3b21289bd060008a2b5547a8c6dc154c115fb36bf5ad695e7591581507feb31d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
Size 4.2MB
Sample261113-fl152ags9p
SHA256 3b21289bd060008a2b5547a8c6dc154c115fb36bf5ad695e7591581507feb31d
MD5 3c76436f37fd98901c91b8f747158ae3
SHA1 35e5e3f4e1726b85e91fd4dcb06209deddd28bd3
SHA512 b36c0297ba29ee4d96e4ba543d254d3b258a67014bfd2af263c632c20ac936e98fd4a3f09a8b4155efed4b9dc61cc6717c2b2f1615bad746cf124af46bc47562
SSDEEP 98304:/rMoeShauAq78koYhxaCuQ/wr3fE4yqIF44sv3fE4yq:woeKo6alCwrc4Ja44svc4J
TLSH
T13316F122FB41C5B3E49316B04139DB7F8939AE20672585D7E7D03DAA88312C26B3F756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
8	elevation_service.exe
3404	elevation_service.exe
4704	maintenanceservice.exe
2800	OSE.EXE
1012	PerceptionSimulationService.exe
3300	ReFsDedupSvc.exe
2612	SensorDataService.exe
3044	ssh-agent.exe
2284	AgentService.exe
2424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\31a2c8a59600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b5618ac2b73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a1ec1ef2b73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d5f01f02b73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000828cacab2b73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9ca56ab2b73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006232fff02b73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000246f6aab2b73dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5888	2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
Token: SeTakeOwnershipPrivilege	8	elevation_service.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3300	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2284	AgentService.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	8	elevation_service.exe
Token: SeDebugPrivilege	3404	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5156	2424	SearchIndexer.exe	99
PID 2424 wrote to memory of 4860	2424	SearchIndexer.exe	100
PID 2424 wrote to memory of 2860	2424	SearchIndexer.exe	101
PID 2424 wrote to memory of 5348	2424	SearchIndexer.exe	102
PID 2424 wrote to memory of 2000	2424	SearchIndexer.exe	104
PID 2424 wrote to memory of 3008	2424	SearchIndexer.exe	105
PID 2424 wrote to memory of 5328	2424	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_3c76436f37fd98901c91b8f747158ae3_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_lynx_njrat_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ae8aecb3a3d28b9e0ed6533ee9f75c2bda771612d6cfc9050409b91751d948ed
MD5 5b5d3ec1dc89c51db713e0761add7e18
SHA1 67c284429a48eaffb89c8ddfa47a5d57ab747f08
SHA512 c0f0016377caacfb386efd6359349c5accccdb91acbadbd6ad0825a1f303d12248d8fb2a5dc4badede3f48da91c2e34b452eb358c05a0403aacfacd57a677b19
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn73fezEdyxw:+3q6HjBi3fE4yq
TLSH
T11CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7ee096d07dfca44436dd230a4a8b500ddc110fdb4b9e1b5bd9d10b5caeb5a5af
MD5 0da4133878c2fcf601490451a9fddf16
SHA1 7557a530b43944f2c4f86141982bdc2fcae919d3
SHA512 4e146e01e148c8845a336a817794607f9ccba12e3e46a0ad95a76ad023d6c64ba7c815497e31b1d79f0c29e2e313b1e033bcf03460afa64ef31a53f409c43540
SSDEEP 12288:n1XLsswWkxy2lRq2czAGxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:1XYfDtczAGzXJFfezVJMBIUXO9xw
TLSH
T1E185F128A3A408FADC67817DCDA28515EA337C5547A4E7DF03E4992A0F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 954c5faa4761770e42e3f2bb30f2c887872beddf93bca7a96251e48cc031a3c2
MD5 97943a84957c37606ae7a774addc4477
SHA1 16923c9ca2922ac7f9492fcdfff067fb1f2ff367
SHA512 e3b15d8ea15f25305bc874522529ebbb3832098e54f040c77484c6e5da27ea95544c27e6eae9a3b84d90c57334fd15526e49f9cd37fd5375d74b7280187ef14a
SSDEEP 24576:50Le5ji0hmxirMQzXJFfezVJMBIUXO9xw:5Pji0Acb3fezEdyxw
TLSH
T134A59E26F6748735D073C0B9C5D2A69EED7130865B308ACB4286D77C2E276E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc11d2fc432f54c29894e1b1177116be3539f8fb27e4e8ef44b5f9ad90404674
MD5 bc5403dfc748dd74285c8aa29407d79e
SHA1 32a0d050dfef693193e75e330d3e0ed29dc20e51
SHA512 9b3da49cf424f0f642fbba4fee680e598ca98061188efdb4c4e1c2a759594b2b8765d364c4ee13754534510515cf64d615005e68dacde361f3b2cd5e02ff861e
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyuuzXJFfezVJMBIUXO9xw:l/ezSC6vUzPvxHjyX3fezEdyxw
TLSH
T188755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0e5a1c90e8ab4c03869628267effe68a78858deedd5e479229739e6561fb201c
