d402945496143c544d5c9d4249f03657569ec2fd3c019c7bd11e2b9e1740801b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260715-nn2tcaa15j
SHA256 d402945496143c544d5c9d4249f03657569ec2fd3c019c7bd11e2b9e1740801b
MD5 ac8308a61230862ddb2effae85b7f803
SHA1 a344538fc8e5459ad6b34ab9f6be04a1bd330219
SHA512 1180b69e181b7c77c24166201c8e870d3ce7b6b31034beb86291fd0ec73f779ff2e62d707ef19213b18f9c67a471fc632e2c128b6cabd9e0d4336de095aa6e65
SSDEEP 24576:AMMF9m96EJz4ddUIsVsjo+NHru65T+v8zVW76r0KA3qHwg4xteLG:oF8nz4ddUI3jo+NHruSXch/3qHiXeLG
TLSH
T1CD75E02139E6D072E57346304DBAD21155AFB8310F3189DB37E8562E2F759C2AB32B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4624	elevation_service.exe
3404	elevation_service.exe
1928	maintenanceservice.exe
5572	OSE.EXE
5744	PerceptionSimulationService.exe
4152	perfhost.exe
4260	ReFsDedupSvc.exe
5424	SensorDataService.exe
4032	ssh-agent.exe
3296	AgentService.exe
2476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f97640be8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2d0b9ce4d14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b649b6d04d14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033219ed04d14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007be2f6ce4d14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f71d300e4e14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd65a80e4e14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4312	2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	4624	elevation_service.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3296	AgentService.exe
Token: 33	2476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeDebugPrivilege	4624	elevation_service.exe
Token: SeDebugPrivilege	3404	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4092	2476	SearchIndexer.exe	99
PID 2476 wrote to memory of 2472	2476	SearchIndexer.exe	100
PID 2476 wrote to memory of 3528	2476	SearchIndexer.exe	101
PID 2476 wrote to memory of 1820	2476	SearchIndexer.exe	102
PID 2476 wrote to memory of 3824	2476	SearchIndexer.exe	104
PID 2476 wrote to memory of 5520	2476	SearchIndexer.exe	105
PID 2476 wrote to memory of 5100	2476	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_ac8308a61230862ddb2effae85b7f803_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 534d479fe75fc6c74613aa4ee0b142755f7380f0cdf6652b9d9f90fc127c99bd
MD5 6cdf7ba3afc830d0ad6cf66885c5e536
SHA1 8f0b9c52c46f37b90531bc3d33864d4148c77398
SHA512 fc8d2b0ff415afb7881db66467b33d1aeb4183fe6448ba249d89867753afa0903af604e4c06a7e23175959acff1af103af1dbb2b0a7eef9b0f084d07194ba136
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBXch/3qHiXeLG:h3q6mjBgXA/6CIG
TLSH
T189D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c781057eecb9e1ddee8c0e2e83b61cc8c899567807b9e30a4102afc1d1e73a1d
MD5 05e00ff923e743c71c32ea24f432f9ed
SHA1 c325ef96dcf4f9513042bb71865d36bc553b17c6
SHA512 ecc7487df5ba26f2c1253a63c1c5dcf49a1bc19f6dba5de954e8e3370b352a0b56cf02f78d305239e64c36df22eb905fd30e2f198f66515e6e3394f5a0f4977c
SSDEEP 24576:8XYfDtczA45T+v8zVW76r0KA3qHwg4xteLG:7tcfXch/3qHiXeLG
TLSH
T18565012877E908F9ED67823CCDA28511D633B8514360EB9B03E4D9261F736D46E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9193fc6f8af11546ef5ccf803cbd989b9ae5ee2ca237d996b561aaad389636e6
MD5 7b59c6275dcf6c5ef911bfa3cf52867c
SHA1 7f473e1dee57d9453ff77d4ffd6c8dc1a2e15632
