18b9a099a2af21983af0886792fe4d6426d15e161d4120e76ea237979ad95505

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
Size 3.0MB
Sample261102-stde6axs8m
SHA256 18b9a099a2af21983af0886792fe4d6426d15e161d4120e76ea237979ad95505
MD5 8ba199bdc297506cd45d08e7399e1e18
SHA1 8d869bb10fe5701d47d3a1e65e487678b6df9402
SHA512 bf2c19ac7321906442bd9f50e888d03a4473c037591b6ff4f68728554744e21b9b8f8088dd1970eb0d6344c6b1340aefbfb23a1c5411834007ed6653bcb1fb0f
SSDEEP 49152:Z5CmzjNtmYO3c46XOBhvCnAaXzUT8bcBBfXZFTIO8xtP3ZJMCTEUCGHGqChOlciO:Z5CmrNehN8bcBBRFT6rJMvUCb8rSex
TLSH
T18AE5D012FB8280B2E49301745577A73F897DBA35572885C7ABC02D2D9C306D2A63E76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1408	elevation_service.exe
5172	elevation_service.exe
4540	maintenanceservice.exe
5424	OSE.EXE
2236	PerceptionSimulationService.exe
3944	perfhost.exe
4644	ReFsDedupSvc.exe
4792	SensorDataService.exe
5860	ssh-agent.exe
3300	AgentService.exe
4996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6697ec3ec17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\OutConfirm.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b90ef152de6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ea03495de6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038045595de6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6979954de6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069047395de6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052557552de6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9026352de6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe
5172	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1760	2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
Token: SeTakeOwnershipPrivilege	1408	elevation_service.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3300	AgentService.exe
Token: 33	4996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4996	SearchIndexer.exe
Token: SeDebugPrivilege	1408	elevation_service.exe
Token: SeDebugPrivilege	5172	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 5692	4996	SearchIndexer.exe	100
PID 4996 wrote to memory of 3888	4996	SearchIndexer.exe	101
PID 4996 wrote to memory of 2324	4996	SearchIndexer.exe	102
PID 4996 wrote to memory of 2632	4996	SearchIndexer.exe	103
PID 4996 wrote to memory of 3012	4996	SearchIndexer.exe	105
PID 4996 wrote to memory of 2792	4996	SearchIndexer.exe	106
PID 4996 wrote to memory of 1220	4996	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ba199bdc297506cd45d08e7399e1e18_amadey_coinminer_elex_glassworm_luca-stealer_lynx_njrat_.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4792

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f34514c9cac83c8d52ee6871cb909139c6b522ff23dbfada20b6231b25ec41f
MD5 118566f8fb06def2119ef11a5fcee048
SHA1 982081b6c9bf9cf9f6fa7d5ee5f801feabf17cb2
SHA512 71ec113a2159051729bb3fff8dcd0cd88e4b766fc5a59b47530c899bd0f36ed9be4743ae6c157f56623f10d12c92d3aea4bce0368a9e6f6936e2b426046be8a9
SSDEEP 49152:rb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnWhOlciSexvI:53q6tjBn8rSex
TLSH
T1A6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e357d9724e6b30cf180187d892a22a9cb09a703194b16f9bde7526fa527ac2c7
MD5 a85a410f5ca14dd42ba43cc7d522a771
SHA1 0973186b5d6027270371822613c51b2480a42597
SHA512 c02dbaeb3cbea372baee01d6acf8c5a6030addd4deb6d00036aab6b12d771284fa0fda9b51d976f0666e0728b9fb4ff108cfbf778cf44f2504394dae55f77ac1
SSDEEP 12288:t1XLsswWkxy2lRq2czA7XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:DXYfDtczADfhOB95Dr47iJ0nQZo2vI3
TLSH
T18385F12877D409F9ED67827CCDA28502DA337C9547A0E78B03A096395F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4e96b1cf655f8696df191ecea6693410639711fd9aaf54944033f1a249d26f1b
MD5 6283f783d7b98e4cc57eea2c32b97162
SHA1 49bf645856165e1c8e66af01069ad9b89f3dd50c
SHA512 d71d2baa6e9c403719d899417668f86c05fe22b45fe82add74482e1a5ac666f197aec558731ed7ff299440124b15b5153f92b0fd4d16a0bcecb3af00195deff1
SSDEEP 24576:o0Le5ji0hmxnrMSfhOB95Dr47iJ0nQZo2vI3:oPji0AxNhOlciSexvI
TLSH
T131A5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d5ab0e931c6c5973b0a31e4d4e1f21bad6763e7166da4903f49b67d47f01ee3
MD5 162707e6be914bb0e82009900eea79e1
SHA1 7794030b22d4467a1e064c8f153c39840059aea4
SHA512 0e2e585ec059326732728e1a25aa5c144ca180187029f8e614acd03c42e130c8e82d97fcd6a03384ade802254fd757b2833a9040ab7c228c982b6fd6cb2f3866
