dce0b8cd496dfc7b81cdb1d1520593469194eb749ef9056697c782ec6acef2f8

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Size 2.0MB
Sample260703-by7fcshy4x
SHA256 dce0b8cd496dfc7b81cdb1d1520593469194eb749ef9056697c782ec6acef2f8
MD5 47168d860c0c4000847f86a9ad413503
SHA1 7d2259848b01db64212a75153dd0c64b89559011
SHA512 86587342c15a6bb1aa46a82143f49044781adf6a8db599fdb09fedd1be2b741cbc123407c2aa6f79e1b54f52e1e0e74f8539a5311c583bcda67344991d5b49e8
SSDEEP 49152:l2Lb5aH3tRORox3azgGJtB76Jx4x8EVep:YkHdROq3azh+ix8EVy
TLSH
T1E295AF307943C1B2E4A212F18AB86FB89569E9B05B3756CB13D42F2D0D305D36F39A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3748	elevation_service.exe
3652	elevation_service.exe
5536	maintenanceservice.exe
1052	OSE.EXE
5548	PerceptionSimulationService.exe
4492	perfhost.exe
2908	ReFsDedupSvc.exe
3024	SensorDataService.exe
244	ssh-agent.exe
3404	AgentService.exe
5420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f9a0593a4a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c655b0188c0add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7c14a5b8c0add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc0801b8c0add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5e3fa198c0add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3652	elevation_service.exe
3652	elevation_service.exe
3652	elevation_service.exe
3652	elevation_service.exe
3652	elevation_service.exe
3652	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	3748	elevation_service.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2908	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3404	AgentService.exe
Token: 33	5420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5420	SearchIndexer.exe
Token: SeDebugPrivilege	3748	elevation_service.exe
Token: SeDebugPrivilege	3652	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 5708	5420	SearchIndexer.exe	100
PID 5420 wrote to memory of 2844	5420	SearchIndexer.exe	101
PID 5420 wrote to memory of 1752	5420	SearchIndexer.exe	102
PID 5420 wrote to memory of 4748	5420	SearchIndexer.exe	103
PID 5420 wrote to memory of 1196	5420	SearchIndexer.exe	105
PID 5420 wrote to memory of 1476	5420	SearchIndexer.exe	106
PID 5420 wrote to memory of 2080	5420	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_47168d860c0c4000847f86a9ad413503_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 22415a51cd94a4dcacbda96acdffc6618f852830bbf2afd3707d85c06e19d69f
MD5 0f73864fe9b07d610aba9de20eba9964
SHA1 782e3039d4dc0787b719dbc692306b5d4acdd8cb
SHA512 b881533b53a3b61bdb3f478d25e6fe5930728867e51f7919691dc664a7638f923cb379ae3a8f0536f1c68bd412cdb93ae4e4a3dcd2bc266bef45c5988d091173
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnix4x8EVep:y3q6HjBRix8EVy
TLSH
T1C5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 72964982d5756325610a86616d1b1de9086fa9a8ee46f9238b83ff0e875f9e2b
MD5 b5a74688b2f68d0d6eaad42bd01a05fb
SHA1 e8c424825d034509e1062fbb9dc8303a7dce4f1f
SHA512 4da8e94257e8089a912e1e6b078a31083fdfe5e41f3d30143f344202d507755c8fcd97d1b558d28b775e39723390cf0a0e5b40166f9b71adaa9312acadd5c664
SSDEEP 12288:O1XLsswWkxy2lRq2czA6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:8XYfDtczA6yxknw4FYnshx8OfVe247
TLSH
T15775F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3437f7d3011b16ca3bede7a44df3fdfce777ced58f37983937f0892974bbb9c5
MD5 a77d6a3c2418120a6f0fd5eabd7f8e62
SHA1 54c6375918ec25bf8a03580e6913332e2f0a42bc
SHA512 2c7fb9b769d46fd9fa602f93e09571b45a1b6f13f1c4d65ccc78ca3e5e912d7d1624d7ecfd3f9ec67b0aedeb8f52bc6240df1cec6f3ca60fcc1282598ffe27ef
SSDEEP 24576:30Le5ji0hmx1rMPyxknw4FYnshx8OfVe247:3Pji0A7/x4x8EVep
TLSH
T15A95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 739e5250be3e4742449e7f29cead95e3f91fa54a63c34ed79a1970777e396c56
MD5 40bb2ee7006762b0da8dff27625783e5
SHA1 af8e5cd1475e66982a6c35ad0a42886e0ef6737f
SHA512 992159d46a67d3e1b0d5cf87164cea05ce7bc17a2800fd3e008846296fd9a43f658b0ccb96aaa60b6e9bc0ee91ae868e13c320fff586fd584e77d5a48fc9c57e
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWE6q8wyudyxknw4FYnshx8OfVe247:v/ezSC6vUzPvxHjyDx4x8EVep
TLSH