MD5 b1a4ae5e0e7811d1d19a4cf89b2eabf4
SHA1 2c89db3fedfd3e831415383b84a400c9d8bfac14
SHA512 f7ba4f70906d0531b144156177bec96b30aee7fbe69ef5591f19434d12ccb7695cf0e4369be1d1cb73fe8afff31375fea11938b3f5a9b5fc59a0acb2d7746f06
SSDEEP 24576:IVbqPb88hv/l+6dzXJFfezVJMBIUXO9xw:IVO88hXl+83fezEdyxw
TLSH
T160559E66F5748331D073C0BAC5D2AA9EEE3234425B318ACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 966fe249c41a0216f2f882d24f3999624faa052dde46147092ccb671380a4f7c
MD5 c5cd5f629e4bee0ac5462151e477d513
SHA1 f9f3e82019d516958fbda843d0a6d8e1d9acc303
SHA512 c4bcc5227bd4b4efa9d9d345c796bd8570c629b41f26cde675203e689553b326c67385a53ce1430fa414e0c066a87093f4294dd01df93fd05b0fbf48e21d39ef
SSDEEP 12288:jRExFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:jREzXJFfezVJMBIUXO9xw
TLSH
T12265232A8238CDF7C0FA09B64F79979CDA296D74A4FC1DDF19D97A1E003A049C53462B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 46db5e5b0c3c236da81532c4e8886a88e0f9d89ff7c04a0d6d30bb0c8f988104
MD5 3a572a1a40b129ba3848b0cb82fefd08
SHA1 b66fdbfa18b0bc9a6d061b10da50dd0f899882c5
SHA512 142b0d5f2eb3ddeac3d2ddf11ea9b878aa9cf52968b14ad2a035416084826f583413583cf92fab10b3d02f3c7ee979f7ba4978fa03fd326c4dc3df0ff630d0cb
SSDEEP 12288:HeBNUbTVO86UVxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:HJIUVzXJFfezVJMBIUXO9xw
TLSH
T15A85CF3BEE38FCE2C27A4DB95B918740D77278304B61A3CBD165820E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4234b23380560c940399cd2b31fd568c90c24a36e5ffeb7a8b454085ee2ff094
MD5 2d68d42e0ea85a2a8bb989aa902c39e6
SHA1 80e2077922a735e48a67e48c22d30280210de185
SHA512 ef2028e674c9e5c98645d3160ff4310ce7e14fda4129921b5b2bbd1d001da67992b5b189285da297a522157b8a9e06faa1601c2f1c5f606f405ca0854ba0d8e2
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:mQvGAdlCEL8c/yRNw5Ce3fE4yq
TLSH
T1E0266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3d938e57eb625a07de74b19b7c070b7c3de6f0fcf473ae6f2d4257812639be04
MD5 4a97023571c5c7f7a32c1e99d1cc9ee4
SHA1 f9689bc8ef8f05181edde4957c27a69b869ec07b
SHA512 2cbf885441aa8c3596b6cf8338ff1dbdeb177e9e8f9cd2704dd17c82e6c7d1b89668f8824edcf3449628c0ff23dc14baab7aad7a9f3ec1e38cebb19e714fb6fa
SSDEEP 12288:gAwSfxL/2Dc34DLLmt0LDQewsAjLxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkrW:1dewsAjLzXJFfezVJMBIUXO9xw
TLSH
T18095E031FA74D436C2BF0DB61B36C71A583D79204BA119C3E3E89E9E59301D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6e1780e60fbd8958eb603901117597b2b98c373785bf9bea54cfceea9dc201b2
MD5 2849f9ce8fce21045746e91e08e57165
SHA1 73a9a4802a7fe4bb18efcc81023a2ddc460705d9
SHA512 19e88d92e7fbf8b3cfcd7e7635943a53173ac7a6fbb216a3247f5c3ea088a16924b3f54fbca0b17c965099dc6463e45976083662d06bfa7839ad48262e00a3a4
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzc4J:DUEtQevvqc2W1cpV2EI32f
TLSH
T1AB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5eeaea717e80e9a4b30d985757a666a2fcfee9cc401fc418b6861a88110b1a50
MD5 66c11bac28b712bcbc8e9dd18a6668be
SHA1 2775df7f2a72aaa9ac8286513ab7856e03343240
SHA512 dca9385436ef29a0da0e300db358277293f2114b8ebf71a0020f7fc2730c6c235d1f76677c9c4f0ad2bbcf3422ef505f18b80ef027dbfe0ab047c87fe160dc50
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zr3fezEdyxw:moqtVjnmq3fE4yq
TLSH
T195D58E0976B8C2E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 401a347e7d41ef0f4934e80252d8b7d50948b99eae3756d3d3379a2ab71f0de1
MD5 6456e56a8047af1e31898c5d97a64408
SHA1 4db22a0f626382940effb6ed69dfe49070b8bcc3
SHA512 b5fed58d3bcdccb2c6c0ae00e720aec3284070f4a0a1fba3b48347ffd78abe8ed852b3eda39a10239c81c78480ed6bfab10c536f2f2a96ba788e0208971dc207
SSDEEP 24576:WAhGLJIFoiwtA5l7S53KzXJFfezVJMBIUXO9xw:WAMyFoiq5a3fezEdyxw
TLSH
T15F359D81E7F955D4F5F3AAB899B69170EA76BCA95E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 9fae4172af377671a41f3ff22002d18fd3f8e04870b8877d98cb77a0a2ea16b4
MD5 04b3e989adf1081326af72f72a8943fc
SHA1 f5a56a88143c353a32e8b85d128fe54c1f802ac8
SHA512 2ccba817cc374c1355ba0c07266a31f742fd2d823c2f3ba729c28f3845d911022e764429156b47943d7ef49803b2be1051653a4d1e9bc242ec7c4b6c6231b979
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+C1xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:MwuoOWgzXJFfezVJMBIUXO9xw
TLSH
T12885F14A63A40CFAE4B745398A57C136F7B2BC112A75CB1F17A0C61B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e547ae9a093feaf45989ace5a399e870c149deeff1eff4ba3869c9b47d2f81d0
