:pJZUPoFWCAbrjsD5FpR
TLSH
T105251851766ACB4FC6A944321E36C2CCA7707D11FE44AF0373C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 478KB
SHA256 ae4d956f7c6f640cb4f4f193967901bcf19e6c7ae74f0b2ae7b68b64c6d17c1e
MD5 4e547d31394b759c589525de9d40e008
SHA1 cce46c4fb6924fb1caf32189cc9271797c17fdf9
SHA512 7e7615f44251ba43e7f6ab7a92fc07c8a942a0c90917fe17b5bf6dfc745fbc050bc253a522b8703ae7ed8f145d6b63572c69e7468445a2fd7041d7f3b87331a1
SSDEEP 1536:HGttASbcTbR3R3NxW8SbcTbR6HR+f/xU9DZiJtXWNfiYVpUM8ib+VsUd/iiCNG0s:ftVnWhp76skC80g0dw/JWiWXgy/v2x
TLSH
T123A4C501A236E74FC0BA50320A365B8DB778B817BB456F1277C9493ECC26766B5B53C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d49e1583cd3a293a8bb4446ff7b83e7cd447f6acd0dc7e0c188eea92d1ed62e1
MD5 4739d9e220f9b50373827d21bbcbb3cc
SHA1 1bf23c753be30e0b7f4bde2788a9aacbc0e32ccc
SHA512 8dbbed5a497641ed560280bb47dcf904a911a6d879248c7e6424fd474aa05f6f7402f0295f2fd3349e4ea27bad4c5856b99794f0db98c3803bfd1a06c4990001
SSDEEP 12288:aM7ifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:XifJ4yL/tNCJPXUQrP6
TLSH
T1E0D423A761D49446ED7687F8164CE000D309BED51B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 89f88c749289efc049dc9283cc84119110c1744c46582e1df2355c58e3096027
MD5 ff462d6e0283b864fcf6777d3e133808
SHA1 3a67b622a7f24b672a89cc65ae669f5373fee0c9
SHA512 2c0f75c97858d7b592d5bc2ebed8e7fcebe004801ef542e20810f923c31614253a753c8714b7a62d2d9a95f96d546f7573b17478e0a0de393ea1b72dc9c8a896
SSDEEP 49152:ygb4mBIBhGFDfJ4klKXnFXltLyvH88YzRp5/NJn:ytsfJ4kArGvwb5/rn
TLSH
T1E3A5D01E22EC01F5E0FAE3B88DAA4417D6B278161732D2DF1151426D2F3BEE85D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 ee79baba075e4c766d7a640b3942652eb45088415ba8a86d5b43907dc40a3714
MD5 86145917fb31186cadb4aa9c3eca3cbf
SHA1 f0763c9c87bba7364451cc19ceecd35397c3e3a5
SHA512 0f1fe6f3e1d3860c57ab66e57a89227117b95316d9c98ccbd0dadb9be5b8462465c868036fc0a119d292c91b57d291d86f0eda7d9ce8ff27ea1f1f3ea40b8ae1
SSDEEP 24576:jGVaTBt3byAUHWreGf+jY+JqRp5fl9NJn:jGValtLyvH88YzRp5/NJn
TLSH
T19D05229A21F520A9D47EAB3509756122BCB1B4516FB968FF08E09175EF607E2323CF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 22b1b0e6c7cf85a374c52df2590833765ccce295226b205ce33c1cbba5028605
MD5 426799a63c764a3274c0f56c3a4f25d9
SHA1 dc3f608d261efb987f90a7ca6297a4e7cf7a7143
SHA512 6329b77f052987cfdc09026371f8658479f2e97937036aee18d9667ffdfd91fcbff42cbb6a9007d58a3808ac9343e58d16bc19899971502a1f6b169ff8a32cb2
SSDEEP 24576:jG88u8FpJqH1vzria7/mTfJ4yL/tNCJPXUQrPr:S7ZFPqVya7/8fJ4klKXnj
TLSH
T1AE35026676E101F1D477D1388A868663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f7768fb3fd52ac538eac4a7e41b8eac72d507a89549e05944d6c07913d5a8155
MD5 0c79e8c07701ae277b18ea9a491b1eda
SHA1 9eb04a73d9bd1c14c3236454c7efbd86792445b4
SHA512 836d6a9431603ffddb89f7d7244cf2f2a9718b4e4943fc5ba8c3e050c73ac4f8a0d732120a1deff56bc32ae83a8005ec9b42eb82e2009c2e3e46cffd6a0f77d0
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/fJ4klKXnJ:7G05lO43bWfJ4k
TLSH
T152D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 38f0aa89d9ca21706f8fa8cb9dfc36347d971808b5571c753ffe8575adda343a
MD5 6a2db2896bb9da3be5dba1efabe7e8cd
SHA1 7b6300f36ca443ccb8b87ac307799f6f5052ec52
SHA512 1177e23e660d1128d725bbc636516b07c557d613e58673543a80a3a37ec5e0f6ff3306fbba7c069129c47bb01a0bcc9a372c72eae4c0b8bc0bdab7d2b2b0eb2f
SSDEEP 24576:ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5fJ4yL/tNCJPXUQrPn:Qa5POZ3lJt2pasx2+mHfJ4klKXnP
TLSH
T11965BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 434ecac7d1ed4a580618fb65eb280156e470c6519795b3ffd8a022f33d3164d3
MD5 70ae19b2dabc0640c05936c612355137
SHA1 28ae7029881c2ab6ce22f2be5b8064871a71810a
SHA512 e1b3148207455669da9586be72d16c8a052bf9fa7bbf7b707786a283e113bbfa06bf5bdc623f88d030a3e1061858189810d707f4029af62e15c941ce58dd6a1a
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fk7fJ4yL/tNCJPXUQrPG:RNc/zEOVHFcfJ4klKXnO
TLSH
