c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Size 4.6MB
Sample261002-t3fsbaec66
SHA256 c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530
MD5 39afd6febb7eeb70b5728fd5d86506b4
SHA1 618b8b214bc64f8d5d92954867c767c95e1697a6
SHA512 b6a662de1debcaf682bdee7bb08c83a95a9d7857abcae209aceca5ce0df679da9498111f80325e7dd04d5f3c893bace255947281d9b34bf23a2f3d0e3b274404
SSDEEP 98304:EC0Uq/np6a7nwvXlUvUF4hGFoLAPdc5MUAE:lq/nAo443GSLW6MUA
TLSH
T18636D012FBC281B1E5930174556ABB3F8D3DBA34672489C7ABC01D2D8C316D16A3A79F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5448	elevation_service.exe
4388	elevation_service.exe
1040	maintenanceservice.exe
4960	OSE.EXE
6100	PerceptionSimulationService.exe
120	perfhost.exe
2432	ReFsDedupSvc.exe
692	SensorDataService.exe
2636	ssh-agent.exe
4744	AgentService.exe
3764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7934b45a25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015e6830b8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c19600c8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006cfbd0c8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000446d7e0e8c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c6ff10d8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5448	elevation_service.exe
5448	elevation_service.exe
5448	elevation_service.exe
5448	elevation_service.exe
5448	elevation_service.exe
5448	elevation_service.exe
5448	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4128	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeTakeOwnershipPrivilege	5448	elevation_service.exe
Token: SeBackupPrivilege	2432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2432	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4744	AgentService.exe
Token: 33	3764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3764	SearchIndexer.exe
Token: SeDebugPrivilege	5448	elevation_service.exe
Token: SeDebugPrivilege	4388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 5856	3764	SearchIndexer.exe	100
PID 3764 wrote to memory of 1176	3764	SearchIndexer.exe	101
PID 3764 wrote to memory of 5404	3764	SearchIndexer.exe	102
PID 3764 wrote to memory of 3988	3764	SearchIndexer.exe	103
PID 3764 wrote to memory of 4568	3764	SearchIndexer.exe	105
PID 3764 wrote to memory of 4220	3764	SearchIndexer.exe	106
PID 3764 wrote to memory of 6084	3764	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1608 1612 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1668 1664 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1608 1612 884 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1668 1664 884 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3fbee0581f6b3064eb7fcf7685c51405dadcb5c65fb26bf9a606e7a2410ad5d1
MD5 b50b2f3d87d26eaa48872da222be3618
SHA1 1e01c2b17d3a324cc16edc518e723636de9e6fca
SHA512 950f1e34691bdff194bd17fbaf969cf77053a569a0b5a76ffb9e2a89e09c1b0f2d2b86c2550c3a2614d8ea233e5d28f37fc6229c26d645f27ed1dc9c6568eeac
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxngAt6+dc0gQfM956TQ:d3q6HjBLAPdc5MUAE
TLSH
T10FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 aaff306980d1c1a9b1984be4438e76c47f0fcd0d591501447d9121a01859479b
MD5 6687e6d8eb2fc8bb22999264823bd669
SHA1 5868852a18174b487b047023fad80cd3e14d6f47
SHA512 f4fbd1f5140daf48328a7bd6656bf3f5624895a4f4217c1b9b3039c7ecdd2d6119852b92affc1a3679c883ca5deb2d4cf097ce14f4b61349706342e1ea526e48
SSDEEP 24576:oXYfDtczAfAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:/tcGAt6+dc0gQfM956TQ
TLSH
T16E55F12473D508F9ED6B813CC9B2C501E673B8554760EB8B03A49A7A4F237D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 15da5767adc921f3a2e788e3c33f829bcefc6fe206fea676c1482fcc346ab777
MD5 825a1e4b54f1385d010e506f1269657b
SHA1 1b0420203eeed97dcbbdfffbf64721017e5db678
SHA512 e070c9ee94183531c04aecd7c7c6fedd7fffd3eb7209248088e85f2aeceb6f4d6d4f893effee61ca055aaca9186743a2b5b9760379b96da1be946212c4f41906
SSDEEP 24576:Z0Le5ji0hmxKrMYAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ZPji0A0RAt6+dc0gQfM956TQ
TLSH
T13175AE16F6748735D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b9c38e1e31f996593077869ac0098ba24a5923d4b553d4300f64afe50be4b674
MD5 c290b0420e00d0cd9ad3a244b46bba17
SHA1 4c21c6a7ec9690fb11c66f0efce0a6bb88cf7dc5
SHA512 6aaed239ec49fdf39a06cc1602cb33f2792a666b625687b00cfb609c5e27ea27140b213345a20d6d705d4a7bf259f5d9249967fae08a0bcc2b895509f6ce7cc0