MD5 11af3c7ff78c9390f0d2af32a54ddaff
SHA1 05c566e023fe5300d02bde3a134005f978e54121
SHA512 a3156e0b9c82509bf0d4c48aad4f2e9ed24733f75b221028baf71189caa27176e873529f78d1057151f347455f5609f41568903ca9e971e787e898cdd1f5325f
SSDEEP 12288:kBZ1Iy7xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:CZuozXJFfezVJMBIUXO9xw
TLSH
T19E75126A23B465FAD0F701798EF54748D772786663B903CF16A4422A1F33AC58E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4e4c05ee7de673995b58ee2132b24c1eb2cd010ea0cb794386780f208bfce39
MD5 0077a32b84d13bf23b18b81f0504f84f
SHA1 9f4ed56f2e6f8bb0f4d94dcbd8d746501a9dfead
SHA512 acec9e8b0808fda90f0242cb7f95bfbecf625ae25c2a4850f59f66d3a1447ebe1f6411f5e3b5e9025b6778105151b57e13d94d8a57f95001e65d5b82887053fa
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:bQRQyi36YOcPQLvw2gAf+PN3h3fE4yq
TLSH
T114667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c342cceeef749dbe71637243f2ab2d696617569d4f1fbbe5b04a07df95a550ed
MD5 b0b94bb95b956ac55679fc2e0ea634b1
SHA1 de75a284c5781b4f2f34363a6a7d61fed18d1801
SHA512 b2892f75a49756382fe59475b0ff648164c7cb8902ec33754e4fa690e90e2502eaf00086dc6ab22f8b140a466c1fe0f3c7f63fdd72e469970c59449c070d152b
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:SQRQyi36YOcPQLvw2gAf+PN3h3fE4yq
TLSH
T192667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c4b7323eafcdba4fdcfa77f87856a375494df485cd2cba6982252b1fc7d5d43a
MD5 c2f3e25c03ed14f61d5dbaef1189961d
SHA1 eba2ef19b042cee95f36294e3ae3c617f32d61e3
SHA512 046889915383e8f0f079c91521555d23a0c832bbbcabaab1df618742588c5d948d8852f8aa670bb0f591312d81c2e03bae05f2e1c2048471e56c62b7d3915be6
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04zXJFfezVJMBIU5:E68Qg55nhheWu7PNU3/b3fezEdyxw
TLSH
T105B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c47ee12af11da28e03841034f0351da060f3107d4ad3b62f93f865c3be2fcbcd
MD5 e2ae8f4f28539ed8d1fda9eb31abcfa2
SHA1 e6ad11ec63095a5918ed28b4e5e5c1465a0a8a4d
SHA512 54f75904197af50849f20a5460d71256d43231b62f428555161630b62a455e8d7425877ca86274695d6d86dca09fc8f40bc03a0618d2fdb6cb4eeb929f2163a6
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:3y5112gYy5azzVvL69nLKnhZE3fE4yq
TLSH
T18B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c27549b9cc6e8e6bc1bd9fa35a60c67ebd8ee00b89ab535aafb22e1cb398e63c
MD5 8e0d4ac8958255e398deed9b169b9750
SHA1 216f4e2e95f58a92ed72e710a52a0e44a0a1a0b1
SHA512 be0822f7a403d9f6240cf366e3edb4b58f846d6168204f257c3fb1a2e350fd4ca92e7129f448f9f6880bfabfe7c60a0ec549e10336511153e0217504d13de814
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glW3fezEdyxw:/u6JmVxd2dW3fE4yq
TLSH
T1DFD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cbf4ad80b69b5750e7b0d7ead44e506fc2915ed50d102f22a13477151361de56
MD5 82e4b5e0c8ef8e8b4b7b3879d8eaed32
SHA1 0814e4ee38978ad30e286c267de786abf0a8a0e4
SHA512 c2ff498c450f32d28dd7b33eca7893ce5042bea41276e4108cfb7896b9f61c872f105dac917d58a4711bfab9436f88dc6ea5c4b33f9b8999027f57f44fc8bdfc
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x13fezEdyxw:nmifPbRq3fE4yq
TLSH
T19FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 38ccc18e4effb2b4b8e4f820ee36ad166127298a390ea005963d80d73edcbc2b
MD5 b8ff0ce96a67611a7f79aa1cf56fb75b
SHA1 43771eeb6f24db2c0c822935d8c9289275a7ba51
SHA512 c30949472cb5949fccce67185cf552ce281866bce735d10259f0524b2d53c839f632058a40d44657a296c81b9b1975db56440449e237048e9f3e2ae66946bc62
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqo3fezEdyxw:75dKTi61o3fE4yq
TLSH
T1FEC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 730121cffa02a7d996975123ba71c04b86160b470a490e85f7793df7604bb317
MD5 6fa7358ab5bb14ac694a25c041ce178f
SHA1 201e61b01d3bb83927a10e5fd2f0e0e987af17ba
SHA512 4e0eac7eadc2af8b0313e40588ad6713b3d2bf6f93b3b4506f7327daf53610172015502746beb8cae45f314c5736d93b1642efc033f5726faf05b9827f83fc3a
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wJ3fezEdyxw:0X2iyphG3fE4yq
TLSH
T14495BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f185d06f28abd373aacdeab76d39bd7de943fd461d8f3e48205b876c74a3f071
MD5 c377b7d6812db8a677e44cfd4eb66ed6
SHA1 a676dba1872784d3061e0f26ecb1fb9d4853970f
SHA512 933294a4905f797cf8f9b13fc5638f0823c965196f46bee34c9072b7e1649a9551358c6a6a29a3a6fe3269e2dd9dba697a58b3893b23a4fd1d3d701b238ab756
SSDEEP 12288:p8xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:p8zXJFfezVJMBIUXO9xw
TLSH