SSDEEP 24576:va7/ezSC6vUyDZaqgrvWx6q8wyu8fhOB95Dr47iJ0nQZo2vI3:i/ezSC6vURPvMHjyBhOlciSexvI
TLSH
T12A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1813cb6d4596e2e55638e25d17ad921d3e10c295d99f05aa495748590f757be4
MD5 787d479bc5815ea5e76c718d05afe460
SHA1 8df9ac2ed28709ad8fcd342adcd7320feadaa819
SHA512 38a8dfc68e47e8140e870bfe4e7fdf180f5c8a6e07ce817ff65e66e5f1d4530d70d36fabd19f0de9af195e31d07a979e3c12e43dd9b6f2134188cdebf096f3e2
SSDEEP 24576:WVbqPb88hv/lV7PfhOB95Dr47iJ0nQZo2vI3:WVO88hXlVDhOlciSexvI
TLSH
T107559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 fcb052080907ad6c3aa0dc2b038f9397ed183a53f8e38e247812fbd4f5f667ef
MD5 5e7f4a37ed0601b30b682ca6bad2beb7
SHA1 b076df69bb0e74fe931eeb9c1f0917f2360e6b7f
SHA512 5f6eed92c6e2dc786ea8b626a2a56234d9d30a0277026373a0502c01224ef2c69627a90c4f79fab222a882bb7a806532e3d3c6f661564272fa71f0175271d0e1
SSDEEP 12288:6GAXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:6GOfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F27523889FCC6DA2F3B7C7B97FAF8B02C8593DA494C11E539D00B26DE535455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 1a75c1e67d93d01df610af8eb1bfe0c7dc1c49b4079ec92ee92d1b4c89ddd8ba
MD5 8616f040bc0d060a6b35433d6aeb798a
SHA1 ab4835f122cde3860b23d797d207f663eefc23e6
SHA512 99c649beb18720a0c070086c0e0fcd51997c0e739cbeccb4c12d8cbb88e2d04da635446195a96a27dec91fb9da0cc6c85da6edcf6123d409715ec8d5fcc8cd19
SSDEEP 12288:OeBNUbTVO86UXXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:OJIUHfhOB95Dr47iJ0nQZo2vI3
TLSH
T16785CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 87d2e3fbd4587047a114d4390d539ebe9485d00f41e0d03b858db1fcfdb20bd9
MD5 b4eecef5087135d3b0454f2533e080e1
SHA1 7a0b6066a19ad5f4b2bcf79f217d9d8adacaac33
SHA512 f79442b298c6713bea53c55179aa92e2301e23c9520d2ae3db1f1ab30c1d2056557335fc293a63ecfbeb640105951eed3ab920bea71337719f1896d0cc3339b0
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THJ:gQvGAdlCEL8c/pRNw5CM8rSex
TLSH
T15E266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d959a916019712f09a719f2f247674a0ccae61cfae0fbf98811522039a098759
MD5 496527bbf275f57e5f20f48e82e62aa2
SHA1 1ad78a075a879373ba30153125fb6f72890cc988
SHA512 48ed7a569dedbf459b4d9ae68f615c75fc6836a02d7830987a918c6ad2a0e97e60b9dc2c9022bd60e9824139dfa292e5a483b4a6b0609fc997259ef958b089b9
SSDEEP 12288:fAwSfxL/2Dc3xDLLmt0LDQewsAjJXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:owewsAj5fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E995E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5ef6751b75776397a97d4776d611197d72f0d2eb3ff04d8ca4f1363557c5d487
MD5 349d993be68b62e567320028510aebae
SHA1 3fb3d6071b813d24bcf3a197758226b7acf90e06
SHA512 a059da930478be5cc0ecefb7544acbfc637d7a8b4316898562c8ada5cdd6f2758fe145832ab04fa797c58bfb39d66838e9668476794a24a8a2dd67296015cb8d
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHyek:MUEtQevvqc2W1cpV29I32fk
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c7cee98c4355fa8b01537bc1346fb13d6624e827562f475bc9d2753076751cd5
MD5 4ec7def491fdb04f0307b9d3985f7f2a
SHA1 29803bbad64649e537e86ce86c3a9b3715527800
SHA512 5d056371468ec10c864132829bd2475724d9040e96a18a947ff4103c6c0260def69cb664eac385cfd1fe58d06fe03c03fe512b107890297e85fa75e8f96ab646
SSDEEP 49152:OCbRquA/m2yL5zifFiV+XenmE3/z9hOlciSexvI:joqHVjnmg8rSex
TLSH
T113D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 200903849f145aec1e1efb990b33a1955300cce9db04abc71aa1757f63715fff
MD5 a293bf62191c6c2933950a52ecd2a548
SHA1 b805ae33e3612e3b88b67cf9882f437ee2df57e8
SHA512 8c2fd8879e1be3eb65aa11d0529d8a806e42d309fe52c31613c439f9c8a43a58d5b97defd49e6720d4873ad41307b47238de0dbc5c89c5a87deafa5c86df2c3c
SSDEEP 24576:pAhGLmIFoiwtA5l7S53wfhOB95Dr47iJ0nQZo2vI3:pAM1Foiq5whOlciSexvI
TLSH
T1FA359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fb2e34da683d110876c581e7587870523dd00b1249804c52f56a358089ae08fd
MD5 e1d810f40ee1de48bd4a2bc59097ca61
SHA1 f829d40d20a1e193d86c1c2fc9e56caafa2016c7
SHA512 5b5333c1fd8e9d48c10c58d070d733c010c7265f63dc8454034c4eacfd2b9dd0ffa0ac82f5caa2736f8ca8cedcf9a2f1123bbe76acfc2f68a8452c2571867326
SSDEEP 12288:5mw5HEjsChNOBFgl0WDm+COXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:UwuXOWdfhOB95Dr47iJ0nQZo2vI3
TLSH
T1B485F14577E81CF9E6B782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 eab50e388b4d996cefe2ac41c62cb0614c4c1440ab44304a9e383f44a2731dc3