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyu2Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:L/ezSC6vUzPvxHjy1At6+dc0gQfM956E
TLSH
T17F756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f59c2485e5536034d3e95c283326e7c4e1cdbb88c2f9258f5f056c4fb6f678a2
MD5 34ee0778d4f1fdfa2bdf790d11fa2fdf
SHA1 472306367e4174a2fbf716729f6d0d0f0f81de77
SHA512 8f05961234174d41d5d710fe547f08d5900ef98efc298c0e9e07eb6ee149b3225c25ff1d7b79a00aaa9eb29fa50035d7bf79f5937d9b510bdb16298c4987c6df
SSDEEP 24576:+VbqPb88hv/l+67Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:+VO88hXl+8At6+dc0gQfM956TQ
TLSH
T19C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2F67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 82c388c5e58127f6d36721413816bf30d002b05d849933047fb2b3240e842b37
MD5 8b2f1aa4b76ca2a328c3bbb37ff91400
SHA1 003a6935078d23ec31b8adc521265b56a27d8343
SHA512 f8422791f668045adaf5d73b1f15e89f359c4579a318b4f4e96d078ae3c71ef588db12426dbc6e5895e5c4400153420dff4d4dc8d938e576b51744f5c76a00a1
SSDEEP 24576:gJEAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZn:nAt6+dc0gQfM956TQ
TLSH
T162352392538B9CDAEB5B0839D67DC65080B69C0C5C214D16D061FEBECB37AD58EE270B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 ffef4af8ffb3540e36178e2d4da17f1b78d8ff10f57fbf6b700f9ac361ddf4b7
MD5 a6a7fafd12d301dffe014d4c77249847
SHA1 6faeb019e8b4ec71f97ace053db047836a7b50d2
SHA512 a84d157ec55c152bc526402a9b12cd77c8c721bf82d88bbdd27b47d6e6129da2578db860bac5587060ff5ab727ff8a22b3769131e4e6ba9d83bb1f1c738347b5
SSDEEP 24576:1JIUTAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:1JIUTAt6+dc0gQfM956TQ
TLSH
T19E55CF7BAE28FCE2C67A4D785AA1C600D77278304F6293CBD165C20EDE235E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fe0cba1821677aee3d85218f62f0559065a4934d8adbd5a480f4811d97de7fc1
MD5 36823dfd9ef97c81ba64d0d1ac9882d2
SHA1 6b642595f2bcd5d184b658516fc5c3fa501eac4f
SHA512 d12417e7a074b887ea377309f8e2b8d1d423939f2e41e58f4409f0305692525ce9b14f0976cae54ae287b50b215cd43a873e7788b8e46c7ee59f0a43b37820c6
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:zQvGAdlCEL8c/yRNw5CmAPdc5MUAE
TLSH
T1EB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 f8a9888ac11ed39b56dbadc7cd63193d77c504e6f439489a106b02d0b3897b33
MD5 6b37fed40ce08a2d6bc618c34b4be966
SHA1 f81b8b2fa7ab1856ff6299dfdd270293efcb8f3b
SHA512 200065a7509d14c4d70f645f3f7b44cd184a164458df4573ab8d38bb338d9cd5b76ce91eb1bf697af683b4b3d0448afc568c6d6d9424cdb522af7a38e2ed4604
SSDEEP 24576:JVewsAjBAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZm:/ljBAt6+dc0gQfM956TQ
TLSH
T1EA65E031FA75E436C77B0DB61B35C716147DB9204F611AC3E3A88E9E8A302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2872059af2842396ff7310368a1a49faf10fce80bc6cf8c44d461587febb725d
MD5 82fe97d9bc04361c898ce10e371b1f0d
SHA1 c034d15a9f209689c8134752d48d53153e291714
SHA512 805b6ac93c2f2f794e6fbda76d0fbd2f8eabe46973e72ab8a2720f6d5d21eba2a1446b7b67eaf6ed0617b2898bb4df5a5e6693f8e3fa83f81e2095f2d4e77caa
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpW6MUA:xUEtQevvqc2W1cpV2EI32RM
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f216ff2a4a346daf75a95b0174c500ed4920caa0f29cd9919805faace2c35578
MD5 2288adba91c039f541df12de6021fcd6
SHA1 2221a874911df651f15e409118539d73ca8649a6
SHA512 52182b0a951b8ed3c1a63871c519e3af7517e9106944fd0e0c85616a0fbf78109bcab554bce0d528ce79df4ae9ab715576b054482cbd4ffea1e4fed7b3b09973
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zhAt6+dc0gQfM956TQ:RoqtVjnmKAPdc5MUAE
TLSH
T106D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eb056569634e41ad50d2e0c438a4a40725914416fca7871d3a3a48dec974584b
MD5 64f92a699a18166af527f681cd507f3c
SHA1 cf3812fa84cf2de135a1c6887f80d19ca42ac7e4
SHA512 397da1e6220c25eb7b69ef978cfe84ca0e94da856dcefe9b88c93dfade9c3b0924d9baa7d12f5a8beecc58c441f3b993f69abbf0d54b99faf4d5930947f75620
SSDEEP 24576:XAhGLJIFoiwtA5l7S53qAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:XAMyFoiq56At6+dc0gQfM956TQ
TLSH
T1B735AE81E7F955D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 7b6f49382052005eab56cf3f4b22169dd89b7f3dd12f0255669290e6f09b6464
MD5 dc210d3c4e08ceb2eea9698ec8bcca4e
SHA1 4b2bb78b97a363b3dadd8ff8a72fbd4c7bd4c15a
SHA512 ee11eadb63217f007d0999620be5ef3a9cd3ef46d65a7c570dbe97fa0a383389b6228f650be8efbb22ada56225f192461c760c84a5dd910b65d7106bd099db22
SSDEEP 24576:ywugOWVAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ywLOuAt6+dc0gQfM956TQ
TLSH