T12D756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8bb6add28773da1e949d305804bd3deb96bd8ba3a2925567858ef3b5c65e8b9a
MD5 3c7b55d6c0b6e52c8e8106223c439336
SHA1 69343d3d59980ac40f2e0cbf983487dd6c3893fa
SHA512 5a32122049f98606f1a389bbccc393935e3a5c92e8847c6fbe26a5f54bde334b4203eee4e1070bc53fa28f342ae14e5476e74348870d034db732d5d5f7a94410
SSDEEP 24576:dVbqPb88hv/l+6Oyxknw4FYnshx8OfVe247:dVO88hXl+ux4x8EVep
TLSH
T1B9559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 760b6d99dc11b25bd1b3e9d3eb7cc224ab2d3cf50119b48211e30c5bbe9f834d
MD5 737fea03e29a05bcda392839c2273223
SHA1 d8a494c6dd11eb5820e98873f3cabe79ecc1a990
SHA512 2dac6a355666ec6c963a784429da635a2bf971e266f34ddd877dcefda9bc5a2adb5d1d89c250a26da929d0a21b4cd809b213c4294b7d6f6c98b59b70e51b7745
SSDEEP 12288:aNT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aNTyxknw4FYnshx8OfVe247
TLSH
T1DB65237CA7DDA4E1FA9E14331A7572623616BDA4DA74C11BC778B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 9906d8dd573782dc25feb7e99be8b9caf368e79987456053adf1fde63fae37fe
MD5 57e67d3f76d052c8f9a6fb2189e8c19e
SHA1 50dd15aa53bdab37637abe02ac2353f7f5a4cc19
SHA512 e8accd9ec69a6a0f71484e5547e72a963d1c770aca965926770eebed670e41f44dc6ff621643f353a0ed5465438496f6748a2b17ce0e193d6cd853dc6937be23
SSDEEP 12288:9eBNUbTVO86UG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9JIUGyxknw4FYnshx8OfVe247
TLSH
T1F375CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 80854e42293fb9275cb6d04bca72a42f6118cb0b520e64411925133657962ce4
MD5 d4c3c6f1eed1a5ea2c4a7015ad99a1a9
SHA1 60befd8b5c1da734164f439fea733466ca630428
SHA512 f341de1479e10a435f4afba79034b57861bcbeaf3f48e2e151ded1fb86e145eb683faa9b685ce8b1dee12c15fb76427e060131baca4b89ea42c3cf3948a00ade
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:7QvGAdlCEL8c/yRNw5C4ix8EVy
TLSH
T194267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d9e1206cac6e9d9c2122f2db3289a5dd4a8c2a86dc1ff02dd2bc89ca1f127860
MD5 48e0ee0938958c5831a4d524655f6e2c
SHA1 f736120febe6d1fdcab22aa1803ff6f353d8281d
SHA512 4a4d2864126170e6300a7e63c87ccb4e2d86c53f1249749ad531f9a0cbeb44361c8b50e2e951b940d38abc2cddca27cc1d20a97f1b44dc3eac3e28cf61fa4c32
SSDEEP 12288:wAwSfxL/2Dc3LDLLmt0LDQewsAjU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:F6ewsAjUyxknw4FYnshx8OfVe247
TLSH
T15D85E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4168b204451d9946f2f50c028377b87db2330b4c0c81023afd0a41922e710f7b
MD5 b66c15d6e21726a6ba24b702aad36104
SHA1 2aea47d2b3b120dcbc9d9ff623ae272760275a02
SHA512 de4447f2778d9a7fac81fcc0d63d30dad9b13bd9bbe30f5c02a7cc4e7e9c79b9d7c17c3adb4f1ff804d3bc9aef33fb3e1e39f043f22ec1e28e8af2218d9e6389
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHy:eUEtQevvqc2W1cpV2EI32
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5e6c2ed209795be23a4252dbda935ee1284b36590c33bd61738039316333c5cc
MD5 890294d534840529a170f06560cd40f3
SHA1 5c4d108f202394d2115d5f9cb8f646002a9af1f4
SHA512 987cbf8c2cdb8e5e84982a86c91dfe73927b4a252a2bc01ded7d9e9c8430a520f2345d8826e0038954045c3ea89cdb4b705bdb857075912078c3a1d095bd5aea
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zPx4x8EVep:9oqtVjnm8ix8EVy
TLSH
T186D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f95d703533700cbe80425e4412d9672ae17199799e7a7d44c1b0ca3770ac8deb
MD5 bdb011ac85d0ad3e56c190a662321e4b
SHA1 caf17eeb02fabded5618366ad6c960086662217d
SHA512 fd119c225d3d19f34f0f18cd95067f3a387efa6981bffce46091e41670990f41d08b1cf6ee7e09b5d7edbd9f07d466b9f214afd44a95bc774ccc635040e1d990
SSDEEP 24576:7AhGLJIFoiwtA5l7S53Zyxknw4FYnshx8OfVe247:7AMyFoiq5sx4x8EVep
TLSH
T13E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 445a0d438e2d23efb22dab75f532bb46ff5035bdc6b4ef9ed2cbfa5715f5746a
MD5 57eb1ce9e50038f0d9aa7b71801d66f5
SHA1 0f2170e792f6439b2110ccad2e0ed0aea38adad3
SHA512 ed26867ea3cbed8e74d50718f2ae5dedcdde97aa2b78aae0df3e592fe1aa277963ba83a6da678c95ccc487986af27c569f3420b495e40024676517ac253a1a52
SSDEEP 12288:amw5HEjsChN4BFgl0WDm+C9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:zwuVOWgyxknw4FYnshx8OfVe247
TLSH
T13675F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9b03f9faa3ac4d33e616135a6ec118160aed16ac7876192ffc5307b1aa3f36ac