MD5 7781ba442a1113018827f065129e2989
SHA1 46779b4250e1996226863eff861d920782eb967c
SHA512 c02daa1d3e9def38458bbb49dcebaeaa9e2a5cb804385a2f50414f00a334e1f7ab8660e4e8a3b0f1776fe2574495f42ac9dd5871d0ef205e2946dcfd7b93aaeb
SSDEEP 12288:hbZ1IyZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:NZuKfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AA75128927D825F6E2B3827C9EE64A02C7763CA5537143CF5A10826D6F339D55E3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 adefbc0468f73ecc6fb833159ea146031b84d2f1ff90a047306a86f66785de8e
MD5 6fa0efd82528cdc0ab945bac01349c6c
SHA1 f85d65c3b2a95f715cddc4c7cb507f3785ec9528
SHA512 c64091b0df4aaa8c6d9d8201e48ec5054d5c08e0a82be49caa9aec544aa0844690c8a6c4327c905ee91381fd77b1d3e44e553bb874ffa18dc55315eefdc5a327
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U1:5QRQyi36YOcPuLvw2gAf+PN3z8rSex
TLSH
T101667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3267396e8fd7ebaa568d8da9ad254be6baf3831534e5478036dd26e8833a10f5
MD5 277b2cda8d77215c893a1e9f8b19ce8e
SHA1 aa2c3b8fa5b9d769aca1d264066706d927e6e99e
SHA512 669ece8445c8491522c4738d0b54ecd80fdd1bddf04dabc038f171a934aff7cf90461305e1007ee2cb910f93875012a26dbe82035f60d94d1a2e050567f91852
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U1:yQRQyi36YOcPuLvw2gAf+PN3z8rSex
TLSH
T1D1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d3d8ba95026883e4dd60927ab8b53c8c4438d39e28123e1ee5a518bc287406e
MD5 3dfc3a0cab32011e0d2cc6bdadf4bb54
SHA1 50d22941875d1df20d0ff3a7ae60b511b691165c
SHA512 0ded0a3a8e3e5c76de1838a7b9b63ad4e41ae84de2ecd9d7ff1d6bef6f063b05b1bdb7f6dc9fa4a9ca8b832168c5eacc728f8b50d09dfaaf1b48da6e767f1f46
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL06fhOB95Dr47iJ03:868Qg55nhxeWu7PNU3/NhOlciSexvI
TLSH
T15BB55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db385c9644324e2dfe1df92dbe9b501c06f5c2f3b70cc2385c51f5f52bfca8b2
MD5 2c69a07887747b9f1ebb5bd3a9d85a89
SHA1 b8b729311a3b2ab7754ac0890724923bb3db7068
SHA512 11453f02aaceafebda9552d87ef580fbf30959a757669b6eebb726af50ef8646d40fd17dc6a12c8a4671aa1bc191fe974cfe3cd583f1ba13dce802ba8375514c
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:Xy5112gYy5azzVvD69nLKnhZa8rSex
TLSH
T177167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 73de81c140a90e60ee3db790545eb93e927c98475b53b4f13320a78c071b34dd
MD5 a56fae7353b2f5052b3685e695af5e28
SHA1 8d331eb694fcad75e62ae6f0ddbd30360aa9027f
SHA512 6c189ef8f6476a4d5d301336c40ed29937a4512eb0770b1ccdb4dad0b0d0095d415697328faf91375572bde9a59b30bbc48f4df0920d93ed77c7154bbb966055
SSDEEP 49152:cB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8hOlciSexvI:2u6JmQxd2d88rSex
TLSH
T14AD5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 96bda4476e28f861a0949a5a55d2538c9bd4e1f79d3442c7c2a49d65821f8fb0
MD5 e5bdd559c252e86519109789e66af2bc
SHA1 9b8f6bac7c85f95d68cca328724e873a74faee51
SHA512 976d50d490e3111308168e9f06b4401775862fce23d2ab2ad5b912101e31b63b9fb1bd26e0f15a4694d2dee9347ebf8b70582892d146f019b3e927520bd25f20
SSDEEP 49152:61hpsNoJpF1A6yU44CwH7R4xfhOlciSexvI:6mifPVRg8rSex
TLSH
T177B5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4b731a114f8425797b96a7e8057d3d030c50bbcef883edcc0455d827fbd5f248
MD5 7601abf5868207eee1acb7b1c1c7a614
SHA1 313fc8aa2fd0fdc7c78091c387ba1772d7acba18
SHA512 40d793e5b4fc4a51a0f5567c4e6c07e8c2c9416b84b276af5bf27f9faec239b5d37d1a9333bbe16852aaa43c906f3c64edd301e13013d50a4a1cfe32bb4a513d
SSDEEP 49152:8SuZQIY0Be2KIRVtOnks6NMHqmhOlciSexvI:+5dKOi61m8rSex
TLSH
T1F9C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c666c98a677e03d542ae13298514a2c7aeb80b25aba07876c70572200a09d951
MD5 d19b0cfdf1c861f40cb263eec2441d3a
SHA1 d36b4679b3774b3b590c353087c40218efedadc7
SHA512 2619740b3ec130e40ca3c30ebcfad251da2bf1741ed6fbfc42ae8c59c3a3182ba2dd6a031d033877ad37bb80c1ea9d81e6493fc822f7c8b6cbf2a334fde9ba95
SSDEEP 49152:0htSn8EApI0figGgiDn0AP5wLhOlciSexvI:VX2i/phk8rSex
TLSH
T15A95BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 da83fe72aaf1ae38f747860b9deae301d59969f07d08eaa6897db39ff57dce1a
MD5 1e43b2fd7de1ad881eba6c7f5b8ebee7
SHA1 94a56ee7ad6809daf5d4933073e4ddb045c5b0f9
SHA512 c2b551ae8ae99543a05e687a0f9e529a0670ede8d3eefd1aa09cd7b64df59191a2e0e59198cc9100a675169f47c5954334ad6e6ba510ccdaa25952be5567dc24
SSDEEP 12288:joXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:jGfhOB95Dr47iJ0nQZo2vI3