T17D55F14673D90CF9E9674539C567C132E7F2B8052A21CB1F5760C66B9F33361AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.1MB
SHA256 8977df98509047bbbfdc4ad76307c99b605f3d3eca8fbf76a61fd5aa3715f4fa
MD5 a5abe2bfbd34ff73bcc2e8237758bfdc
SHA1 4bbd25142800976c3ad989be3a0e717a2e988c07
SHA512 92af87b793bf79975f582e461323861f9109c3e42b2ed829705dfa8aeb4fb604e949db36e4deadd9255b58df2ea8776f4a600386bc62b086932cb76ddfa910f1
SSDEEP 24576:+ZuQAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:8At6+dc0gQfM956TQ
TLSH
T12245129633C964FAE6A7453CC9F9C601D3B278162B3243CF516486AE9F33AC54E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0e04d0594bb471499da02fec86a7230489facdac025f976b1b738369409a0b0b
MD5 4805bbc83eae9707e941e0a857b88cbf
SHA1 93246eef84beec0db3de033e1d5bd7093227e95a
SHA512 64091060de43106eff35ba9ea709667041e2efb20d8df88bd78c299edea5e63089fcb0c5a87a036dad634993decb3a42c9eea6c238c8be3da99f70daef9e67d6
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN33APdc5MUAE:dQyiKayX+PNHW6MUA
TLSH
T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fec33110412f6bf43f45f609dbb920a4491ad46e1d0289885a28b93b02ca2b35
MD5 aa998befefa90b9bfc5644be62035023
SHA1 e9b442153d26f79afc067631ccfac3f46a085c89
SHA512 f1c1de33a2e6bed483b54fabdc2cc7bf1138b876e2b35a7bf35cec402b4d9977e3509676f5c4fb004a1f0502c5bb8688be4ae2b9e2b5f192d36fe68ef0af578b
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN33APdc5MUAE:UQyiKayX+PNHW6MUA
TLSH
T16F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9439e86cc92e9996b019ca466b9e39a986d120e0da2ab67150f5effc84566ea3
MD5 c282e4e057ac33e7e09ac576aa89020e
SHA1 c67a9d787b9ce8ce3479f5b92098d7f653a6a3fb
SHA512 e9cd53a58994f7950211b109ace897fa524f1c4e9a559e87969ad3594b14071d65f9ac0a70154da9abcadeb049fed9b8aee67abbbcdaa2dbd27937485aee4390
SSDEEP 49152:Q68Qg55nhheWu7PNU3/RAt6+dc0gQfM956TQ:KthWRc/RAPdc5MUAE
TLSH
T169B55A33B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 24de731ac8c38a15e086a42a66b32de837df777da078b1e9b418802f77c51d33
MD5 0b55e4b404c6ce4f1c99b73ecf812f71
SHA1 805add096d82b5f558378fd21818abc9bd6f2a9e
SHA512 1b4c304bf673b1da312cdfe0b368895afe8e3d384040ab58ed5fba70253d971353ac00c9ad90a1f1a2dd174c8daa442793591abb3e944dda4e4d7bafefd5a00d
SSDEEP 98304:Fy5112gYy5azzVvL69nLKnhZEAPdc5MUAE:oLIHmWhSW6MUA
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aedc519b0fd624dff1e6577d1500bcc87d02404efc27460e60aa4a47429e7989
MD5 2e272ddc3258005a816cc2b51db0bec2
SHA1 5d40187bc98c5540ae341d71e109c5dec31eac58
SHA512 2263d9ff1616d6bbf0da5e829512a06d12dc1bd43df1ec297958edc82d01a63f2bf6aa879f49fd89ae4b2410f8238033d21d54fb5415ac498908cf8c0410e1cc
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQAt6+dc0gQfM956TQ:Wu6JmVxd2dQAPdc5MUAE
TLSH
T1DBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d7479c0b3564ca3113f628e8511cd6943ce6fcc84c7de2b9b9e958b64c223e50
MD5 18b8f9624d1981d4e3f9e45ebdc9945c
SHA1 0824a604dba8970c69babd064831665ab2d8efa9
SHA512 67c92ccc6ef79d160f2f3a35858415662e833d59e21e9d18603129ed2570c86d6e5ed4176c7cb9e52e807d8b42f57ee98368a0828e7d0e9ad546f30fc53b87ca
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xzAt6+dc0gQfM956TQ:WmifPbRKAPdc5MUAE
TLSH
T1EBB5BE13F2D900E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca24d000f57c2f684ba5cfb11973f9316ce6127fd660e57f2176f06929fc3399
MD5 23b63e3fbd1c20645276fc336928f002
SHA1 b20e74f26d972e8e29dbd025b96f5c8e25646f02
SHA512 3b710c8135dce87234917b8b3cce56173d9434a7967f16721ee1d8390ad1f139e9c4117eea6a43b32804ababb6e268fdaf2e5deb8ab760604be76f9c8a3d7295
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqQAt6+dc0gQfM956TQ:J5dKTi61QAPdc5MUAE
TLSH
T120C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3fbb70080c01e4d66c1402d8047deb156ffebdd4d0271ce9450331a67105c54
MD5 8fe60655b97c113d4e3d01384a885829
SHA1 22ec0a1e077a48e66ce77e95add9687e29f643da
SHA512 6b644253fbd159cc1b2896bd50671d813e97f4754881189d34224e693e129409a782702c8644ede850be47b75c274691d0910144ba5e358e1a947ff584c26279
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5wfAt6+dc0gQfM956TQ:KX2iyphOAPdc5MUAE
TLSH
T18C95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 7463a01b4abf28a41bbf9591f7a9c9710dd95d98ac058b61a721615a9964b4a7
MD5 d256be60b9528fc8c12281a0b676749e
SHA1 d7c6cd5a29301acc37d09f8972caa202b18da5f1
SHA512 13017c09544ef640f2d726508ea6617d35306c2efdce2e90613309ed159167b55ede7a2e5e6a4ad613090c0fd1ec308ba47ecaf06faafbc525c43ee1748094b8