MD5 4812ae35b0559256601b14afd25cb6e9
SHA1 94dcb3c6611f7a94070deb53bf4eb62be4df69e7
SHA512 36d066fc5898959980068b85730816e026fab3280b6e5eebc8de67206db1aea070cbed4956999ede2cb79050ed7939db0f01045af8472356e6eba8887e0157d8
SSDEEP 12288:rFZ1IyE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZuHyxknw4FYnshx8OfVe247
TLSH
T1316512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11e8b97835b87f5575171bf6ba459f00dae23c39bbd5fad6f54918c1a64307a0
MD5 45af483de46aac79daedf09311e2c8bb
SHA1 f7a7c5bcb6e5df0ff2fd9cf1d1146e43815cc10a
SHA512 641882cfd127ff387959fc3763532b125ffc108166fd19333d8d7b17d895c0aa9e45f2e9a653dfd115fa7596efc8e77de428be4bb762451197df4cb107122772
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:hQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T1EE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 31fa4ee744bd9f02190ed5d7363097921ed37ddafe564e5c8910fc10e052f161
MD5 85075f0af68cff14f6f624a726a827ae
SHA1 c60abbbe3ca6d1203d299861bb9b2e8820b8126d
SHA512 1de06109cc7aa8b3e0f2241ddbff0f34d2f1b57885095678b7f8730e6692bd47c421799cc29188831f6eeb884d85c5a3fb4175cd7ad2119fdaf881e88ee28825
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:TQRQyi36YOcPQLvw2gAf+PN3Nix8EVy
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 293a47d8d54bcdf0a21afcb17c4dc12fed1321fb508d1a772498dd5c65bf70b8
MD5 ce4c0568b3fe10748d7a5756f251b629
SHA1 ef3a93248ce45e1b99dc750ef61b09ec396e7a45
SHA512 6ed91f00dd3ef57f44d3b34047f279d16cad28e46c8285d9ae16048b20bb3fda3f65d50b2be6e13a311af7a3ef81a9d7b127a7d5fc034a88e6b290a74a577d25
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Xyxknw4FYnshx8Z:v68Qg55nhheWu7PNU3//x4x8EVep
TLSH
T197B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2eeacc17668072268dcbd881ec2d85c935f9623373839b03c7aade510e0f2a47
MD5 bc323c2641bb553de7b5aba82c97fa88
SHA1 ab56305e813e0fdde4bd07861d7b9a1b6753de3e
SHA512 04a9a3b7b2afe214f93f772a44f1416cf7a530e41a790b06c95401c557df2a8db354aab3b725faa3a5203ade41ec155b8000f882a275ad12f061c7b615b8ec85
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:Wy5112gYy5azzVvL69nLKnhZWix8EVy
TLSH
T1A1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 72d28bd8028818f19db286284567a829e73c014a0f109ee45b854db5114dc1d8
MD5 61cde1976a07aa8b103812b02b0800fc
SHA1 abe8888b8c398de3c7a76cf20806358b83a6215c
SHA512 cb3f242bb4e963536accbb786b14c1b2e361f9e27996307ef752adfa6e4df8753fa7fdfa9a8b81479f39605aa673fedb1b8e514a8b6dbb3306b42edda4e0ee11
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glix4x8EVep:Ru6JmVxd2diix8EVy
TLSH
T1D4D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c6d110707e50b7da2d03cf81c475fb5ae699b32c0fd268ec54c13de3f1a57246
MD5 5fe9c73a5107d56141c34566128014b4
SHA1 f1470254cdee0703706a9ec9cb9f8d940af7ca6e
SHA512 aaa5ef2b3b08237db95ed280bfaca1a5bb128802c72172b80901dc08538b9c01f6552ee3290a8b1521abbf11f258062c46f2212df778ef84e0aaaa3bcbacd8b6
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xZx4x8EVep:9mifPbR8ix8EVy
TLSH
T1B5B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a98992a690f8bbbd3b06b9b494e0b0788e9e3fc1b1062bdd737b91819f30c24d
MD5 bbb989b56aa111d16132a6e45e9e65c8
SHA1 b2d61d2306987dbdd35d623a6dc15fc1f50b3365
SHA512 af70c4fad50b18ebec4b60fb1e45a941cf1213c1ec97ef7224cfe5ad2f5b23fec4ac6229033461fb7ef80797c01c99ee2db8ff36787ab40da1038159cb07305d
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqSx4x8EVep:A5dKTi61Six8EVy
TLSH
T1AAC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c5fdd7935bcaf0f966bce7582cdb0d03694a3bc3f620bee841621d89e0f5180f
MD5 fdcd9eedf5b6213efd50e62563325851
SHA1 3c1ad689566649d5ff9341fb601a1835e218dbfa
SHA512 8335e3a03faa848130f3eac2351334fd82e9e9912781df03fc23f4f17f83946daafd7b821ea3360fd66b38468b27720ea8d15b35b4b02507d171057e56d3a754
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wVx4x8EVep:GX2iyphAix8EVy
TLSH
T12C95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 84994656e25ed6c8a5f5baa31ad37f9b97919ac6e095e94e7d418721b803717d
MD5 dc5641d74c42cdf0f70fc48937d995b9
SHA1 b1816acb75b9d91e9d7642bb000010457b1ed574
SHA512 cd5f0943958645844df21e4362c8ee1ed3f3e3df5d47fcca31201f2fd303ee1036397c8a72c549a507fbfe2167a6943b93a20cd74f26956a6a2315f95a7037a2