T170858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 718aafaf9c87a0fa6d716846b1f8d50c707528de5be0eb771e202cf51399ad92
MD5 03992a9474ba5a5dd045b0e8f6e01d99
SHA1 0b883b72f7f6c887f24e4d076532a937bf3a2ff2
SHA512 57b35d1f364bc5568c02bb7788fa9418866539202b8a521ce343c8feb811f03afe15aa7706aa076081ee7dbc22424d0fd1744ba5e5016f1e955300afd82c08f9
SSDEEP 24576:J6DIwBTBt3byAUHWreGf+jY+JqRp5fl9NJn:J6DIwBltLyvH88YzRp5/NJn
TLSH
T14925015D23BA10F6E07BE13D86920102E5B2F0619B6659DF09E4C1B99EA3FC9793CF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 fdc40610f24336ab9b24af8089c67ac0da66f5030f4b067f25d0d371d834db38
MD5 692879e8574010311ece2e9ac1aa88a5
SHA1 c82e61e59d96b1b31ab74921a67c8d7c32450619
SHA512 ab98ad47a1d4550f9a3dd341e91947af22d1f8d59e1154b5123e3e0371cbc3020ebfc59424b430a6bc237c33a29aafebce9db1a1ff7fbf1ff44146ab30e0c580
SSDEEP 24576:ptyZTBt3byAUHWreGf+jY+JqRp5fl9NJn:ptWltLyvH88YzRp5/NJn
TLSH
T1F415224153E410A5FABE27384A7242619D71FC106F7696EF18E0E22EAF327D27934B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 fbe7e361d8ef76fe90b3eab4e787d97262b9a6b7f534eb47fe1703cf06384283
MD5 d96635384fd79fff8d6885c019f847c0
SHA1 e1aff4151c2781ae9e40880efe79d6d463a88ac6
SHA512 81976321f5c330e0ee91d42e6edc9a687fd179e51b728bf42b9b9b8dbb121ff775d75b43727b0ed5eb16808791c79cb2bb19ea8671d30671fdbc9d41b2448f66
SSDEEP 12288:HY1rgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9N1:4FTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T18405238642F41066E97D7B350676221268B1F45A6FBB58EF2CE09265EE713C33239F1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 afd2659109fb5b524f7cca63ad937d38e1897d1017b69442078713e66225bc27
MD5 0f37f8fcd366efb8d77a786468a850a3
SHA1 2ab6cbd1189f07b4e3c2a8b88446fe169010f1a7
SHA512 be3db2e30480273400b3ac64d657930be70582df0fad237e29a551e4148d47933ffac302a83c3715c23c5ba0f8a95d7ee809ff40d7ba53e2ebf297900d5c639f
SSDEEP 24576:CNgdLoTfaidZHTBt3byAUHWreGf+jY+JqRp5fl9NJn:+gyTrZHltLyvH88YzRp5/NJn
TLSH
T18365AD1D63EA05CAE2B2D635D9721493D633B4315772C6DF2448C03A8DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 f5788072dc8fa03cd5e014e05fd5c1b24ac05313c691716045c9e2aa0449f4a4
MD5 6ae5bc34bbb0fe3d4d8fdb1ff8641790
SHA1 51d3d7ab17a2b235d1c3e7efdbabde1a64939a4f
SHA512 8a8627b5b87eabd6857da1f8aaefe3da37f02b9eed548e057f9fb8067073f54d0bc5d15e88cb82870855e4d2cd9526ff9c01440c2a8205c4574afdfec3b782f3
SSDEEP 49152:egb4mBIBhGFDfJ4klKXnFXltLyvH88YzRp5/NJn:etsfJ4kArGvwb5/rn
TLSH
T145A5D01E22EC01F5E0FAE3B88DAA4417D6B278161732D2DF1151426D2F3BEE85D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 03c9e83caeab598ac3482a610fbd9dfc73877741d68dd1fab38aed0815c29be7
MD5 b55e45738dbb7adec53b8bf8ce38b03e
SHA1 216fee912f5dcca5942d5220645f044028387701
SHA512 03730a606f428ae414b53c001b004e0234b8d768fed0adcc1502a0d420653d1d138fe59d9ef6f91ba783a381bbe0fd70d078858b0020dc6b2fd04459623d40a2
SSDEEP 49152:7gMwBtOmdfJ4klKXn9nltLyvH88YzRp5/NJn:8FFfJ4kgrGvwb5/rn
TLSH
T169A5E16EB6F805E4D1FEC6B48E238112EA727851073293CB5290C13F5E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 026200359cd84c5f3814d7773b8bd89876ca042009309e7600cda89b968976a4
MD5 5256aeca5aaa255153a67b334537a79d
SHA1 2cc6706c2af1de54dc013ca45a93bb3dda31e245
SHA512 56c262eb69440d422745824ae6a55f722cfc55dacf3c0473b474a004a1275caab66abd83f501f7207d2a94e1e0fd57c355272525131c064f6805db7d469646ae
SSDEEP 12288:aHvUrBFrEjwaQvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:aPUr+NQvfJ4yL/tNCJPXUQrP6
TLSH
T1DA05F16F22E818E5E676E17C8A858209E771B8921312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 2deda1b118e4068f688f887afea6d4afbd5478c30e6e74e9421f7ba201f6c2ee
MD5 8fd498a73adadda5b3b5d2bfb5d1e565
SHA1 8a051c377ef2b2a01307906b9d1f57377a975494
SHA512 400d27de33796a7442c3ff765b54aff727fa131f39d6838edad1c1a2342f3dad8dff4648641b822ce26732bcbf248ad9edfe620a77ff271978f8228efce9134d
SSDEEP 49152:XDVHeBIAAGfJ4klKXn5ultLyvH88YzRp5/NJn:QfJ4kRrGvwb5/rn
TLSH