SSDEEP 24576:n8Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:8At6+dc0gQfM956TQ
TLSH
T1B5352391628F8CDFEA1B0879C67DC640C0B6680EBD220516E555D97FCB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 c109d814514e783cf6c0886c59be6dccc52540aa991dfd82ea3f91828e5736da
MD5 778f0149ecad4b017fc7fb70d3f8d79e
SHA1 1b4ac88bcdc2612b47da2023236fda5bb5e03bc4
SHA512 a4093acef41b3f4c38090b1b8ab55d4ee784d90543271649f83c39c12e81e9e3e485a549fb93cb92c82b25e9618d4f71b41e60a8f2dd5b4a7dc876f0de99023f
SSDEEP 24576:CdAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:KAt6+dc0gQfM956TQ
TLSH
T15C352391628F8CDFEA0B0879C67DC640C0B6680EBD224516E555D97FCB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 f435a3e6b0ef59b9d5f6d2db779cbdf430fd55a6b7729d04de3eed064d7c9c7e
MD5 32c50b90a78546f962da467ed295b133
SHA1 80bfd34e9a4655814ac9800cdf2a04b01a2e7655
SHA512 15c6ea847d0d9ffd56ae5454834a42406ef9e4dc1b5f07bb01040efec6ab31d498efe7f053f917734f8cf0cab1fbbd29bc070d98b062e07103261372e3bb7e07
SSDEEP 24576:kLAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:iAt6+dc0gQfM956TQ
TLSH
T1C8352391628F8CDFEA0B0879C67DC340C0B6680EBD224516E555D97ECB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 faf8679599454b6ca2e1d41d8c7765bff51843795f605811ce97ea72a7c54f38
MD5 b7eba7f9950caaf1e2dbf95541f3593c
SHA1 d63690506144a2b64aa448eb399979e15345fd2d
SHA512 19018d9f668e48376ba4a47edb3e651d27bb7abb961129a183e1d05e47920082bd7bc26a5d7c413e0303e8b3b80f1cd0cd97c7034fd0f2face0a46dd092536e6
SSDEEP 24576:nAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:nAt6+dc0gQfM956TQ
TLSH
T162352352238F88DAE9178538C679C240D1B6BC4DAE32465FD610896ECF33BD44EB1F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 a21592ab6a36adb2309df74c300b12c2199fd18cf3d423099e663c83599d07d2
MD5 d8c6ec32834ba9554bbf291c68ee6edb
SHA1 c1747700371128cbc95d6d033f4192aa122b2e7b
SHA512 ba3b13304877387c3db7603d5e625f8ef26d98e6d22ee4049c7e0968bfb68a99d3d9c94f6aeb7917fdb507ec97be2624c4b6f8260267f9a2c4bbcbd2239f5ca3
SSDEEP 24576:xyAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:gAt6+dc0gQfM956TQ
TLSH
T1DD352391628F8CDFEA0B0879C67DC240C0B6680EBD224556E555D97ECB33AD50FE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 03a3ec1b6da821a7c6db4b0dc7bc58b82b15e51ce5ed8dfa7f690b4ff845ce4b
MD5 69851c3700c5ea6258784678ec1520d0
SHA1 8af7bedfe2a8fa76792a938aa93fad23f56bdce8
SHA512 2ab8b54fc00be0d26d63c959ae1998c0d9976bbf74edf2eadb054178e3702ea0d7fdf77b235f75ad4b4208a1705791515adca0b87d673bca170f96151184bdb6
SSDEEP 24576:JZAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:3At6+dc0gQfM956TQ
TLSH
T1F1352391628F8CDFEA1B0879C67DC240C0B6680EBD224516E555D97FCB33AD50FA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 9d92d1a26cf18971ace84f3f1420d79687b9092f214e4d69ad59b8817f35055a
MD5 f7ef3448ea9025028d80630ced7ef0d8
SHA1 fb1e699d0b8549023aa046950629d1bdbf249cf6
SHA512 a86497e2ab62f8db3a07b3bcbb1ea06be76a4b6c3b0cd6cb18e6e83700265e619b077a9d115c29dbc8d2b5fa16821ecd5823e21540d3c90317c76a3e4f7ff7c8
SSDEEP 24576:wlAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:oAt6+dc0gQfM956TQ
TLSH
T1B9352391628B8CDFEA1B0879C67CC640C0B66C0EBD324516E555D97FCB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 0c62062d403a53c5c9b968003a1080ab4dffcc5eaf4ebb1633a9e0b18f0e0c92
MD5 3762b27644976a2bb149f5340b3ec68e
SHA1 4059ef9fae34fc3416f1ac3384581c81ffcf5d3c
SHA512 68d9f3c7bb914407924a5c80ef7f36e65f2c0099fc1dd1f4afb5d91fb0c5d4ab28637a4397f08b0b8ef9bddc26f39406c0dd20840fcd88a2d96e2944a5eb7c93
SSDEEP 24576:yZMqzFVSO9Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:yZMqzfJAt6+dc0gQfM956TQ
TLSH
T1FF55F1A5B3911CF9EC67813EC9658905D2B27C1A0B70C61F13A4366B9F333A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 27d1c4886b95fdebd89e3e18c85f68c71b253bff568d0ffde24512c657c60cb6
MD5 87cd8c1127e4c1de622909fd7b169826
SHA1 1197b89c21a3e5b56d2fb65c33ba44db511ae556
SHA512 657eb4262d5ba517d8472545d82dab15081e05fc7b95d2dd8caee8fe69b92af8806369825544a273eb5d19579898dfb074dc2de5927d45101bfe417c8b9f88ce
SSDEEP 24576:aAAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:9At6+dc0gQfM956TQ
TLSH
T13F352391618F8CDFEA0B0879C67DC740C0B6680E7D224516E559D97ECB33AD50FA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 8e3c2247ec92c25e7e5e12b5745f359041c97a5bfcc5d4d837e1a2a1717b675d
MD5 7599cb750c4114304bd1e53f2e529c70
SHA1 9d617bba736e50bc6522120d9f73ed169b9fc604