TLSH
T1B27523886ECD5DA7F373C7F96F9B4B02C85D3D98A4C10653AE00A12DF63545582AE06B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 bafd7cb218873037065f746842ce4cd7b9a8ecb65f05ff3ae72819c3ac901436
MD5 58811bff94701423a784a8a2bd9800e0
SHA1 a2d7e3af45ef28e60243e52250c60c059984d009
SHA512 ea520656ee0ef17437814e5b3ea1a90bd9f1f203701ef8f02bd30594f1f11c63cb333d2a7d44023675f9f94c1485fdd14ccb0e7e608f35eaf93c2dee1b9c5dee
SSDEEP 12288:5dXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:5lfhOB95Dr47iJ0nQZo2vI3
TLSH
T1CA7523886ECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53AE00E12DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 514203aa6fe99e39cd8c9161ea72a4a0bcafa2f833ea7325e881770fdcf46966
MD5 12cbf6bf97c06d6e51d3ab686f2ce4fa
SHA1 4e7a213f8217532364972a5d17cd942431068ada
SHA512 8f74651aa8a89178d8d759b2ebb821327d1f5e2fb964a2d9d903d0a8e87cbdc9eb22506dd64ac5fc5912ee7a201cfb655b71728b17ae888fb5755d73c71015fb
SSDEEP 12288:3/XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:3/fhOB95Dr47iJ0nQZo2vI3
TLSH
T16D752388AECD5DA7F373C7F96F9B4B02C85D3DD8A4C10A53AE00A12CF53545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 61078426d117bb7e978b9ee1524b290dc7aefb6d1b2a5f39bbba8d6ab928bce5
MD5 ec03facb7783320fecb91c8b6d352b5b
SHA1 9c7e9670c776777654306d28393de3e28d6fbf90
SHA512 35b1038bac363e8b7483e8f5d05d263d8663c8eae28fe04c536e9c3501e6dd0240138698514ef7742eba33d1193ad65a6fa4725b23c72318f869220b29c3464c
SSDEEP 12288:5VKXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:kfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DF7523446FDC19E2F3B3C3F8DFAB8702C4793CE496610B9B9E00512DAE316948679627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 14d458b2b23b579f7bcfc3b1737123a1c023fbdd36fd3994cb8d1fddc77a14b8
MD5 719f10cb5cdab65b6a1451a0e220cc6a
SHA1 26732d41e62369d00a73238c8c1eaf10981e81f4
SHA512 500fa9c430d2684cf4622691d3dfa98bd10b32f6f466c1a2eba598c36d2f2daaa43e9aa5af9359420fd7a9025ca955fd39826b135fdfdb30cdc4e47391a943af
SSDEEP 12288:TiXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:TYfhOB95Dr47iJ0nQZo2vI3
TLSH
T18A752388AECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AD00A12CF63545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 d3c3ca198bc51489e841072a3f078bd6b810a39aac6de0935f5052cb2b2fcb6d
MD5 e3e89056c732fa21d30ba6166288ef98
SHA1 d3e961b74e21260838013b7c4588394ebe58c1c9
SHA512 06a1f27f1310dc6e5ae139c5e3ffb09521b16c115566a86781fcf99a3a3fa5e5d0d834e3e7a563e151c81199f72a1f50d70157e62d4673f2215277fe74f5a072
SSDEEP 12288:mRXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:mxfhOB95Dr47iJ0nQZo2vI3
TLSH
T187752388AECD5DA7F373C7F96F9B4B02C85D3D98A4C10653AE00E12DF63545582AE02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f121000b24ea3977b1c144411c3f5dd73eeefc6afe4d4f9aa0fd40aa102936a6
MD5 71e94844c03510624c22b24853882f2d
SHA1 e6086659acf19c8b307e712666e47a1b992f8eee
SHA512 4ec2080d4c742c84ae4d3af1fc76a5adfebefc81a44b9d71237b6f7a01ee0a063f5f2bdd2292901f3c40eb55d611a71070a99f6b8ed558c4aeb64dbf923c9876
SSDEEP 12288:JVXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:JNfhOB95Dr47iJ0nQZo2vI3
TLSH
T16C752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 5c3278bc38e32b96c2e2108ebe1db9ff7fd32cbae80452707152f84eb6544829
MD5 95f144ad0e9b9c91393f9b716fb55cbf
SHA1 f8c0056fa92489b8161c18687e1b8fd5d832d715
SHA512 8d3b3cdd68b419f925405148273faa8f42c90f1937590b5b6b05b64ba4ef492f80ea9e213e2ecc46e3cc0cefa21b25c27d90a71371ab33910b0e12fd9e877e51
SSDEEP 12288:PiZwbNzzFEoS2cPvy9XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qZMJzFVSOFfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A1850294B3941CF5ED73827ECD568906D6B23C5907A0C61F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 8892ae51bf328c57730cd86d128a366b522dc4128007bbd0a5a8586c899b63f5
MD5 fb8c0a90d7c2d1b7e23447e4a6a5b5f3
SHA1 9429431f0c801f955ca095269efffff236630c1e
SHA512 38dfe035a304583b77e49ed8ee4fc2bf77543a8303c598861f8f394664cb9f9f8a3989e8c13892065d01a77d72c78ccfa6cedbb87a1e3adcd246e7025bbe5e21
SSDEEP 12288:C0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:CafhOB95Dr47iJ0nQZo2vI3
TLSH
T1C87523886ECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AD00A12DF63585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 265ecd55fc1777bc1b4aab40874162dde9f914dc65bc2d0e850618d3cc36f5c6
MD5 c247d83faceba1433ed9359aa8368e9f