SHA512 1f684f44c245010c1a47d476390173aaadad31a27d93b9ffb1b8f6d9bb06bf00b251a07a11318bce5039361c513376750cdb5f91ca1992f04280c3cb09dfbb15
SSDEEP 24576:s0Le5ji0hmxhrMz5T+v8zVW76r0KA3qHwg4xteLGz:sPji0Az+Xch/3qHiXeLGz
TLSH
T120859E15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8499140a626c635fcab815ba7db4b43cd1a825b5376490db13b83a58b2985bb5
MD5 4d480a24e072294324f56d8a1edae420
SHA1 6610b1ea0ed18696c75e555c90e33702368c17cd
SHA512 30c0b84ec6d32b5caa8964f01bd97eac4062903e729950391273fcc02e9bcb6a8e9b6106be64bcea9cdcab0913cf1f84746bd63230ad8a9906d43ca9846fd280
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWj6q8wyul5T+v8zVW76r0KA3qHwg4xteLG:b/ezSC6vUzPv+HjyyXch/3qHiXeLG
TLSH
T1BC755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4e5045026e4f532a1123f7327c4a2a9d02b901c6bdb913549111e272c464de95
MD5 bc98ff423e162318e7dbea983e84ff10
SHA1 432ae8fdbc253bc15370b981c582d78e0f923bc6
SHA512 df2c60fffade2f9af61f5ca26b44909bf28e9ce15524afad3f3d31389bb74a4b976884171fafcbaf3de4af3fbfa6dfa23b510795369ef450671dd65b52434a26
SSDEEP 24576:JVbqPb88hv/l+Bk5T+v8zVW76r0KA3qHwg4xteLG:JVO88hXl+eXch/3qHiXeLG
TLSH
T117559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 276d6612fa5b16f2da5553651f14c74e2530d47f5c857f85b3b22ecfeab3c3c7
MD5 9855d023e646b5a7536d6e694451d2b9
SHA1 e848661d2b248494306a3a95ec6c88a5939f7168
SHA512 0f592ddd45684ae953712c0ba9c928b8b7f8182410d1205d36018a432d518bd2f4e3e7c665de0fc83364eb9009d653781fdf0e9d1a8f5df97431447a0ed899fa
SSDEEP 12288:QG/5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:QG/5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1974523485E6E2850D39B8A303FD79460C642AC7263859C175B8BF6237CF8CB0FC166E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 62b46da10bb1ccfacb73c80fc5bdc4b47ca835fadc82d39cdc324fcacecf6b84
MD5 092f32ce10f392c19324fc640c1c38bb
SHA1 91d1d60bd732dad1d5e9567439d091fea89087ae
SHA512 c1b3f246a731d8f7cfef4564dd98a5e12a3fdb928994c7f8391d693049de01ae6c39a0b4b70023c92e9579dafd799ae2348e1a92d3d1fd408fe2cb7213163bbc
SSDEEP 12288:zeBNUbTVO86Us5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:zJIUs5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18365CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a2819c04f2102ee01c9690a75023229ab261e2f92c45ef33d22dc6efa4fe97ee
MD5 377597d31d444f66d541c7a1f7b9254d
SHA1 c404e1d67ddbd1c54661c6bd25be6c5ed0d45e37
SHA512 914cbe47525fa15111a4f6bf49b058ea29198be8694ccba01964b0cce23cdebe4844cd459d808c90d23fdb07e79620d20cdfc82b3b8e4fa3edce48c8e0ac349b
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:JQvGAdlCEL8c/WRNw5C/XA/6CIG
TLSH
T1FD267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 170f2f625ee43e8577ef9d291a7ec812a1b9d31a19afde6278460e8e1790b4f1
MD5 ba1c4f187c4ba1f9ca26c144689bbba5
SHA1 beb1f4a9e58c0a6666ad5f1a73d6ac3ba9227287
SHA512 f8777b78a5a494cbb84c759e5ee9c68e796d9bedab447e9285a5f9aebc1d05aacd424f06b0b841c42132d08185d5cc2a19686e340a129a9ff0deb971df9ea542
SSDEEP 24576:ifewsAj25T+v8zVW76r0KA3qHwg4xteLG:YljuXch/3qHiXeLG
TLSH
T10C75E031FE78E432C3BF0DB21B66C716542DB9204B5219C3E3E88E9E59702D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0dc6f145144eebdb9ab0c6b8c48b7c9ac212e1fefebcc5261c29d5bdd585a164
MD5 c329218dea6398e30670c3af9366d18b
SHA1 8c0668240fe1da45f6a2380eefcbe5e6d6dcaba9