SHA512 37777c41a50d625d35e20b5e7f81fd2efdcda24db19d34b6bb867a6472609a7c61c40ab24075122435ec101dba420c65e758995f56136233c8ad4768fe315943
SSDEEP 24576:A0Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:PAt6+dc0gQfM956TQ
TLSH
T18D352391628F8CDFEA0B0879C67CC640C0BA680EBD234556E555D97ECB33AD50ED2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 f4972d3117ed4d37a01993288134605126b506b42ff8dc713bed124079bc1918
MD5 cc3c55dab86e3829f3272f191704eb20
SHA1 c862d3d5b1c4381497c7f8ac8fccebf82b4da3fb
SHA512 e261797b51288386910f4863a26ac5190351bccba50ac1fbb2a64e6ded119975adb46c7e64f181592fbac0421316ee1fa1d7055af2b56a217dcfe12118ced069
SSDEEP 24576:WzyxAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:WOAt6+dc0gQfM956TQ
TLSH
T1B3451253739620F9D5278138C9B64A01F3B2B8365B308AAF53A4477B5F336D05E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 c3f5c56705b69313a0c09b665de0fb2b7d98ed787ced2c04fc946aed8e09d617
MD5 5500c0c889fc0ac818b60287fafa6bdf
SHA1 321d6ff24e46ead7169692986957100a5bc4867f
SHA512 180ec4748aafc22b864928954ba3e49902aa1a397ec99df3c459edeea7ca4bb0119fb9d8ba0f04c79cb746152ad73a02343439c435b51454b6f904b8f84c5fc9
SSDEEP 24576:DAAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:sAt6+dc0gQfM956TQ
TLSH
T1BE352391618F8CDFEA0B0879C67DC740C0BA680EBD220516E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 36c8a55d676e84adf42641152059e7501a56067cd4e69d6fcefdf734db7ad850
MD5 01ebaba529ad00e74bade5a67bd656b3
SHA1 d27939f6475bdf890d1b20aeb6a07a392e7bf258
SHA512 f9dac61fe90e597fb1889c76b2368e9d2623052938c732813d11e6dfb0ea6ef9a0ecf1b9655dc85931c8feba6b4ac9d787fc99953ba09426cb723619918edb87
SSDEEP 24576:FAAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:aAt6+dc0gQfM956TQ
TLSH
T1B2352391618F8CDFEA0B0879C67CC740C0BA680E7D224556E555D97ECB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 097ee6818b0ea37e06763b1d7f40b7ef66880172b336cff3cbc544300b235395
MD5 c9193861336fc6dfbe06fbd50926f263
SHA1 0401c94f9027dd0d5a31840b06d5414a75975f7a
SHA512 442b267a562800b818663d909d3e9272235c7e2693b5d85f3cdaf8ac8669c5a73cdd026a4e06f067e2cb20cfa23987bf0ff9e7d6825f2e7e0b2aee0bc49c4897
SSDEEP 24576:tzyxAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:tOAt6+dc0gQfM956TQ
TLSH
T12C451253739620F9D5274138C9B64A01F3B2B8361B308AAF53A4477B5F336D05E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 518e3de2e182c70f0cad65c5afa5cb4a2a97c043dd767a9b87e0b9fc3cea7739
MD5 f2f62067eb7fc772f73ecadcadd56ae1
SHA1 302655b304d4868aa4bcd919881cbd707aff600c
SHA512 0f6e5c44a023092b2ae9e563cfc648ccdfcabc5f23e01747c7523df61eb1e4308a0c80a13d41e2a81ab4c9fa4274157d6467ef63e1a696a96ba61cb9bbb38683
SSDEEP 24576:1TPaLl3z0zDbAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:1TSLlj2At6+dc0gQfM956TQ
TLSH
T1A45501A5B3915CF9EC67413EC9658906D2B27C1A0B70C61F03A4366B9F333A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 2cae9ab0e342ff060e2b813af5e87c31e0717fadd014e17e52a562e7158c84fd
MD5 9ac0d398fe89db316a96123da748550a
SHA1 b23975c794bd4a2e5b6f451f425bb6bc1a1006d1
SHA512 971c4d004d91a1a6a9f37200aa304da0d8c41f04e6e000a074246e44fb8d00b5285420533eed663f50f466e812454d42d6cba6d763baed138e20de55ed8b1bf3
SSDEEP 24576:23zd9CHKy7GZXAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:Yzd9CHKyaJAt6+dc0gQfM956TQ
TLSH
T1DC75CF90F3D814E8F1B78A35C9768511DAB67C5A1B31CE8F03A4665A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 65c01a86974d7e3a991bc68c4c84406fd8f7d11ffb0aae9fcb7141b5cff24756
MD5 26a0263c372399f3457441bea7befb2d
SHA1 0dcc2ffebeb6daa38dba4fbc4cbae971b20bcc21
SHA512 67138934f6b80d901585509b5c9a628299a20ad06d31245cd1f9f973c20e6617b96ffb27b77ead72b0ed74496093eb52eea33cd60fa4ae1371cb60ab495be07c
SSDEEP 24576:wrAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:GAt6+dc0gQfM956TQ
TLSH
T160352391628F8CDFEA0B0879C67DC240C0B6680EBD224516E555D97ECB33AD50FE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 3f1b44bc0f4666348257dd701bd90de12d2c990911b931035fa87f37a27ae854
MD5 337db350440a8193a5394a399de32836
SHA1 42ed31abb1344ed98790549ceff7cc39d1205b4f
SHA512 d3608b63d5d2002cbd16c1033e56e325cd00ba65b788df24b897114256734afcfbfb3a4a79fac7449bfab24a8e0701b298c35b866cf9373683aca64812a2ef5b
SSDEEP 24576:+RAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:qAt6+dc0gQfM956TQ
TLSH
T120352391628B8CEFEA1B0879C67DC740C0B66C0DBD320516E555D97FCB33AD50EA2B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 faf7995c263fddee393ce7f6c25094f217d8cb12a81d39f2e182721be8da4b72