T1C365232D8139CEFBC0FA09F68F79439CDA192D78F4F908EF29D9651A0136059C534A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 48ce4c1334d1ea870bf9343d36816a65f2941c47ff0d7bd9d9d902a4f2750b6a
MD5 27c14166970718fd9ddee752d2697448
SHA1 2127c022deca32acbc4c4aca752a35cd41cf3887
SHA512 7793a8a2ffffaf521456d7117e543264ffcf855bd4c7bcc6e3b21d6d6db8d0275aaaa3ef313c8a4e4fadc1efffe98cdf2dc304d5ab9e9bac85b929a5c95ec79b
SSDEEP 12288:p/xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:p/zXJFfezVJMBIUXO9xw
TLSH
T11E65232D81398EFBC0FA09F64F39439CCA196D79F4F908EF29D9651B0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 3fa7a5e60d06828fa18afc9d86c68b54a41c511b5ce07986218451a4c02efa70
MD5 c051527c41a5c689e0b628f83505aed1
SHA1 05e2bb95535552771c04b8b8ef78e0f25a583c53
SHA512 f19ca065be4a0873cf0a9680949acf41d847fcaa6c8a1add3da83a8b5e40a6c0261b6815d5c75e2858ef9902a382ee99cfe65923fb731e14e646eeb8e31fce25
SSDEEP 12288:TtxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:TtzXJFfezVJMBIUXO9xw
TLSH
T1F065232D8139CEFBC0FA09F64F39439CC9296D79F4F908EF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 dfeda7fe0446c2bfd5f99875a23bfe682ae976d0add95f4f6b42cedbde87e85e
MD5 d44a9aa6d068ad9f653f56b176cbc1d5
SHA1 52b49f98e8bb60971a15b9e2577e2a1729631423
SHA512 e8c1680eca0e651c5db1c2cdfcab3372fe9ab73ffd029b83e241e819939716186036e59762288c7885d8337667cc0e6351177cb61654e66ef8822c35bb09a6b5
SSDEEP 12288:qVqxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:PzXJFfezVJMBIUXO9xw
TLSH
T140752329833889E7C0F645B6CF76835CDA797CB4E4B91ADF1A84191F0A32294C934B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 39b2dfe5b1e093f5c214768338b88d9b35be447beee8f5ddde1c56987517e9be
MD5 cad1c5a6d1c2b88b7dbed4292e8bf5d2
SHA1 53b6e19393602f50e194bfcbabe45e04668a3dc9
SHA512 9258c803042ce9c2fd217f9304e63fc45923981d053a82767647d7a12978ea3de45881a689d5aaacdde6d238d48be5d754e8679c7ee7fcc60d053b8f4c7ea0b9
SSDEEP 12288:LyxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:LyzXJFfezVJMBIUXO9xw
TLSH
T15665232D81398EFBC0FA09F64F39439CDD292D79F4F908EF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 a27e78704da06b046b06ccc84ae49126983e88315440643ab5bc0cd5547aad53
MD5 af06868d1334d1cf70588d34c66c407c
SHA1 9f062d0f0dcc75282cda270c0f833d02ccb4f4da
SHA512 2530cb8ab0170fba717a13655062312989f6adb7f2b8c2f64e8079192ad1335cb6e431a2ab8edf9bdfca018068c9af19138acf07c5fc252cea9c8c4e5ddb712d
SSDEEP 12288:yjxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:yjzXJFfezVJMBIUXO9xw
TLSH
T13965232D81388EFBC0FA09F64F39439CCA196D79F4F909EF29D9651B0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 aa7eace45f7e5aa7630e6a4746b820f23e3baed0e65cb003aebc1fcd3e6a854a
MD5 8d83f061d9ff5d8302cc3f11b3020b50
SHA1 fc65a1b321dd7e425b0f6c505795822718e058ff
SHA512 de9b94414c3cc6c8ce322b7b911d25232cb81467d77fd378b16471fab23b020bd3c9cf5c19e17d66802aa3992c35752100c4b273726d331214895d49d4060d95
SSDEEP 12288:yHxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:yHzXJFfezVJMBIUXO9xw
TLSH
T1A965232DC1398EFBC0FA09F64F39439CCA192D79F4FD09DF29D9A51A0236059C524A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 645fd1d367e3d8e287cbbc3972ed109862b11bf728d084ef62e308ea94e0106a
MD5 c17b91aabcf155aec6eb2c913c656b48
SHA1 f998f619994d52cfd7859e98297785c416abc18a
SHA512 a00ec13c365276abaa65ea80d47531a60a37d9b41c8228efc85eb124602101f4ac495b16c5ef9cdd812d0309deb7cd45f5b2bf033876cb653f3e90f6f3062da5
SSDEEP 12288:eiZwb6zzFEoS2cPvyfxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:BZMSzFVSOfzXJFfezVJMBIUXO9xw
TLSH
T1AF85F1A9B3600CF9DCA7417EC9258905D6B27C6946B0C65F13E4362B1F333A14D3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7d7396ce7ec64dfc30939da37bdb45cf24afa2096971a3ed750d5150d19487a4
MD5 c6d43eb0c587269759d7428d83a9c195
SHA1 f41f3f9d832f587e351c40c37d8b97df9f13f6f6
SHA512 5f10b5b03415790ceeaccbbea0d79ddc7517fd69a07978b0672738d4ccd854aa8e8b263cc2e8ed0f651e88a6ed1fffe8412514cfe9ee0b8124c29d2e580e6143
SSDEEP 12288:aYxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:aYzXJFfezVJMBIUXO9xw
TLSH
T16C65232D81388EFBC0FA09F64F39439CCE296D79F4F909DF29DD651A0136059C624A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 2c341f4e4b93046b1ebf5f5bca4ea5b57d5733c08dffba4b8c4c56c6fea09ed1
MD5 1a5dec6ce9e1821ab011135a51518500
SHA1 873cd03cf95737b61a0c1f1315365abae120a90f