SSDEEP 12288:0L+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0Lyxknw4FYnshx8OfVe247
TLSH
T1A865237CBBDEA5E2F50D11734A7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 01d489175c6d8884b8fde4ba0854fe58e63df503d59e0eb8d83392f450d3d710
MD5 e67f37abba721b9bacd6c36903e2dc16
SHA1 c86a0174fe9571b6ecae1b8e76b17da7bba7a0d9
SHA512 7ad7c53e589897671573f822066a6204920709c2eece33c3548ab41bb95e9e639407253d8d49ab936a133f6b867f820a3c483d3eaeb86305109f8a168c7de156
SSDEEP 12288:wI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wIyxknw4FYnshx8OfVe247
TLSH
T10465237CBBDE95D2E50D11734B7172626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9250891ef88c758edbf7ea5dfe319579e3dd9c5bb2ab1a54e8bda5b2016a4e7a
MD5 9415a9b3c750609144f7c7aa583204f2
SHA1 ff3fefd115c77f5c109ec8b939973e9abdfb203a
SHA512 acd4a8fcaa6d7fafabde4e4b9f4418ef590fe8f326fdd28b1091829e04fb8065b48014a3f8078f0a331bb611d0bffb331d2ed9ded26c9e884f7e1d43eb86b421
SSDEEP 12288:5e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5eyxknw4FYnshx8OfVe247
TLSH
T1A965237CBBDEA4D2E54D11734B7163626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e6b4a95e36a239f7a2ffe270b96b16ade0ae874c856948bc8e72f57c98455889
MD5 272268bc1c8c620eb02b108b4ff7b725
SHA1 a66c2b32f72d4a076be48e9e64302c4313081b01
SHA512 0d51dc026a66b33807f9d08a4e9aad50640aa4c19823f12f19f0537895629613dd4c1166ebb2620810ede77e5087c59672987d8632a9e9ee3549215e71c54d99
SSDEEP 12288:cV5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ayxknw4FYnshx8OfVe247
TLSH
T12065236C77EE50D1E85A51738A716222B365B8E5E731C35FCB64700EE9F08A0A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 249850b8c08f024c0671d76939e316a91c9b4e63844277815bd1c35cfd2eea91
MD5 68f0a0d55c831dd325a0650993e55b2c
SHA1 6f4e4549740e656083ec0194f9f45ff5c1cad782
SHA512 3d652e936cc3f93fb8555ef2acbdee1aba0c8673d1d30c97096e7432cfed56bdb710f57818099006275f30380021431f3776e3ae1627e26c0c20fcdecc100a46
SSDEEP 12288:IB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IByxknw4FYnshx8OfVe247
TLSH
T19865237CBBDEA5D2F50D11734B7163626609B5A5EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4954e2a6daf3af6fcd4c494493d420f1e117ff8b10fd7b3882b470217407eb4e
MD5 479afeed9ef5a24bde0fb9f892d98fff
SHA1 551511ee5a3ea2c012f1c74eecf629997cb8bfdf
SHA512 24dd4c5462723f2ae9d8a0764771a36a36eec732468f4520870fb346802a6ea0fd3911b124b36fb7aab48c755038c43b7bd736617b41efc5f28105714dbafcb9
SSDEEP 12288:pM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pMyxknw4FYnshx8OfVe247
TLSH
T1AE65237CBBDE95E2E50D11734B7162626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ca8c1c4e3c8aa9fbafa195a88434686a07838ad2c4914cf6d93fb4a8b5ea82a2
MD5 eabd2e81c53b305f30a721a7e1e92dcb
SHA1 a4aa007ae9c469a0a3aee6e5088936e1d42720da
SHA512 8f78ec35908160978543db8453ca24a21d9418d6c5a26274c601c5c5136791c3a28ea7b4bd7eab729ef0ad17aecd3e76827113349e9c635d429f35276c467b49
SSDEEP 12288:Sw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Swyxknw4FYnshx8OfVe247
TLSH
T17E65237CBBDE95D2E50D11734B7173626609B5A5EAB1821BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 cdc8b030dde9450b83293863d60835d6cba0f0f3f4b666ed1752d9763785d19b
MD5 a0b103b0e38120ce89390b6de26715a3
SHA1 cba06da4a690b02553fadcbc7875a6b04f0914ae
SHA512 8e17aea831e7b58ee218a292d099d463a05af443e0314db3c1e2fa7aee7a3143fd0d50d82970f9a1bb98f2c79e1ab9a4ebd24b1edfb0c576026e77d179bb7c02
SSDEEP 12288:aiZwbZzzFEoS2cPvyo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9ZMdzFVSOoyxknw4FYnshx8OfVe247
TLSH
T1327502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7bf89f7d32854a9915bb55ec5630e3465365e0cd6f2a7ab8d43fe0bc23e6f7e0
MD5 c322a35c8c1ec1cf931ae1d7dc38226f
SHA1 9ea14acf25a0fea6012d0e6ce7d99e187a0a6e82
SHA512 913e6f1c7efec99b6daddd73134439a5fbf16f23238686c1e4e5237b702fc172ca126f10b857e07dbe45d6dd8b26a3fd63ced9f8cc46fe957c6ea56eb3382a7f
SSDEEP 12288:A3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:A3yxknw4FYnshx8OfVe247
TLSH
T18665237CBBDEA4D2F54D11734B7163626609B5A5EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8f385be93d78128c44eaedd181fadcf14afdfd1e7463eaa38c4abdb2d788a6fc
MD5 ba0f27fd33b231a2458f7aa1ff25fc4d