MD5 f33aef20c92c9777cca2b20aa426388f
SHA1 4a461d0165dab5c8d9a3639fc32aed0d631866d5
SHA512 1ef953266e4b32d7bde8518d2a22c450a6019596c25b154ce666746a4e6449cb404e076cda712fc334fe300eed1757aaa80e06b67f4a8c43746877d6a4e217b5
SSDEEP 24576:Z+Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:kAt6+dc0gQfM956TQ
TLSH
T148352391628F8CDFEA0B0879C67DC740C0B6680EBD224517E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 aaf6b648501e5c32ddde70353e792ef9c9befb6de074341316a0c27458c73c29
MD5 88272facf51167ba265b8794c551262b
SHA1 1710c639f24049241f2954f7a97d0d11de785180
SHA512 a7e6c74ac6568ed9c955a0bb54784a94a9e71fbae24ab26da5e051721ec93eaacadeda3ea83776e9a86261dc84ae531daec016082bb0543d7ad2f67475c841af
SSDEEP 24576:iAAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:VAt6+dc0gQfM956TQ
TLSH
T145352391628F8CDFEA0B0879C67CC740C0BA680E7D224556E555D97ECB33AD50FA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 677639cb975ea8ffedc552690eef098448f5c05ea1cfa0a8a3e06c87e5b724c1
MD5 83129bdbf65c2a377701a2e9dc57a0e1
SHA1 d3d2a5456a1d17a3a6f4158a85979abfa2ef43e7
SHA512 eb281ca8efec3fe27ea7a9ec93e207f7730b9317112c8349a4243a7e331b640e7205bc551a4a0f6e687d8055b615b4f6b00f9d4895a00da68966f9005449aa7d
SSDEEP 24576:OrAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:sAt6+dc0gQfM956TQ
TLSH
T1A0352391628F8CDFEA0B0879C67DC640C0B6680EBD224516E555D97ECB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 5f01bdc8b40277c72cd580a28cf85ad9961d386afddb7d9e1a9e5cf7e66f90a4
MD5 cc96e96fdfb0c65c655523cc00e52b69
SHA1 a40b0a2b2e0ee9c037fcacaed77c763b86e7b693
SHA512 fa4d5415f6ab72a4858039468f71d161bf9ce080812e047a88667ddc80d2e90b28931eebf96ac80cca8eded68b83680faca59426210394d47b0eefbc05a47ee2
SSDEEP 24576:soAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:jAt6+dc0gQfM956TQ
TLSH
T140352391628B8CDFDA0B0879C67DC740C0BA6C0EBD234516E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 7f21501f3593961583ac8680bfbd29eebd671ae9b8f13246d60bf92e338926c8
MD5 7e049b46ce21db0f4c5d8311ca1c3e47
SHA1 074109d81791d706174f654fb2aacf98685e4f47
SHA512 2407395999126698a112b0c8cae15d7ca02c9049f636a4bd9eab7a65ed433725fcfe93a72efc01e654c17abfd173cea5257dea0854d231001b307e41a767d08b
SSDEEP 24576:0yAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ZAt6+dc0gQfM956TQ
TLSH
T1DF352391618F8CDFEA0B0879C67DC640C0B6680EBD224516E555D97ECB33AD50FE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.5MB
SHA256 b3fb1dca2d95b86b3afe8a98b519a23e5b0116a3df60af319ce7de0c498ccd7d
MD5 f41a300202a202c998045267f4947d7e
SHA1 6ce1a3241956417039002b30cffcb34b1218a02d
SHA512 1bc6f828a8315a405d216bdd7e2f40777d63f473669fc7aab5686c284d435eb5f2688484ab47deb4e4f779261cb51eb2934e21652705059ec18e25b7880e49ed
SSDEEP 24576:1fwv1k9RX6wkyAIkAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:GMnYIkAt6+dc0gQfM956TQ
TLSH
T1DC75D029EBCC44E5E177913C89B7860AF2B178591B31C6CF129A536E0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3fcd14db30ae8fa6a92dea586ff94398c909adfb9dbedd210f69f9842cd09ddb
MD5 f1ee581b30281708641b0692d94ac679
SHA1 698a8cc00548b681651a0b243f299076e634f537
SHA512 f2237122cb5c19d8d5936b6d68ef6f321c60a1ef3a31afb31d222d81e5862816df7139a4e552e5f1e3d2ebd41b76d17ba72f7a5482abceb3876bc28133550556
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/At6+dc0gQfMl:8ySzPXAPdc5MUAE
TLSH
T1F2066C96A1A841D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7b0dc690afc9f521727fd95c54a24fbad34b914f4112a6f95df1c6b8ce5d6f60
MD5 6ff97784addb2b5e307d22d7a23b8632
SHA1 638469f08a70059ffc76801cf859c3ead74a5a2a
SHA512 0e71a44806021ff6bb2c12509609fc61dbb631a1c3ee5bd77b6a7b08e42be7546b13e60abf2190afce0c4179f1c28793ca63f2d6bd8591957533137076bc49a2
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtAl5zuQ6+GWZGd9iwnsOTQfM956R/C:i47JUQj1irIhCnDHUPfF/vAt6+dc0gQY
TLSH
T1C365AE1EA3EC01E5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 86c855f7aa287bb3d69f798fb7c46795a2d9223e77b5280c2340a3dd0dae00ca
MD5 a7fcbc99cd7f559594eefe3cb35d608d
SHA1 3be72bc37a206c33bb2d505d7aff2da1100ee719
SHA512 892f13ef4164697eee154db85f27c6147f20610f4fb294d95960235f07a1108ea1cf989bb8aa84cccee91ac2abfe0f3fa24cea3c8ac586a566301fa51f8e2469
SSDEEP 24576:TQAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:kAt6+dc0gQfM956TQ
TLSH
T14345F056D28941E9C06E5179C7698A40F3737C2997E293CB92D0F93E0F366D05EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 605667a65e846baafe576c5aab0166202226bc51fe19692e9a8a1432fdfe858a