SHA512 45904cab2fa0bba8a110faf4a06acb46c0b63a7d83e38ed6e132a6e8cc3cb52f9c16f7bde9c9604d461376bbe7070f58477cb2dd58f9156b142cd8c0b95525d8
SSDEEP 12288:50xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:50zXJFfezVJMBIUXO9xw
TLSH
T14565232D81388EFBC0FA09F64F39439CCE296D79F4F905DF29DD661A0236059C524A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 be4f59a82a531a50b6f3e81a0621d1fcd0a3faf979280e8fb60dd835ceb02255
MD5 e211753942a89ae8500f5ffefe677511
SHA1 774b3304fc68d79f89cf6f34fc6ec4bcde8670f4
SHA512 a7e6fbf8946cb6d7d8837e2d3915eb411bece5aa9edb0070f8abd301648e25a5fa152cd0ce45469fd15e278dd2c549e06fbe7e7ac2c893031f90ed61c486ef1d
SSDEEP 12288:0yPz5L87xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:tzy7zXJFfezVJMBIUXO9xw
TLSH
T12075021B637520FAC0B742798A620A05F776BC3657744AEF17A4073B1E372909E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 021310172134ed55bbe9172722d2dcdac86ce8cc6b2b3515a24ca336ad8bf7cc
MD5 f0791a43994f4c65848c64ce90e9aeb5
SHA1 f6adbd358ccfe99b8180d789fc6ae0f5e49c4e1d
SHA512 38c582dcd6dc1886bd7f784c5f28868620167fd5b18d793c997da3431f397afde2898f8c89712597d069d9c91400736d6b6e7514a0c307f967dbfeec135346a3
SSDEEP 12288:pYxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:pYzXJFfezVJMBIUXO9xw
TLSH
T15C65232D81388EFBC0FA09F64F39439CCD296D79F4F909DF29D9651A0236059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 f56ae080e22a53995e86af48ea6f49c11a3dccb573f5fb89e06781dcecc7a14c
MD5 c604cc04dbcd38699b7799c7a2167098
SHA1 98d6048bab257e2fd9df437174c1bfc56deb5caa
SHA512 3b2386b757c18bb3bd73a9dccfd24f239b31971ae25d3f473978302a783380359b256c46296b3b349d151e953d39c6c1fce7b88813505b4770e72c21830ecb2a
SSDEEP 12288:zYxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:zYzXJFfezVJMBIUXO9xw
TLSH
T17B65232D81388EFBC0FA09F64F39439CCE286D79F4F919DF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 4db591f5f0a177d115a84ff4294c2af4e0d81ae978205c660b51ae2ff021fe7c
MD5 aec6dc46c8df7da559d043c126199825
SHA1 4c312c75a3264e849e20ad6a2cbc28e76bc0e6db
SHA512 5baf3dac173a12b2e2732aebfed8c9723720b4c313d3e4ab22b5786c7313d9afbc7f96c8b5feb608f75ad384253fe57aa7dbc9f92a16981c8c938302d8b5702a
SSDEEP 12288:eyPz5L87xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:Dzy7zXJFfezVJMBIUXO9xw
TLSH
T16075021B637520FAC0B742798E620A45F776BC3657744AEF17A4073A1E372909E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 c87727826ccf5cfa88f38eeef45a1c8d558a91a5d5fb22260552251409be6265
MD5 1e1719e8403d3fd02d2e7e3b659ceaaa
SHA1 92c7873eda75968d2eae9b10b00feb9d38f2960e
SHA512 69dd299d9c42aabb3a2512eb0cfe48342bd7d168ebd67270ce929825a00ff88d7852a92b35cb0d6afd88566fa07043d389dcfd0f177fac77e14dc8e27bddfd5f
SSDEEP 12288:BCd9eWYoaLHF3z0z04PDvh9xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:8THaLl3z0zD9zXJFfezVJMBIUXO9xw
TLSH
T11185F1A9B3604CF9DCA7417ECD258905D6B27C6946B0C65F03E8362B1F332A14D3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 72efaab2ba3d5406fcfd8175ec0276ca351fcd4d1c2189e012c54905964d4280
MD5 287d0b37ca95c27dbd0efec44ba1e5a1
SHA1 b997f2491fe1028d20404cc7855ba4f90fa0d170
SHA512 7082e4e031b37fb1ca3245b17645678ea383b8864ab13c2595969289150ad3f9140f1ce3133930e744a75e39fb12a60980b080994e836e0410c51f1125dacfbe
SSDEEP 12288:qi4e7+RdTfgwCHKy7GLbbdIv2xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7O:q37d9CHKy7GZBzXJFfezVJMBIUXO9xw
TLSH
T10495CF90F3E414E9F0B78A358D764611DAB67C695B71CE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7d57e8d7d24f697e6b7f196cbedac4ea843ea8ca6bbf265db3667cdc95fede88
MD5 c7688e9163c9a9df165a8f636c4d48f5
SHA1 fc79e75a11f1bf3b64a7ac325759a5544d4ee981
SHA512 25e4d84e02bbc0bea20c7d78c9ad7c540b966f7c2ed20ef2926610fa3a5c5b3beb22c2b83bab7eae22731323ad6ac98fe1c4d0fdadd4a7349e514739e017b6dd
SSDEEP 12288:SNxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:SNzXJFfezVJMBIUXO9xw
TLSH
T1D465232DC1398EFBC0FA09F64F39439CD9292D79F4F908EF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 f758209f955c28355c671d2d1232baf286b2eb6288bb02295414cbdb7fec3ae2
MD5 36e614e23d857efd2ffb9fb47b338f10
SHA1 50956f3dc4bf52c7e88dc32ec26c3da3bffee33b
SHA512 f06ee15acc7d8bd8024f1a413bfe5043be273281cbb8b5ce2e5539405863e4c251ed63f585a013c74501a9d0522d2d7f56f185538a31d961ad07c6ffc6a0de1b
SSDEEP 12288:vbxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:vbzXJFfezVJMBIUXO9xw
TLSH
T16265233D81388EFBC0FA09F64F79439CDA186D78F4F909EF29D9651A0236049C534A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 74ff611eccb5f3d2331b9589d72d05d84c72b33fa56d2b68c67d405a201d831c