SHA1 cfb752da89db77875d2f1addb17cfe511b4cf51d
SHA512 d69306f80e4d9d9d390e58b9c9996e3be391acef3fe4a9ed1b1f4eb5b89d83bd752e916537c80cd66c256a7676d8493ba2e48a41742200e82582294f52899525
SSDEEP 12288:VD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VDyxknw4FYnshx8OfVe247
TLSH
T1B46523BCBBDE95D2F50D11734B7163626609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 be89ffb6568a01f45987be722f5d458d0457cb0fe3aa7b917e08195d6094918b
MD5 54310fed4d226491f5a9395da30b3951
SHA1 557add5a8d56d0fc6efde263325ebd2275a170f2
SHA512 563e99a5027624d5fc6dd4e4f1f933da4a037a4ccadb62b01aa2217b7162848b1f9a58fd47f18ee61fc4685faf0b37b294d8cff808887260a52247ce7dc73f81
SSDEEP 12288:YyPz5L8E+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5zyEyxknw4FYnshx8OfVe247
TLSH
T11375125B73E530F5E12A423689621612F372B872473086AF87A4537E6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c60eea5d13eb1970501d175c1b4af50099ca286b5f0434279bf7721fb186984f
MD5 65bf31266d03bf9b75b80ad9bcfcaa9e
SHA1 cdca43585a0bc8ea9defcce48a221fb3b185f3ed
SHA512 a94b77dd906ac5aaf6c0b27c0273eb31bfd0c4b1d6639a3484e5a20547cd09c426fc191abd9a5b5c22ad6aec57bc4c92264d0ca1448ad721244ab0fea1ef3c70
SSDEEP 12288:W3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:W3yxknw4FYnshx8OfVe247
TLSH
T1DC65237CBBDEA4D2F54D11734B7163626609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a459d7d71c5b94666a3c45c5c125b904450ccfda5a932df09a4a04853eb90cbd
MD5 468c3417d98f44fba2b0664f6aef323c
SHA1 b77f476e83923f850fc412a18d0191fda31a9946
SHA512 b312941829672d1d20eb493017dd0162c9dd1e253648f6434c17ace691853709063d866fe98e1e5e5b51afbd4dc050859539318ad3d754c381052391eb98971c
SSDEEP 12288:63+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:63yxknw4FYnshx8OfVe247
TLSH
T1D96523BCBBDEA4D2F54D11734B7163626609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 bb894e61d771ee60cb51d2c57a1b3ad845e2bf10420f1646f0b54893f819d335
MD5 5b82ccaf427767876d55f526416682b4
SHA1 19724f3798e6e0209b9757cd749c1cc37b47ff53
SHA512 2869a6d946289609694862d6d825e4939055a66ad2cf7a7583cdea5024ae425abbadcae6c722d8741de84aa41f9b758e8fa64c4ca1080f7de1fc35030352b4e1
SSDEEP 12288:tyPz5L8E+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EzyEyxknw4FYnshx8OfVe247
TLSH
T1A875125B73E530F5D12A423689621612F372B872473086AF87A4537E6E729E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e09c1afe7fb5943350c14f4729536ddffda4d225d740d88edafb2ae86b5450cb
MD5 8afca371f0a7e1658c6069e22f4909ae
SHA1 92f93f1b2c0da5ef9cd7fbb5e90414960dd8d91e
SHA512 1d44d5949daf0c200ca650cde3871e922c0471d300eea307f28278a81d3c1cd20185cdde41d972f21f4c29677b39b789fe11e2591af8e29d9fd040f9688cd7c1
SSDEEP 24576:8TGaLl3z0zDuyxknw4FYnshx8OfVe247:8TFLljIx4x8EVep
TLSH
T1F87502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 7f5df83bcb1a1250a63f42f578e69915a8b42c9a03e70c86f0d6f813438bb680
MD5 0041206e3f9ccb4e6462e1562f347f74
SHA1 fb471ad37ec53bb4ad7c70ecddcd339f7097bed2
SHA512 b91e068ad52a79cb4a269c6dfa85641c7627587bd1c354a1e460c665d69ebf35b44f2fb814d0e9144267c39e2d67e87e10fc4ed87c7d741e0d61b6ebf6197e80
SSDEEP 24576:v3Xd9CHKy7GZyyxknw4FYnshx8OfVe247:/Xd9CHKyaXx4x8EVep
TLSH
T1FD95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 665b8f3db77420b1ad976aab1444b56fa9d940fdb7f7402af6927701314eb0d7
MD5 e63665bf8b6a2106eeb8193eb875a8d6
SHA1 bddac8e75dc396e4c192ba708c66deb07162acb7
SHA512 eec2ae7bc1475bf081055d458a0a750de3137e5f1d9e490c1544c9116c2ea79ab18506f51254e6adce9e8180dc3be42116f7a36f958cfe38f576a5842c7625e5
SSDEEP 12288:8++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8+yxknw4FYnshx8OfVe247
TLSH
T1FA65237CBBDEA5D2E50D11734B7173626609B5A5EA71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 48af5759f711a71c437a515aa70f971642b3cc37f8076360cbc97fdc657cc690
MD5 39975c6d2de5e37353b508e70ca67dc0
SHA1 d7af7d377e74efb804c8738eac591b560988151d
SHA512 d23dad73588d371f47be1bf69d335729b10826d3808aae918ee2c700dc9df29ae379da837f921a36c1f092daf8f11ffec7bd7400ab1faaf0e7957fe93c46adca
SSDEEP 12288:jk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jkyxknw4FYnshx8OfVe247
TLSH