SHA1 31a06b77949d86c4683342b14e117e47510ec98d
SHA512 0d21cc496e513602750ec0e4928a6e6d8e1cf71e7fe56390dcd5b5e99dd6b060cd8260fd1fc3a938f44fffd360db9b2b88cfe7f2ed879a165395e6a17f7afe22
SSDEEP 12288:FQXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:FefhOB95Dr47iJ0nQZo2vI3
TLSH
T1EA7523886ECD5DA7F373C7F96F9B4B42C85D3E98A4C10653AE00E22DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6e3e091d3e5b222a31d87c167386594ea4df111c93e5e27a21385c9a56391142
MD5 9cd12f3bf045cfc798cb9695e85f1e0a
SHA1 a171b34a61ae9e3ac9de911d73156e6b6816928a
SHA512 e37573f12a6d3b43d50a189c1cef4fec8b04beb326c0dbd971aa4948ea43ae1af91ff84a7f697dddc77e63a9f8d86e449d4dbda0ffbce2c7fb10dd8ee2b06235
SSDEEP 12288:cyPz5L8ZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:FzyJfhOB95Dr47iJ0nQZo2vI3
TLSH
T1ED85124777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 8b25dc0a6cb6554a339828593cbc3493889063b5343edd008c448435281f70a4
MD5 c6a39e5dd7af2409f284596bf4c32e18
SHA1 618d864751af48f9ec2c191b76300cdb7d996e38
SHA512 ea0cd8070451b4841f54e6a260bf8519afba8cec78a0c25bf3465cd1528d4c0d63ca2201a3a8cc6edfd2fcd44ee76e59598e5660bbb88585758d3ade60c5e6be
SSDEEP 12288:x0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xafhOB95Dr47iJ0nQZo2vI3
TLSH
T19A7523886ECD5DA7F373C7F96F9B4B42C85D3DD9A4C10A53AD00A12CF63545982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 80a96c7cc750afe5a163bdfb1d2c32a62520bee7e35d705c88b60444a8321edf
MD5 e9c0a095536704efa973502343181ca9
SHA1 5836b55726961d437555039128ede2f9cab41b1d
SHA512 16b15ecaa95e299fb5100134f968ecedad1d386493aa0d436855a21250af501bacf0626abf9f142f802f9d09c497d5391bb574e634f2049ee65a36e8ad164976
SSDEEP 12288:q0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97C:qafhOB95Dr47iJ0nQZo2vI3C
TLSH
T1937523886ECD5DA7F377C7F96F9B4B42C85D3DD8A4C10A53AD00A12CF63545982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 24a6ac975e98b3172dacc963110e571e9b68dcd1f32966772abf4c3486f80659
MD5 7c2c12bd444feffcf82b71e65866c0e0
SHA1 5f23d2b0b0a1916c7f9abe5edcbf4ef82a4fd5c8
SHA512 edf6d72e7032eb028f555322db951163e43930a07e55915b006dbe3ad7fa22e0ceb47f26978ead287213e26fcb5284c4fe9689222cfd5d84c4a034d9e389cc17
SSDEEP 12288:0yPz5L8ZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97C:tzyJfhOB95Dr47iJ0nQZo2vI3C
TLSH
T18185024777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 6f0321633990da412d9df1dfb40c94189aab14dfb67bb4b41ad71ba665771001
MD5 8432c3c74c91f732599afce0616f4ebd
SHA1 77c6bb599269511c2889f705cf0d51e59699538a
SHA512 5420efd1c27689aeab9f1c9e335a3c0a7541b4b1a8450ee0af2eee0e69bd26af4b590f631de5c2ddd80928ea713f2040c30bdf072a8feec95158a6b9a93243d4
SSDEEP 24576:fTuaLl3z0zDvfhOB95Dr47iJ0nQZo2vI3:fTdLlj8hOlciSexvI
TLSH
T10E850294B3901CF9ED77827ECD568906C5B23C590760C61F07A4366A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e92001a16a765184fa5c0daebf7ddc945fb31232514f1bab9172b974a67a381e
MD5 f8e17ab9512cc701705443f7dc84095a
SHA1 c69c3d4c35162d915d176060519f13e161f4220b
SHA512 1a885dad0ac704479678ecaa4201001a6202a4dd1cd0c20c1480c3cb62f00b49622868020bb2026b8a3bc89cd9218c3e679d20c846113c7aae66189e9e17067f
SSDEEP 24576:k3xd9CHKy7GZ7fhOB95Dr47iJ0nQZo2vI3:uxd9CHKya1hOlciSexvI
TLSH
T18795CF90F3E814E9F1B7CA358D764502CAB67C995B61CE8F0394661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 355e0b61fb73074ae105e3cdebd30feaaa8caea652cf3b099ae6b96f8f07349f
MD5 73b462b2ead1e38c3741a4c8200852b5
SHA1 db26615c0baf0a7a0d9eaee43206cf1b2c0ff5af
SHA512 05f011100c027bf0927b387b53d3d6e79f8a21e5d97b8ff6066cc584ebb73dc43b25bf3570e1e1ccbeca2ccd75b6da02faadf312c04cbe923701c412289debe1
SSDEEP 12288:HfXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:HffhOB95Dr47iJ0nQZo2vI3
TLSH
T12A752388AECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AD00A12CF53545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 4e2248e567d5fd987f116a1f4d2bbf7375941134c97f6f7fe6aa42a6fbc3d197
MD5 248aa01c0f9fcdd2095bb6efbfeb3944
SHA1 37602dd5cbe6a4f87e73b4e2f6ddc1adecbdaaac
SHA512 3510378ed63d255fbea4be038c4037d1805ce4a93eff0e9392e060cc196d60caba70a3eea6011e6419f05ba15655b46cc28dedd82dffcba90794564d78ab34b4
SSDEEP 12288:L5XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:LpfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E37523886EDC5DE7F377C7F96F9B4B02C85D3D98A4C10A53AE00A12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 20283052b7cba0a87da59b2b59e51c84a6ec93e6b6769f2f49b3afe6ccddd6b7