SHA512 445dd8b16c603a91b641d4abb2128562603a252d103a405b24755dcb53ae3d881d186a4ecc483b90c4c4ee401fc4374b84dc6d2bc3e18f6ed4ff6b7b3e517ad9
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHsCIG:rUEtQevvqc2W1cpV20I32sCIG
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4625651c2d1a1552c516825e86d9be768c01dd96b73c02c2418a786e5657c4f2
MD5 6fc9506688d44062c389225198e4f886
SHA1 6d2c5f819856be805e6bb111e89e067a2f429fa7
SHA512 e16d0b0dc462b17f1a56970d69a5626ea55bae9aab4d29cc77bce058a4ef4cb1a5350dceb8dec27709515205d8013469ce1efa4790b98dda1569b95eed43c0ea
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zOXch/3qHiXeLG:/oquVjnmzXA/6CIG
TLSH
T1B6D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 441c8350b97f9c1dcfdadca747ee7ef34eaf155e209aa7a04f247946c00d06e9
MD5 9886609512226f79e60c799906422802
SHA1 ddf6217f5f7abb702bb3cfafdf9663679b71d486
SHA512 434b34afd0152fd4f4b82570595336663d2fc4a2a1c2bccd79213ee87899e4b9ff3dfce05d3a90d08aca85c2cd9743de1241b3c120df338e755ccc26e789e7b6
SSDEEP 24576:HAhGL6IFoiwtA5l7S53Z5T+v8zVW76r0KA3qHwg4xteLG:HAM5Foiq5jXch/3qHiXeLG
TLSH
T16A35AD80EBF955D4F5B39A7899B68170EA76BCA65E31C20F2250D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b7d0caaafdf7187a22833fef0b27529f5bc506e9941bd797fdcaa340bba4c785
MD5 7b5f5f9c0e0e8abf687d9923a3f85584
SHA1 4649dca856a6cd27934637fe3d5399c04b7937e2
SHA512 4378a1778de23db64f0a04ab851617ff08abb12b52ce91975dd28358b1933a3cf6921c794e2730487f7c8b4ebde312d4605c973cf503ee9956be88409d510f40
SSDEEP 24576:ZwuROW65T+v8zVW76r0KA3qHwg4xteLG:ZwSOnXch/3qHiXeLG
TLSH
T19965F14936A91CF9E5A782388697C136E7F2BC122721DB1F1760C6176F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a194b6c13aa224cc88f0ec6ef33db5728d97c6944a312616222f801242c116c1
MD5 c728ef7902530ba5bcea4d127cacec70
SHA1 cd4dcb135069b498b8dc86f2f45f0f8e59353d7e
SHA512 5c71c8149250da434ab066201e21e521c15940e3f2f931edc9063c57451d65a72e6ecc0e8e05fb8b1004afebb64c2de0204d9d9b97449e40d9355ae1d09f68a8
SSDEEP 12288:LyZ1Iym5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:GZu75T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D05512493AEC30F5D29782389EE29604C7727863237247CF165582672FB3EE16D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22de8352309f059191f9e32b17dc551e82a9162354e83c14e1868d8263a0b9ac
MD5 7578716ca5488eceea74c4fd2f7493b6
SHA1 e39377464b7410aa460f2a2ff2da34e46a7da424
SHA512 bc11b7a3b844938259ce1f96474e2466b9fe321bcaf442f452b24a8a698ae978d6d59d71b15555b72cd989c4c9f1c56a021d640f6f72568c0174ad923417f8bc
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3MXA/6CIG:qQyiKanX+PNiCIG
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 18584c114139892088c943aca3476aaf508b761d14fed2272f08c7717b1f53d2
MD5 ba24310d3b853b57b7d26fb6902a773e
SHA1 67eb97df4e510475ee3f4c5b413e31edc110ef07
SHA512 b927eabec35993f6ec84924a18ad774f3e3e607ed5a2257f95b981bd10ea0bb589f4cefaaad9c78f71278111e88eb38c49a7b55a2f5e6e14c654a19324ca0685
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3MXA/6CIG:sQyiKanX+PNiCIG
TLSH
T112667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c80cdd38b04bddd1b0139fe3573ae37f48804fe156051ec7a43a77fd90a8d66f
MD5 6bb84e70beded13983ec85707b205bfb
SHA1 3d4cdaae756046e7516d75ed9c3cfbc18a7acf98
SHA512 89aea2b3d61b639a337d8f4167ee28f7a480747e42c05b8812d16146a80b4fbd4b0d183578fbcf651e450b119db7e50af7b2821688e71fc1e4656d02f37dea10