MD5 732cb62d6ee14cb9e2bad3c2fa4f76ea
SHA1 865fc6bdc9297b861767b6c1e408d2663f6ca7bc
SHA512 706cf14728f5a1a2cb1b4d9e322be0ff1882fefe6e11f33e932b9fc835591badc385318edbe8a1755b4bcd5efb3cd8658684cbde81d0008eda3154b89bd4ecea
SSDEEP 12288:r2xFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:r2zXJFfezVJMBIUXO9xw
TLSH
T18665232D81388EFBC0FA09F64F39439CCD286D79F4F908DF29D9661A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 38a2f6d89ce76f684b0a2a0e3a50dd856b5dbd71ce1adfebe2668a489ac22cb6
MD5 526341bf842c353f80743e71d9097fa1
SHA1 6cf4af0a5fbb84fd71cad3567a2d42d72fdb7ec0
SHA512 35ee3cfdafaf912510ef03bad81fe4d9db0aaf989de51f8db02374069bd3390885b159c8f702c22d006bbec4f93764df873321dd4ddde44c3e2fa7d5531c8fcb
SSDEEP 12288:UYxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:UYzXJFfezVJMBIUXO9xw
TLSH
T10F65232D81388EFBC0FA09F64F39439CCE296D79F4F909DF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 615b66bed343f84a598ee7252fdaa055ea4dd43afa6bef50c3c5e018415d8bf9
MD5 84440d5483f53faffb1301e8649c6c36
SHA1 f7713ada723977ec411fd2dcf4209329bc97b884
SHA512 b2100c1c56cc0b428d30a8df8f3cdb07d036d8ac0eaeb3286fa242809aa0c3648c0c4860e6f86dfbea5bc286a54924fb20b1544aecd37456a0abcc870aa0dd32
SSDEEP 12288:INxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:INzXJFfezVJMBIUXO9xw
TLSH
T13065232D8139CEFBC0FA09F64F39439CD9292D79F4F908EF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 f0d6e16e340c79f823a53c3e046e1773252690031d9ea16fdd9450a62d4bcbda
MD5 48ca653e1eb7bf888f49812763bfe62a
SHA1 77b4df0acc9901b5f2a60da99023daa4393ce05c
SHA512 dbb2b8a8423f5ebf570f9dd9120b9b3604b80a32061515f268afbe852a2c5a4b0db940831e79f0ee26a31f210bad9e1772b999aa5db1cabcd24a615e468bc7d8
SSDEEP 12288:ngxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:ngzXJFfezVJMBIUXO9xw
TLSH
T1AE65232D85388EFBC0FA09F64F79439CCD1C6D78F4F909DF29D9661A0236059C524A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 2b0e1e57454fc958ded0ef9a297527ae559f33c45f212da03ed9f7d10859030e
MD5 49f2a7d1cf750d5f0fcf777404d5cb24
SHA1 06674daba16f2ff95fdb45388d1b376b9e403279
SHA512 d22c1c3292d2ab662aeab8701e334754103b75246c226b88e46435bf116e6a39cfb7e66c470497ff787f756763f72cbc66616d9298516c258b977ebc51c83afe
SSDEEP 12288:fyxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:fyzXJFfezVJMBIUXO9xw
TLSH
T1D865232D81398EFBC0FA09F64F39439CD9292D79F4F908EF29D9651A0136059C634A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 346d1e75314f5ea892c1f5ec43e1d2445d6de65fb3cc44b383aba6addba2ab47
MD5 808dcf0bceb3191b96317a17e95042ef
SHA1 e5bbe4e08ccbbd5efc0d172f16e999f9a97ccce3
SHA512 ee6c6d72c30579d2a53ebe404e39a08ef4085cfaff2ad9bd40c3cba4146a7f733e3a11429238baa1810f6557ba76af1e52d06550c83377812b98a3993656e2e7
SSDEEP 24576:gfwvok9RX6wkyAIkzXJFfezVJMBIUXO9xw:oMnYIk3fezEdyxw
TLSH
T15E95D029EBDC44E6E0B7913C89B7460AF6B178691B31C6CF029A536D0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 312bab0276f2d1b276aeebe1085b62fd5e028d495fbc97d1776d81691b36c724
MD5 cc02b91917dd04af8a5ad35c4539ac75
SHA1 fc4cec6e1ec4661548f7d0adf11bd2b102da0c35
SHA512 d27f7463740cd58b0e3de726c2406ec0d63353baa99f4d486d404b5860a68107d7a2ba515bf960afe8169a4e5f653da9d20c0dbefc876637559d653bde9fea99
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0p3fezEdyxw:5ySzPB3fE4yq
TLSH
T1A3066C96A16841D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ed29e36f65ed283d7f9251f0b3e246a39b3fd898b3ef46739e568605e0284bc1
MD5 3c37cc285e8acf1c98306f512f57a92c
SHA1 aa394744b57837d9382453797388e3005bbf70ac
SHA512 dd1b3c1053357a4120c89ab61325c99ec1f8a6999e53b4a0e2fe881a3a1ebda0e32e9c31b30dc045128620014d47c02754d875317a1a6750d7add141405a74ac
SSDEEP 24576:p47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPzXJFfezVJMBIUXO9xw:p47JUQj1irIhCnDHUPfF/Z3fezEdyxw
TLSH
T1DF65AE1DA3EC01E5E1BA927885154A5AEA71782D5F31CACF1270837D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 52bbc6343ef247c2b6d05f39edf478b7b585a9c05fba1ad0cf4dc111cba0a7af
MD5 2deca176338eb96a162a18c02d99c198
SHA1 4cef536102556706ea2dad0e3f45ea377d13d7b8
SHA512 eb8794473ccdda87dab9c9afd9cff2f287b91ad21ff1776c684953f2cafeb306fccae9ae58a71fceeadc8218f4acbc6ff0e4c13751985d53c345678910ac0592
SSDEEP 12288:sNsfoxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:dozXJFfezVJMBIUXO9xw
TLSH