MD5 9b224b37ef301ba29572e551b9136b5b
SHA1 b9c21833226a7613eac588c9f29b8cd0dce7be66
SHA512 672eb4259fbe0ea5742830f99094ecea418c14ad8c98defef1baeacc8956359186d05f20126442140e497a0bca48846b9651b905161ef93b054e530ad57f79e6
SSDEEP 12288:9mXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:9kfhOB95Dr47iJ0nQZo2vI3
TLSH
T1377523886ECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AD00A12CF935859826E02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 87469aa27418735fe375eefea8626bc98583a8323b2c01845be7bd47e9085177
MD5 79554213893da2b3a1850403f3753c7b
SHA1 c493744b402747dcdf01078df101408e85e70fe8
SHA512 8f2718f1d8d12717b8f743bc013d646e58d06940c4137c27e43660b016e5dafd95e14349b39e3752f05b7db14bc48bf9a7a103d4c84eae61e37ee272a6f4beb5
SSDEEP 12288:s0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:safhOB95Dr47iJ0nQZo2vI3
TLSH
T1067523886ECD5DA7F373C7F96F9B4B42C85D3DD9A4C10A53AD00A12CF93545982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 b4af673705ca8f8fec1f960a94bbc7530f1eddddc9e2b36d2c4b553ffa2869e0
MD5 39ee179e2ac0ac76df30ae324471e572
SHA1 3c99a3fd53f9d0b7320c5fa54874b0e241104f9f
SHA512 ea52ce96ca57d3ee200a61237b432abd3d8a2669c3722e43a0e6bfc389cf742ed2bed8e972352919830914d99a0e733cbd49f63dd8e0d8351c7cfd1e736ace59
SSDEEP 12288:WfXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:WffhOB95Dr47iJ0nQZo2vI3
TLSH
T1207523886ECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AE00A12CF63545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 efc4f350753fbabdf59a2f5527c11d85afd91fb5f622d8cbe48e8054f837765d
MD5 ffa7157147c000423b25756b9cc58f5b
SHA1 290296f7f92a7551f68ef39b55dd50cc5649601b
SHA512 41f671daaf92229ba18f45929b527f89789b0ea51b3db1fb8466988a325566e3f63a251d097da789aa160a0ffe711b5ca5bfe92009e18d68849c7942a3dc1100
SSDEEP 12288:rMXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rCfhOB95Dr47iJ0nQZo2vI3
TLSH
T1867523886ECD5DA7F377C7F96F9B4B02C85D3DD8A4C20653AE00A22DF635459826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 f555b5feff11f9b3a00823b0542bcd45407e0f60f6f670e24226929b4654f53a
MD5 44f85f5269b06c87ab9f8c0572cd5996
SHA1 6738aff8a511d1589630fdb2543deff21d7ca681
SHA512 6a4c20e2ba4a5656565a0eb48d67795a3d203c27d2c98600fac0a612a429e938317023e69c787f4e3f8c7e3ad23c3e18de82d010d79eb4f4dca5a004886920ac
SSDEEP 12288:siXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:sYfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A47523886ECD5DA7F373C7F96F9B4B42C85D3DD8A4C10A53AD00A12CF53545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 34a6cd84b4a585fe4a4443b1dc13e9a89a737cae0f032a93efd39aea8c1ec3b2
MD5 701f82017fa7cc5522b661f804c128c5
SHA1 85e7d7eb606e0fca89a04fa4a04e251f5853828f
SHA512 c53dacfa38ce194097fa4af276d37aea99c7cba1b9732eb1844440316430c9b22a41afb45412696a9238e725c0c482190c4cfa83093225334fd2429fa1e84446
SSDEEP 24576:efwvOk9RX6wkyAIufhOB95Dr47iJ0nQZo2vI3:IMnYI6hOlciSexvI
TLSH
T18B95CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c6f2d058eab6bb0c312b8dbb23dde8c69ed9e79ad41f708156ef9cd76b81cdc
MD5 045c755a46e148f3ea47060a8b6b1c5d
SHA1 595eeab21d0d1dbdb2d04af0813a9bb1a4fe9921
SHA512 f89618a0be7b7d1fdf717683f988dedd004fe4e5ba97ba778d8670bc9acaef4b64cbf6cfbcfef8bbd50706eda32967fe9da8554ced267226ad846ec9c8f71b20
SSDEEP 49152:0YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rhOlciSexvI:4ySzPT8rSex
TLSH
T13E067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b77a97172d880722fcb652d02aac979017d236a6bcc71266c506c3b76aba50df
MD5 ef0dd7c9ba82c2162aa088440fe97b5c
SHA1 230bf2e2f30c3c1c7ff9a5759353e403704a605c
SHA512 4f7ebc3d6427153ac2a397a21b0f91716688f7fdcbd8c88efd140b9c2ee55c6a2633e7bc172f71811dfb872c5a2f6a3ada6f6ccbc169ec758462fa919b2379b2
SSDEEP 24576:747Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYVfhOB95Dr47iJ0nQZo2vI3:747JUQjairIhCnDHUPfF/7hOlciSexvI
TLSH
T16865AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 40af8445026a225281821c44741612d05c44b4099b939ad88006e3eba0f5adfd
MD5 2aa75eb7e2a55c5bf9c632afabf85c4a
SHA1 09efa9dff1df25a28718719eb782e903ede5f44b
SHA512 f576fc258f9f3387efe6cf5109fd58e07e06925dfda8fd5bf7bcc2b463e1d0f22e3d8821b96acfcdb8356964280a0f7838bce648923b9a0c87b69cb6cf460ad0
SSDEEP 12288:gksfkXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qKfhOB95Dr47iJ0nQZo2vI3
TLSH