MD5 327a6da36a3b751ba06b64f5121740db
SHA1 68138e87521ee7a11d5f6e5782f8d084d8552cf7
SHA512 a036e0b10e957b1e74bd76fed26e4817e65cc93e8a5cba213b9607d5ec07e4768ca615692d3aabf6c0df63888d9adb15be51ed2022969ad75c54375d9b0bb653
SSDEEP 12288:mvGaU3fyG38ucDxcpIp5wX4h2QCLWAUCK2AlaRMuHl8eYvozT0:mvhUPxoDxcpnXK2BLWAO2AaRMuFpHz
TLSH
T1E2352811766ACB4FC66944321E33D2CCA7707C11EE05AF0373C99B3F9576658BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 a1bff1bc0448592a61ce456ff52ff1211cf243b1cdc31fe68c47e40af066ebc6
MD5 574771426f96743c2d7c460d8c1bf3cd
SHA1 5aec595b6a31e177148480ff681ee225c149ab24
SHA512 7b69dd432a36e222ab7e5048b5d62def9e1a315689f25833c63c8bb6ed7fa135b40e25e571cdc147e11e87032a411710d2bfeb49e2244765ac7f026f474a3f65
SSDEEP 6144:EMuTCo31hJouhgbLm2nPm+PLurAnMdOWnFoyNtMxFyNtMxcaofbpqUsfwjk9Re:kFh6uhg3dPvjuceF3sfwI9Re
TLSH
T1F475FA416137E78FC1B76032032A5B8C77A4EC16B7096F22B7C9493AD826B51A0F97D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 8b96bfc2576bc72889b9984a66c7da3277a85cfd07cb7025fa9a7520f67cf893
MD5 6761513f985a0141ea23141b1973c387
SHA1 c9775563fc4bd2a085422c4d811ec6b5a2b132f0
SHA512 860c4c27abab02d769762e3145b9b518693ad2384c205e2e4af6e6d3a337b980764fa0d1a2ba732230026ec494204e6b8c55fa243dcfc2e2ea574ecb7bd4966b
SSDEEP 24576:h4Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZa:h4At6+dc0gQfM956TQ
TLSH
T128352362538F8C9AE97B0974C57DC210916BB81D5F2145D7E4059AAECB33EC44EB2B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 75f77bf3415a4c5244460b5a12632acdeafbcd4356716f81c4fe34341c36bc06
MD5 95b9fc217aea3bc87d5f3a7655d3a9d7
SHA1 2a6e2965f2d8d39ab93591ab3ef5f1fe4040046e
SHA512 70cd55a1e55f7afc5de23d3b963c1a4d838e8bc8198b289e59b16184fa4a53575d13f1b3fdd55da3e59c7823646d63c94d67aa7838532c5e9c9edbc777f89511
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bY2Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:agb4mBIBhGFtAt6+dc0gQfM956TQ
TLSH
T1B1659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d452cb68507a6949f77cb0d02ca02eb8a6089c6d41a079e62ce5e6cfd8ac2e67
MD5 69de804c5ba7ecee54cc7a79fd8eed10
SHA1 3dab82cc8ff410d4c26f7210d03b4a4fd17cabf1
SHA512 78b3a849860955c132e818fc96d48a814bc908fb51a8f9a829dde49478acc40f0df53821c2a888fbd82741970b9e0d362fa7aea2abdc2ffc14288aa8fb6639b1
SSDEEP 24576:hG88u8FpJqH1Dzria7/m9Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:k7ZFPqVWa7/eAt6+dc0gQfM956TQ
TLSH
T1A575F16173E101F1D47BD138CA968663F6B2B4251360EFDF06A88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1c9d413b50b6c296042e6d52e5fc0a3f9b007836362891bc4e45db15674f5f53
MD5 f3d84d5410996982ba475dd87bc7b0ec
SHA1 d7f955cc0de47832749c33356f284f0e4e6f8570
SHA512 c3d5b6edfcace9d47afebfa06ec328921d305ab1557fd4430b3fc457a15b30f07cf236ccd5579fb5fed5059d9cd8d9062ad4436214b59378e711d9b36951f432
SSDEEP 24576:ZPUr+NQJAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ZJQJAt6+dc0gQfM956TQ
TLSH
T12255F22F22DD1CE5E67AA17DC5968709E772B466171292CF02E0817E4F23ED8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f07d464ea4d3b56c7dcd57282e00b60a6a5aca46891170ecb90840a48497bd42
MD5 92604d2edd1fc862d562f1cfc5f7ecce
SHA1 f0c2923f89acbe800ad2ccf365eaf21f3b01c6d9
SHA512 fe7d5afcef8797e43ca86b05f2644946b92df4e642964055f0d1b25d895cbc6baeefa94ffc61faee7eeac2c091f29e8300ebf39430062e744829880ac3be2c61
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZAt6+dc0gQfM956TQ:IG05lO43bsAPdc5MUAE
TLSH
T1C5D5C06A62EC11F9D1BBC17CDAC6860BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eaeec5530c00a32e3fb7430f3e4005800ad53232c7b6862082b899f2d0b40185
MD5 8421310e2bb23a4d2030c8e882612e55
SHA1 c0afef08f0ac3e35623e16ea633fd4b914c87d95
SHA512 53ea007fb5105112fb65e8a6d8ace161f565ec801eca5c5e77d75788b07f9b4b6319c47b3a5f0579e8bd6aa98c58a86bcc69ff4b0a590c7b439662b258701b09
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/Al5zuQ6+GWZGd9iwnsOTQfM956E:Va5POZ3+Jt2pasx2+mRAt6+dc0gQfM9L
TLSH
T12B65BF5EA3EC01D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8525870850364d17bf21b93ace71b32a09bef96eef3d9b2bfc4bdcc7b540eacd
MD5 d643ba578f68519d61bdff0b8d873f15
SHA1 231475decf46499b344394e1f7dc7f8102d46065
SHA512 bf76df70763260acb7512c7416418bddc28922dadeea46fa3ba2677f2e255e89910bc28c7ded750c2d33df03de1e8e31a234428752f962db6c5297bee168e466
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fk1Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:VNc/zEOVHF+At6+dc0gQfM956TQ