T1E275F01AC26842EAC0AE617ACB664644F7377C2592F193CF16D0F53E0F366909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 346e8422b8321c04b349e620a87b163fb8e8ad74885fd83a9c08d3cc63ca9b94
MD5 3f8af04a23c2e4ddfd2d24491790aeb3
SHA1 b2088ffba2e746b11ddb9e8e95ffab2c8b73ba98
SHA512 7a91de0a0f1a6658106921f24b1aed6f93e04b6d7a4e682035526911811f24cca6585907600bdb51c45acdf874176bc1c45d57040e45b764c836c922a747fb84
SSDEEP 12288:PkQeOksU3f2TDHauV4ptExgbUswkK9POONjsOZYIGVOFMEuhh4H:PkQeORUPM4EkaPOONjsEYxsaNhg
TLSH
T1143507007626DB4FC6A950322E76D6CCAB707D01EE08AF0772C9473FD476659BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 ce32a8e5914826532be0d2a6327d3f64cd0dbf8dbee55943278415c87d1d6838
MD5 78d20973e3f727f35807777fbeed6606
SHA1 8f926bd06cca8a3ca982adaf73a08c2bf29a081d
SHA512 358f8c6da068d464478a45779903d5dc3f1e54edfdd3d5d9c9d40ce6031aa6f18ffb792f870c9a378c5084579dcd963dab0809a8a4a429b71c14f05b52decf97
SSDEEP 24576:59smBd1xGoys7JAjhZDypfwZJI6NrZ233iVjreLcHLnypv2gJ9TBc9pfbqMYZ:dDJAjh3M9+pfuMG
TLSH
T199854A016577EB4FC9BA9037133296CDBBB4AC02BB493F0173458938986791EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 1.5MB
SHA256 c13d91fb6f72694e28f7a1ea41486c52861f86c1b84688efd4cc009f98b65843
MD5 1b3ce4dea55412dc3a9ee66876a4baf4
SHA1 23e0ca4f2cb84e282a02b5ed76499bad25b525b1
SHA512 a65ddc536d0180360829b6324bb36a908edf8e7100b262732df14eb9b105bf250993bcabb422ebba7d221923c78882cb1b1209511c792e05254ac3a757532602
SSDEEP 12288:kM7zxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:FzzXJFfezVJMBIUXO9xw
TLSH
T166652339C3388EA7D0FA19B54B7A832CDA1D7D749BF804DF6989661A01364C5CD34B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8ae6bf975aa6c4481b9317ae22d374db9716f1d24f85de8b8aa14c01b2c1230c
MD5 a438418b5fd59346cbaa1943c5ba91c5
SHA1 d800e816b072ee29266dad5cf47b4234ba872ad0
SHA512 2594f0f9914cc1839d8fe7bbd8468a0e076686f34590fd8e35f1392dc467ad7a57338083e94b916cd946d5f6463043de98f25ce78cbfa1b1dec8ab608f80c0da
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYuzXJFfezVJMBIUXO9xw:xgb4mBIBhGFP3fezEdyxw
TLSH
T17765AE1E22EC02F5E0FAD2B8CDAA4417D6B278165731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ac40860cd112133ae6f3c3ad080484322c7c0505782ae8d1457f97874f0d36d9
MD5 4357a6e7420c90f24463984c3f96587f
SHA1 993263755e612c2f5193ae7177c8bf30c73b2285
SHA512 f59dc789287e09cb69da226690fac2e101aa3771d510b27b664121aea5d59d7bc8b7f9e1091f841ac1ea626990c16ecf077641b0aaea122df8063f01919e5433
SSDEEP 24576:yG88u8FpJqH1bzria7/mfzXJFfezVJMBIUXO9xw:p7ZFPqVea7/W3fezEdyxw
TLSH
T16AA5016563E001F1D07BD1388A964667F6B2B8250374EFDF06A88B561F33AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 50e8b0d193a72081ef39aa41bc499ff7f31536a03799002341c10c6dcb47a5f8
MD5 6d312ebf564ace6700fbe236ef046b7d
SHA1 5cc23407204ef9051bf557914ca03bb863a70414
SHA512 030c12e22e707efd6cd37a5eb7c72884df09585e17f1a296309b8252e8c2452032ec15c5e7a26dc0f7bea8ba4db015abe2fe0d43187e0105a4654d79bb2123a4
SSDEEP 12288:GHvUrBFrEjwaQUxFXuYFfFiYcb91V8wNXdO+iJIpGqGDWhmkr9p7wK0:GPUr+NQUzXJFfezVJMBIUXO9xw
TLSH
T19685E12F62AC1CE5E57AA17D8A96871DE7717862135192CF02E0813E0F37DD8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee6cf2b2c215b724038cd1f5e9c5de1a4d65fcdcf540745c2231afa880444da9
MD5 e4efd7867dd14eff3e90d3d3e8a9fb48
SHA1 3bd307c45ba4aa2d75ab3bed0167ab24e180fb46
SHA512 3021c05a0da8c484b100e8287594d2613b7e9a45c59c9ae042ca0cf6430653b7ab48f7a1295b457a8ba26cc21b0e9432ca866ab550f20a4928d4582cc63c4827
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjj3fezEdyxw:7G05lO43bs3fE4yq
TLSH
T1DCD5BF6E62EC11F9D0BBD17CDA86460BEBB23825033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c4350c17a44a391072dc9e4dd0d8363019d29b307731993623160955e6a7b15
MD5 ec49e75a68a968e7398c559a0f376b23
SHA1 0ea02149f39548002655fbfbf65c785e435a0ebe
SHA512 32f17527d2be2c18d631881c14d68033dc7761bc30616f623d67a1d32766ac9d51811d792ec03767123d928dc7fec1d545f635211ee9ac6653169ac4fa963f55
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpzXJFfezVJMBIUXO9xw:Da5POZ3+Jt2pasx2+mb3fezEdyxw
TLSH
T1FD65BF5EA6FC01D5D1B9D17DC683861AE5B1342553319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b572af2ec28c3275dd55d56a5e28cf40cf0cc608e88ea9fce728a9e363758fd0
MD5 ad8181bb26df6cdb3d1210eac111dd38
SHA1 63a6145306df34df2b844f696ccefb1cdab79ce1
SHA512 93057838b81995eca5cfedf2e777bcfe5535d70145e9dbadb178a51144a4b5c1ef740bcb595087e1afb9ecb57bfe54dcd9564ebd7eb619321aafee635c36d700