T175750149D29802E9D16E92B9CB564A01F3373C6493E1D3CB67C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a90a544628a1656e787170442301eaa133ab6360c284e96ab330f34b75d8e1c2
MD5 57ddb2ec06d67e90a7ef55c3cfe02a35
SHA1 82c94fddfaebb264baef93a64092d015d6c9d2de
SHA512 468fe4dfb88d10954184c167a759694b685d9fc547472c826987808ae65a6028a5784595a8cc706d5b684268a3b2ed0d72852dd214ddd9d09f632c28063201ad
SSDEEP 12288:xSCtU3fwrrwjIWGOnWAih2744wSJc8aRMNQ96:xSWUPorqIWGOnWAT44w78aRMNz
TLSH
T18E3507007666DB4FC6A940321E33D1CCAB707D41EE446F0373C99B3F9576A59BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 fdd513ffeb28effab8c926be1d6c4321875fa720190e7544df573938dfb8e837
MD5 423a6beda21f6140358955b3d0af72c1
SHA1 148ba53b024f67740734714fd42b29a1a15b6dbf
SHA512 9817c6aae8e23772b8b9c4b4bf0d0b7783ba0e3f55f6e966e8094e21b6244cd1a7bb332eaa87ea6b16d836fb2b178cf7f37eb9340f2025a399c0c93087000a2f
SSDEEP 6144:dzk1+JoRoaxLHHKAAsHa1xB2sN1+N1+P4HVATq+iRFaauOHxIJa9DDPJaZoDPJa+:aLHHKA+2KJaJDPJamDPJazSSdV0
TLSH
T13445A5805437A68FD1BB2032072B5F4CA7A4DC16B7496F26B389553ED82AB11B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b809d1cb64d75002774c82f74f85886a410ef92e300e1828b7cfc0a6e21c1276
MD5 c3e627801b6d91d9a072404682adabd9
SHA1 b34da6106e93d1ad0b34fadf23e460477cbd1370
SHA512 a274fd3a7bdbde332abbca405f637c1cd3b9646221300ca3c7178d687d534c811e6b38a317f092936bb892dbb98ddb1b18c86328f0815a7dae3120437c7b5c45
SSDEEP 12288:sz78XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ayfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EF752344ABCC5D96F3B6C7F46E9F8712C41E3DA89B8045C3ED00A26DF5318D58ABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bb49f6f2a9f13ea41881c1e0e2ddd3e8ccf4fbe8d2bd7c3a147dcdb74368d4e8
MD5 209bf3c6f78d7d2fa191cb80ed2fa540
SHA1 0c5e01d67bc21d39ebd82d8cd4d149c42e7480ae
SHA512 33abae8bcb3b0caf37ff24a475d93d63cfb6826f63a9ea8ed2621d2fdafd2a8cff1196fff066116990070fb99f992340c6b1ed2f43f3d0762012430c5c85202b
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bY8fhOB95Dr47iJ0nQZo2vI3:Ugb4mBIBhGFJhOlciSexvI
TLSH
T17365AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0cac543300524e1277004d5938d08b778bc641ae14f89757028dadf765fa1135
MD5 560be3c2ab64983146e83348bfa8fce7
SHA1 16d16f73006ebe93816040f4a8f0383ae548fdf9
SHA512 b53f353899a5c2460a1be95ced0c7b1baab14c6671953875b93661372b9e1917044b7560fdfa13eb3ffc92bacbdbcf1488d505cf0863207589cbe9806014711d
SSDEEP 24576:XG88u8FpJqH1nzria7/mFfhOB95Dr47iJ0nQZo2vI3:W7ZFPqV6a7/UhOlciSexvI
TLSH
T1FBA5F16577E401F1D077D1388A864663F6B2B8250360EFDF0B988B551F23AE54B7EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4d1bc38316e200d2730720d86b7c0aa44887f21d058b3e4ad602d17465394c27
MD5 65e0f3f3c20dedc038aa37707a5560cc
SHA1 d8581a9ecfee71b6ff9adec52a73fbaef3b14657
SHA512 c6ccd014a59cbde4335aa6e544685e8111901478e1738e2ca8f012ccd81ed13e39cebabbd81791467226f14010c3827c973a2d6a81196496015e9efbff25fbf6
SSDEEP 12288:oHvUrBFrEjwaQhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:oPUr+NQBfhOB95Dr47iJ0nQZo2vI3
TLSH
T1CA85E11E66EC1CE5F676E17D8A868709E7717862131292CF0290817E5F33DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 00ecc1063f2f424218594ac0b3b5156026204888fc554033bdfd11cedeb9abbb
MD5 24c54946a3702d83c40afecfeaccb859
SHA1 41d24db3488e70da8f9bb8f0ad88a2a57679c7cb
SHA512 9f9d8e548dac222aa9fc294db759c150c34ee5a5a9efde1d1b38d79c72047a5bc7f71a4dd21222d419100ba065158d999e347f5111d38b522c7d40439190f358
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlhOlciSexvI:NG05lO43by8rSex
TLSH
T169D5C06E62EC11F9D1BBC17CDAC64A0BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dcd6bdaaeb9201f946136347e881aaa1e7bd8143144b74a3c55c09ac76ed7353
MD5 9bc79dbb0d8efaf31b447e0e5fee19fe
SHA1 8e2bf15e3f01633a930df1ccf97dfce82d081668
SHA512 0d979f6b6a068d43ec4adba5f3b3af8845ea38abadc6a77ace169b4bddfc0a3ae7a4a023d206225a5b1bf748df98664b1c76a63de87d251f3841d182802757b1
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnjfhOB95Dr47iJ0nQZo2vI3:8a5POZ3hJt2pasx2+mNhOlciSexvI
TLSH
T17B65BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ba217ee48f2b916b6ba0480785112e54901be3a77ce3f64f744453f847f08f7
MD5 d96ace84292e5ff350530eed66c7ca0c
SHA1 33d83153b2c300957217408e996f8f5c07e9e778
SHA512 ef7bd361cdfc94f54e8be08e58682b02284545945ce77a9c75a67e5ff62b6fdee22595c1692a679b00c649a149d85e28233c0f5966e69831f4e0caf232efdc9e