T1D485127EE6A800E4E47BD2BC8A538502E77178A9073665DB05D081B66F6BFE43D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 f6fb05c7fb189d63e03f7b957e131a1b69b54649e996d41044bb73a5a2ef0fa1
MD5 0afce11cb432f1bab4a902cf049927b6
SHA1 bfbec7ba17bc6e708063466876c2368c2f808f1b
SHA512 ae81dd7995a38f9feabf2c731080273ccb95147c368369bf9672dc476ba873125cade4263e1f8091d5753a4ad83563a76edc5b47c25cee50c5e44a1a48c30910
SSDEEP 24576:RJnJPbzB4SJTBt3byAUHWreGf+jY+JqRp5fl9NJn:RJnJv6SJltLyvH88YzRp5/NJn
TLSH
T1F535F13DD2A810E8E4B7C274415A175AFE71386D2F2669CB18B4D5347F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 c4231034c36cd89bd649aa901b3b1c3518f9afb24ad9bfb5f1e087efb8baaa57
MD5 2f31a50677544c532a0958707d9ca477
SHA1 37a0ac69988275e2adb0926ad19262c7251a2351
SHA512 4339100375e84dea82b9849837078d7aa3986f9bb0dd49c2b4bb5cef5e6e365ab85e41cd82632c0edcea69818ff988101547c2db022d36273e5ba689a459caa0
SSDEEP 12288:yrrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9NHV:yDTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1A10523C241F400A6F5BE7B350A7662126CB1E84A6FFB59EB1CA05245EDB13D33279B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 25249e380ca8441802c2c86a2cd53251eaad2d94d31c147a186a2357c2f7b556
MD5 c5923cf895e69db6d00f30480634ec20
SHA1 0646a901cdc662623694a33c302a774866153114
SHA512 5f5bf84093676046265be62a8fac8057df530d9b9897a3218e360e1af78d5ad0a15486a356c3ffe90b944e73bf9d1641a0eb85851e61717e020bf9d010b37448
SSDEEP 24576:q6UqjpYTBt3byAUHWreGf+jY+JqRp5fl9NJn:q6U5ltLyvH88YzRp5/NJn
TLSH
T15015228A52E410E9F47D57309975822284B1FC661BB659EF34D4827ACF31BC2623EF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 03d0dfd5c5c9f428dbc1dbd3a967929b794c773462c67c3e35cfb67a7b37b468
MD5 c60cbe4fc865d07842e1c11cf1e8b14d
SHA1 afe49aa289be90e2b2b481bee97e6f23701b0a3f
SHA512 78fd5d48e2bd96c45821a5c53b340dceaac9d0c0fb0339b47dad9f79df0b207dca385eef6fc0f651abfd0915916c8518473308eb554392464808292c9cffe24c
SSDEEP 49152:aCLHGeeV5ijCmlDWDk1ltLyvH88YzRp5/NJn:B7rGvwb5/rn
TLSH
T16DA57C05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 2abf2f042fae6a339b41a913b436c023b84e81d461465f40544ea0a84035cb75
MD5 8cdd7e75ec5c95b72458d788bd66c720
SHA1 056b313e32e2a9863a794aa3171231c8be96f466
SHA512 85203898db06b3b109e4f9389b7388c2db6cd31cf6502424b98c09b1189dba93bf9213145a80598b96640b05feb7d6c9f5334b19e7cc600625dbfbeabcb98688
SSDEEP 24576:+rcmRUTBt3byAUHWreGf+jY+JqRp5fl9NJn:IcmRUltLyvH88YzRp5/NJn
TLSH
T13625024EB2BE00E6E1BB923C89514112F6B3B0316B6257DF05A1C37D9E636DA7D38B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 48e8f210efe7604de342b8703e295d82c0dc268f5adedf62fc5aa436e9de1a0a
MD5 e65277191becea6064a8efebc78fdc54
SHA1 8fa725c4de1aa093e90f6d5d8bc55e7d86032742
SHA512 a1f8f1621d210b459d21b7bf7b080e456960de2ce3238177edc07c547082815acf0fb84fcc1e1c44cdc6fec773d2b8f303f8a807223a48c7f9911ddf3de5e63c
SSDEEP 49152:qDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/ltLyvH88YzRp5/NJn:L3Upow8sBurGvwb5/rn
TLSH
T179B59D3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/928-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/928-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/928-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1084-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1084-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1084-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1084-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1084-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1256-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1256-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1968-92-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/1968-318-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1968-87-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/1968-86-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2056-70-0x0000000000400000-0x0000000000C6C000-memory.dmp