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkXzXJFfezVJMBIUXO9xw:KNc/zEOVHF23fezEdyxw
TLSH
T191858C2623E901E4E1BBE1BE89779546FA71786553348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5afd3e3232282fe09f70d72530df4f727861911e13e4c15172287237232bf83f
MD5 9cbc6bd2b22398fd9da19c2f7eb2d53b
SHA1 352d25de77c66dd7bbdd040d4e68c1f9c60f011d
SHA512 bd19080151d3e73f0c8aca4b9a810d71f7495944ac921202c76b6c233427da6a32ba0315715f48bfbc64b4e3243fe00d7f4fc88fc615a2913bd6c76db26cf5e4
SSDEEP 24576:n8kNvNnaFeYhJNtmZBm6zXJFfezVJMBIUXO9xw:n8MwBtOm63fezEdyxw
TLSH
T12055AF2EA6B846E4D1FEC6B5CE238516EA727861173253CF5290C13F0E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a2d96c62ade229d3cdd907db50b9eed3d3f2cf523b063a659d54a406c11f9be7
MD5 f0501f9829fe19d021b5581519a02256
SHA1 95698c43ac136b34fa119cb8a371f8f17f5c504c
SHA512 f36b644e44f37206f8b934bafbc99d495de5a9818d229b1a2cf6be7315468eb0a56cfebde18bce1e3ce3befe7798bea35552ddaa7f8bee0112f81a330bc9eeba
SSDEEP 24576:6D3FHshBIYQgAczXJFfezVJMBIUXO9xw:6DVHeBIAAc3fezEdyxw
TLSH
T11395E17EE66C04E5D47BC1BCCA638A06E77138A9033255DB16D481BA1F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/8-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/8-30-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/8-29-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/8-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1012-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1012-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1012-79-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/1012-301-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/2284-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2284-148-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2284-157-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2284-154-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2284-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2424-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2424-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2424-165-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2612-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2612-129-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2612-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2612-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2612-332-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-63-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/2800-64-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2800-196-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/3044-143-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3044-137-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3044-135-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/3044-331-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/3300-111-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3300-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3300-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-347-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3404-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4704-55-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4704-48-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4704-47-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4704-61-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4704-54-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4704-59-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/5328-422-0x0000018A363F0000-0x0000018A36638000-memory.dmp

Download

memory/5348-346-0x00000202EC660000-0x00000202EC8EB000-memory.dmp

Download

memory/5888-89-0x00000000040C0000-0x0000000004127000-memory.dmp

Download

memory/5888-0-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/5888-94-0x00000000040C0000-0x0000000004127000-memory.dmp

Download

memory/5888-106-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/5888-8-0x00000000030B0000-0x0000000003135000-memory.dmp

Download

memory/5888-14-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5888-15-0x0000000002DE0000-0x0000000002F30000-memory.dmp

Download

memory/5888-16-0x00000000030B0000-0x0000000003135000-memory.dmp

Download

memory/5888-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5888-74-0x0000000000400000-0x0000000000830000-memory.dmp

Download