TLSH
T18F858B1623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 61104ebb9b36e382e28314ca9543a3b3187d76e64ba02f1f753bdc809b1934ee
MD5 4fa77586ba7234bc9cc0211ab3974c64
SHA1 800f3a0400807cbfc2ac5862bf6aa481cba21eeb
SHA512 1e37ea43c8e7df05233e27edd1e1544ddc15ae877a946d3afebb6a9ebe14e67d430bfc0a2945307d2103a79917eb4f320bc9cdd63baabdbddcab5a7f5b2874ce
SSDEEP 24576:18kNvNnaFeYhJNtmZBmUAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:18MwBtOmUAt6+dc0gQfM956TQ
TLSH
T13555AF6EB6E846E4D1FEC6B4CD238512E6727461073293CB9290C13F4E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.4MB
SHA256 1b3b139cdf4323754f5437eec3bc1a2ba0a63789756344da2d20e8d27c606329
MD5 b648c6d1c3dff14a766ea71a40180f89
SHA1 3cfd0c6fcef319ff9e41565827e263bc93e3026f
SHA512 8781c5d73f81fff70c51526dd6be9535c0a95a57109b8520d73f1a794ef83ac5dfae350bc10f93bf93fa416288ad722a19b65e3fb3ca3d02ab2505106b2d3d52
SSDEEP 24576:iD3FHshBIYQgAcAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:iDVHeBIAAcAt6+dc0gQfM956TQ
TLSH
T1E465E17EE69D04E4E57BC1BCC6638A06E67138AD072255CB02D4C1BA5F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-82-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/120-309-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/120-88-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/120-83-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/692-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/692-316-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/692-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/692-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/692-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1040-55-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1040-57-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1040-44-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1040-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1040-52-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/2432-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2432-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2432-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2432-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2432-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2432-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2636-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2636-125-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2636-119-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2636-117-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3764-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3764-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3764-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3764-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4128-1-0x00000000027A0000-0x0000000002807000-memory.dmp

Download

memory/4128-6-0x00000000027A0000-0x0000000002807000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x00000000008AE000-memory.dmp

Download

memory/4128-7-0x00000000027A0000-0x0000000002807000-memory.dmp

Download

memory/4128-17-0x0000000000400000-0x00000000008AE000-memory.dmp

Download

memory/4388-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4388-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4388-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4388-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4744-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4744-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4744-139-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4744-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4960-280-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4960-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4960-59-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4960-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5448-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5448-27-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5448-19-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5448-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6100-70-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/6100-72-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6100-78-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6100-297-0x0000000140000000-0x000000014014D000-memory.dmp

Download