Download

memory/2056-10-0x00000000033F0000-0x0000000003457000-memory.dmp

Download

memory/2056-8-0x0000000002D60000-0x0000000002DE5000-memory.dmp

Download

memory/2056-17-0x00000000033F0000-0x0000000003457000-memory.dmp

Download

memory/2056-374-0x0000000000400000-0x0000000000C6C000-memory.dmp

Download

memory/2056-2-0x0000000002D60000-0x0000000002DE5000-memory.dmp

Download

memory/2056-0-0x0000000000400000-0x0000000000C6C000-memory.dmp

Download

memory/2056-1-0x0000000002A60000-0x0000000002C10000-memory.dmp

Download

memory/2092-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2092-74-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2092-76-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2092-82-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2868-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2868-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2868-54-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/2868-48-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/2868-58-0x0000000001EF0000-0x0000000001F50000-memory.dmp

Download

memory/3164-424-0x000001FB657D0000-0x000001FB6599A000-memory.dmp

Download

memory/3904-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3904-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3904-423-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3904-422-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3904-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3904-103-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4148-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-23-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4148-29-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4148-30-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4148-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5508-339-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5508-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5508-115-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5508-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5608-124-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5608-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5608-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5608-337-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5936-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5936-272-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5936-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5936-68-0x0000000000860000-0x00000000008C0000-memory.dmp

Download