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7Fk9fhOB95Dr47iJ0nQZo2vI3:uNc/zEOVHF0hOlciSexvI
TLSH
T173857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94420bc7820179e891689158b2879c30daf80f91e4a4e9628fb21dddd0720856
MD5 4ea85e3a5ba94a13ea3653d7c8b72801
SHA1 f64cead0a9530365fb76b8f8049cf042d18b6c83
SHA512 1f1e37850279090a0580a72827a7235b348aafca7e2514e5144bcf6b03a6fd1fe74cc03c0da75cede37724687c6ac9f6282c5384131cd8d0b6cc5e5d00f3cacf
SSDEEP 24576:13kNvNnaFeYhJNtmZBmofhOB95Dr47iJ0nQZo2vI3:13MwBtOmIhOlciSexvI
TLSH
T1E155AF6EBAF806E4D1FEC6B4CE238512E6727861073253CB5290C13E5E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 be49c7f5c54182124b0497f73b1e42f670bdec5a4537ca752b0b9bafd88f3186
MD5 2b95fd9b6057cce62102a024206a3b6d
SHA1 9c5d51b3fe15338771a7507f5a7f8649fb78a3ac
SHA512 3f6c7b0b344bdeada031ec8661a418b9f912aee1a07de8a944224b304aeb2dedbbb5d17c1e8a230c86e6cba6e29b0ede4de7c9a9e785af2d96b007f5740c3fca
SSDEEP 24576:7D3FHshBIYQgAmfhOB95Dr47iJ0nQZo2vI3:7DVHeBIAAChOlciSexvI
TLSH
T13795E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-24-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1408-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1408-18-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1408-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1760-0-0x0000000000400000-0x000000000070E000-memory.dmp

Download

memory/1760-16-0x0000000000400000-0x000000000070E000-memory.dmp

Download

memory/1760-6-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/1760-1-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2236-309-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/2236-76-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2236-70-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2236-68-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/3300-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3300-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3300-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3300-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3300-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3944-80-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3944-311-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3944-86-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/3944-81-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/4540-55-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4540-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4540-42-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4540-46-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4540-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4644-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4644-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-331-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4644-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4644-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4792-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-315-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4792-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-103-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4792-109-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4792-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4996-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4996-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4996-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4996-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5172-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5172-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5172-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5172-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5172-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5424-286-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5424-57-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/5424-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5424-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5860-116-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/5860-123-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5860-117-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5860-314-0x0000000140000000-0x000000014031D000-memory.dmp

Download