T15865237CBBDE95E2F50D11734B7163626609B5A5EA71821BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3e5849a3ab4bf3759854ec81d80832f00e6f7eb603a25847e7a35a556d2f576b
MD5 e2bf6f0ad4ecc91a5b7cd0504093cc0e
SHA1 9c5e0eadebb5732bee86be3b90d13b91c96d3a28
SHA512 a314f305f2c2f204c7f03a189e0cd6e9fee1f0ce474e229fe56a546ba45fbab4510a20d413ee618a6e77263f8aa474f992c43972e371bc80080e5eed970a7596
SSDEEP 12288:Sl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Slyxknw4FYnshx8OfVe247
TLSH
T1FA6523BCBBDE94D2E54D10734B7173626509B5A5EAB1811BCBBDB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 114d08d566c5d3fd446bad540e17f0122953dbee08d83ddcc7bd47ffb1e7b097
MD5 22b9382d25b90314004ed48c50cb1ae9
SHA1 2412055c872f6e9febb94c57f20b17ab9aa1ec35
SHA512 a0be374ead7290786322fccb240a41dd4cf17c38feda4c31ea9f1f9d837830c2a5ecaded4a4003fcec64d7d1b7a58cba6b5ab0443599a399d0f32148fb93fa09
SSDEEP 12288:H3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:H3yxknw4FYnshx8OfVe247
TLSH
T1DB65237CBBDEA4D2F54D11734B7163626609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2c79eac5313f2a4dcccfd717a108ead1dd8a0efbce2ec20c040bb090816ce0d5
MD5 d114eb7fa157b5473c1bb208e7b7ef70
SHA1 42d0bfabc380e7f19f483111a7b0f11642861069
SHA512 2e382f5cae1c30c08a7ab43204f0579bd12c36b010c394126a43b9471473632876d2ed7cf590dd84ac7bdcd962317e3fa1a17b044fed86969afba541f640482d
SSDEEP 12288:p++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:p+yxknw4FYnshx8OfVe247
TLSH
T13665237CBBDE94D2E50D11734B7163626609B5A6EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 dd4630de452b50fc3ee7638d483e65d604c6967bb87b3ec8b60c3dd06caa3d2c
MD5 3154755ae64e450e1aed2ff8f684dd32
SHA1 7137a1281b9e64885eefbf3d66cb3065cd04a050
SHA512 177d8200c53d2c50e00329cbd4e2293abc8ec2920dd7226211b18c154618b58ffcbb10c44a5bb2525c2d7cdc1080c1555a94c939a347d0eb73a06e1e2314a14d
SSDEEP 12288:Kf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kfyxknw4FYnshx8OfVe247
TLSH
T14965237CBBDE95D2E50D01734B7163626609B5A5FA72821BCB7DB10EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 a7080db5d8a856fc12fd9c351c41f2ae1f4aad7665b77b3dad2a5c03f20a6ba4
MD5 7c971a070be1f6734fb1437ac75d6368
SHA1 03f486c60830f14a38bbdea37ea915630eba7c0d
SHA512 28cddae783898edbbca28a9ab2acc728e727f6d1e603f92e2423e000d23f10f22445dc508a39eadeaa7ce6debf1600c411e63ea77903c382d85221be1ebec2e1
SSDEEP 12288:kB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kByxknw4FYnshx8OfVe247
TLSH
T1A265237CBBDE95D2E50D11734B7163627609B5A5EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3dc1d4d4e3c39f191fce9b446ad45e789e875e2bf53205f12cc6cda8e97544ce
MD5 22b384db5e52c887cf95e80eed9946be
SHA1 f269d33b1092fee8979d955bde7b519bd8b3f53b
SHA512 26d0f54fd141346bd8c21103952e1312f21a11fd4b7a674118c16b63fa495a8fe4c3d36b647e18b5827377679eafd0f0336b531d74e0c3fa3c6bdd717b1af3ff
SSDEEP 24576:EfwvJk9RX6wkyAIzyxknw4FYnshx8OfVe247:tMnYI2x4x8EVep
TLSH
T19D95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ba34f9fbb7f150528e7db308bbbe6cfc5c8e8a19171aec7579c588ca033b3b67
MD5 aa6de4285077e757bb1ed64aff8720a9
SHA1 b017792f2ccb5c3d9ba3c030c8c4c733fac1fe7a
SHA512 985bee6fb165973f356f43dbfe59bb32f9c14d679dc18ab7be3594f1d80b4dcc96bed9de4a0f227ab24ee2d256fc58b7268f2f9d5f6eff1b9b8989d87f8527c2
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01x4x8EVep:EySzPtix8EVy
TLSH
T176066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c4bd5d6155f56923ea360d91161b36386a450236404cf7516ba90718a249cccd
MD5 edf0ce27062d3d24af6b1f281dde2a59
SHA1 ae3f43419c015bd7fb7dd16fe325fdda8df91c38
SHA512 623a3c423113088a9b4d81e70861af2a1eabd1b391a72d741fc4191b45a0191b26a55b9ccba69fcf4c1712596958214e89fb56f57d1579878921a08c30e7abff
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYyxknw4FYnshx8OfVe247:L47JUQj1irIhCnDHUPfF/lx4x8EVep
TLSH
T17365AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b2d25dc0ce4acda421fb387a665fae4cf750aa4729275d65598593075cd44d95
MD5 b71c8774758dfd4daadf134ac53b9df2
SHA1 e5f863533224a9c3afaaa674dbc8b579751fdc99
SHA512 545f97c53b25f7ab28762a4a94aa6a2810f9ae775ee0cb4222eab5ecfe66a90c5c45d62060eafc8b87a4e0e1900b092951abb3c53f017f6bba7cbeff5a9f1564
SSDEEP 12288:i+sfH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yHyxknw4FYnshx8OfVe247
TLSH
T13F75F028E29842E4D06E2136CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9901633307b5ddcd7bf500bc22f1d183cf813d272506dea535aa4a80b4252152
MD5 25653a444344392cc748ab6bf4e0553d
SHA1 86de6284437315a4f84f770e2735378cff07f720
SHA512 d7105c74c5d3fcc482e64255a7feff61e0808190c2ab290e2c346e3b504f2f0f2ec0faf2c4bd275cb9274dd5323a8b1cfae943e408370b3870bdde9852bb9c51
SSDEEP 24576:BAOWUP12N+MhdgSgZ12iblEDre0PTKZAOaRtOiGVl:aOWUoN/vzgZ12iblEDC0PGZAOaRtOiGV
TLSH
T1FC351810B266D74FC66940321E32D6CDAB707D41FE05AE0773C88B3F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 2adf1b87fed749411816a61d6da192579329e401b800927fab3c5b2af4d599ad
MD5 b2d1d6fb28b5b753ee888a2e2c9ca72c
SHA1 b71fc7f40311c59b4b55cb494c8bb7590fa851bf
SHA512 cc99bf35b714cd4e77f829b9b7a6a170424db0b2b7c050c17b8799cdaaa6c8d7caac13152189cb8d7c1a0477a046b0261de2d5c2a5eb61ca7aea48b7b0351086
SSDEEP 12288:CHvUB9vshgXF6JfJ3p6xKZAIP/08efVe7o1EN64rv+M8lIAzqdvgGJN/d3owSaSi:19vsSXF6tM4IGld3oxAB
TLSH
T179750A40A136E28FC1BB513207255F8D77B8EC56BB456F16B3C9483AD82A715A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4573ed438a1a5762f0822d9c3298d3b99de6bde9fe955657d264b99e9a5159f9
MD5 e972321d9761868bff696748d02f2307
SHA1 da1cef4fdde9380935fab007d4c4e1cd919cad72
SHA512 ae89489f2a7d9f4a650721bd84ef52200adff17c16511393c3db65850fc58b4f11de646c0054710f8a1afcafa28c18de603db9f3fc9966b4db05090ad191734c
SSDEEP 12288:J47v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wvyxknw4FYnshx8OfVe247
TLSH
T17965237CA7DEA892F86D15730676A231320AB5B49B70C1DBD768B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ba6a09786618f53260c17e32ee70500a13dd8ac30739171e7a9c7294e819fa1f
MD5 5fec66630907bb8e415020e105af242a
SHA1 a64c88b4419e103100faddc6bf1f813bb60da6be
SHA512 9b0d36695c7957892054b5774a6cc100bebf2de00d82b5b834df2af3442d3af81f828afffffe4d421d8a7742bfc59c55a5781dcf8a5d1f6c4bea6f02447627c4
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYdyxknw4FYnshx8OfVe247:kgb4mBIBhGF7x4x8EVep
TLSH
T13B65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 cc2cfbf94d000157647260eb3da3e042e3520c6a1772a5a7d1c9aa256b47db0c
MD5 b7720bd537233439412106f2be9c4ab7
SHA1 7e52961eb53b14a713ce9d52be837d9c158b7521
SHA512 bc305822b25d988441299ee3c77dc43f81e5ecfe39a2f430f5d201e6528d715e21a8934aa1f74a5c8c8f6bace638be0e8855f272162465205cbbc08a3aaaac31
SSDEEP 24576:EG88u8FpJqH1azria7/moyxknw4FYnshx8OfVe247:37ZFPqVla7/Qx4x8EVep
TLSH
T1C595F16877E501F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 bddbb19490bc8d7910d9198d42b99a782491ae607d2b8169a1ae77e688f3c698
MD5 4240c9eec675a85b1f5e2d5e973926ed
SHA1 b02da1ee434ff571f185ffaefc4121de53e64bef
SHA512 8524045eff25fa6d36a98317a1ad7cf2e0cde1642688f507d1ccfbec78eb2e11eb505882b993bd4f53ebb32bc4577f63e4192d693e646c2b8e7b256c63399249
SSDEEP 12288:EHvUrBFrEjwaQ8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EPUr+NQ8yxknw4FYnshx8OfVe247
TLSH
T14F75F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ad86dbb7f4475c090182f0cfc1330c965aab7530ae01ba16fb8602408236f8f8
MD5 2203dbc959755190ed47eeee0e0bb7f0
SHA1 5b364cef3971678ea98724cae839fac0369d1adf
SHA512 9067729dbe621a0cca79c0310daecaf3e084eeb44abb5158ea8eb5363f8ebefccbf69ea84f3a48bf09a8279346f8cce7a6a634a1f1869989c4143d373bb874cb
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnx4x8EVep:PG05lO43beix8EVy
TLSH
T170D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd1aa7bae5be4dc991822db419b23ada9c287779fcf8e3b99eba24436df634aa
MD5 114a750600bae30929dd7be3f91bb357
SHA1 7258b9cd86a2f0001c83dafb6be529f33b275ffe
SHA512 4c96ceceb4b8d7dc777acbe411907742f7a3193b3b152ec3ca9aa669aaa04b4d85709d5f317552a7a24a1c8df33a4225750d9d8f8c34726ad15610f8f66a310e
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnayxknw4FYnshx8OfVe247:Ca5POZ3+Jt2pasx2+m/x4x8EVep
TLSH
T1ED65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aff30ec201be9440c441a0061fc538081abdd7478d837918cd6914df102ea44b
MD5 93b7dfd9f7c4cf610e077e19f733cf55
SHA1 868ee30c9084ebd7516a5c2c22f1324c171ad2d6
SHA512 b2c360796bdc9f682eff5d2bd53fe8e03db9a469fe2353c1a40019cbb11631d56d338712dc9e7c2327742789569415d437ad7e4f6e9a0612e8aa34adc4597738
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkAyxknw4FYnshx8OfVe247:fNc/zEOVHFwx4x8EVep
TLSH
T1B2857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8a54e85b6b7452f94e3c1a6a4e837b75fbdaca999e9344ed282159314413bd2c
MD5 685e1e1e8d6c4563a4c071a6a6365093
SHA1 4a3cd269caa7c8beee559c621f72912b581cd09b
SHA512 ce437a908efcd05a903650a79fb0fcf9845ae99cb1ad938b4009de79126c20b07a7fb8fcf322a01489374501ee7c6a9ec59f26fd464f03bdf15d7764b7136790
SSDEEP 24576:98kNvNnaFeYhJNtmZBm7yxknw4FYnshx8OfVe247:98MwBtOmex4x8EVep
TLSH
T17D55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 1c6f7eab531dd3484f1addf411d702af24e34697c78bb6b46282033ee491a8fe
MD5 389b6d42faadc66606eedba4c8dcaaee
SHA1 73844d3196aec8d51795b1f13dedbd5d25cb79c3
SHA512 8d51600aaae9932390d9fc5ac205864d1f15da48ad8ed9a9d360326fe2b19f721e960a730288a45a14bf72801e7df8d8ecfc3ac6df3a5bf59964bd26ed8c97fe
SSDEEP 24576:pD3FHshBIYQgAryxknw4FYnshx8OfVe247:pDVHeBIAAOx4x8EVep
TLSH
T17685E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-115-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/244-122-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/244-123-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/244-314-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1052-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1052-57-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1052-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1052-295-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2908-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2908-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2908-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2908-91-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3024-109-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3024-103-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3024-316-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3024-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3024-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3404-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3404-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3404-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3404-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3404-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3652-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3652-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3652-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3652-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3652-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3748-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3748-25-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3748-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3748-17-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4492-80-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4492-311-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4492-86-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/4492-81-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/5000-1-0x0000000000D70000-0x0000000000DD6000-memory.dmp

Download

memory/5000-0-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/5000-6-0x0000000000D70000-0x0000000000DD6000-memory.dmp

Download

memory/5000-8-0x0000000000D70000-0x0000000000DD6000-memory.dmp

Download

memory/5000-15-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/5420-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5420-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5536-49-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/5536-53-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/5536-42-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5536-55-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5536-43-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/5548-68-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5548-70-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5548-76-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5548-309-0x0000000140000000-0x0000000140197000-memory.dmp

Download