SSDEEP 49152:M68Qg55nhkeWu7PNU3/+Xch/3qHiXeLG:GthTRc/+XA/6CIG
TLSH
T123B54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 397aa2a38067c277eb0c716dc853a2ab19a364be8a44a7e40e44579800d8fd07
MD5 8613b0e19f75415f684471f7e23f62d6
SHA1 2d214b56777dd31a89a5347518a7a3d40b3ee83b
SHA512 e3ae6af885002b32fbb32c23d9fc1fd6bdc0fafa20877877cd3dff0ae57f6f6c3e74161403d609dd16d469ab33694fff81dc53df4ea974817047999255edc504
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZVXA/6CIG:BLIHRWhvCIG
TLSH
T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fbaba0db877855d30a72193010a38716816cc4a7367966793dcb63183046e7e6
MD5 55d476ffcab66963242d68ece6dc3a5b
SHA1 0ae7bbfd615858f63f2d881b72462baeebeec9e2
SHA512 a830e2e299065ec9900d4a73c995347b71be6a4622fb886cb343c6a2adf959b39602dad04bdd8c1a7952f16e70fcbedc2999f84442de27dd7d573c67a6f60521
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0Xch/3qHiXeLG:Hu6JmIxd2d0XA/6CIG
TLSH
T18AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fbad459ebda2dd715d93266c1c4136fc2654e77b0d1bed538136407ec9db05a3
MD5 614245d36576510d5c61287feca7c134
SHA1 87ced8982e2f25882f83e5eda53ed9fc42b5987b
SHA512 63f13a06d0f508f789555eaf4a67ee57a339a18d88471af24d2f10cde5158e621f88a2d6487ca4da02bde7437ff7fa7a65bcf14ac020e251d5624e270982c88a
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4xIXch/3qHiXeLG:cmifPqRzXA/6CIG
TLSH
T163B5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e1b59e03a8a28c2d798a6fd62f59ced9c71bba281f211d4d2a5d8fd045506595
MD5 645d54b62b441883f7776b4e5d056be4
SHA1 1d0c54ac709684395597d2ae307dff32ab5e2d5d
SHA512 a5930efaac8169c08adeac82bc75f3768006b554a402e24d900ee8e4a1aaa14a43e0d58f0b181bbdf0635692a920f2ca78ce487b3c00bec503fd0226c1523793
SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHqxXch/3qHiXeLG:95dKqi61xXA/6CIG
TLSH
T16CC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 082f76fa5815460eec0e5f9da4436605bccc21e76a4fae42c01e01fee4e88acd
MD5 4e45ed79593071a1f53128a6fb6e301c
SHA1 1389dfee4add923e31cc8e5c67169be1caf9c982
SHA512 70a8bcec665a68af3e01330292d620caafe69bae26cbd31ebd673bab46f794bd24ba1100ee701cd8176ee95b9ea9c42adc13adaa11f03fa143c00952e754676e
SSDEEP 49152:shtSn8EApI0figjgiDn0AP5wUXch/3qHiXeLG:NX2iWphHXA/6CIG
TLSH
T1E595BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 29fedbb85f00f56cf01ed116a7bf5f4d04faec1295c430ad36ab0da7d91ce986
MD5 12d20611fde511b287448a6c9e65f7b2
SHA1 5514689fe6bc147fc9fb151f0ef18705b117ab84
SHA512 6dafcd5a274fd324a216b0ff49322b57a6366ea80dda596cbdf1089a4945c35f4a9add6192f56575ba69e5461385bacb1d7b471bf2688f13197e9019d5dd1ecf
SSDEEP 12288:YH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:YH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E54523486D6F2854D34BCA312FD39164C6466877B386581B2B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5163254755fb21c41f08f2600e3cbd26ea651c19b509734286e7001dd3527032
MD5 07665b73e597374b3857a08c230d72fb
SHA1 e7e569a6ffcd22ec609cceb93e32b473b64daf38
SHA512 045d86442e5c2b39415f5020ff5465c144313434f7344a7b1e6a256b4852712a5f6646646bf6b8f95aad712cee7bdd5227e151f0f97707f25bda0aa695ca0f07
SSDEEP 12288:Yy5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yy5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1B14523486D6F2850D34BCA312FD39164C646A8777346581B2B8FE123BEF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 630983e86f7c061f75f58897a861b1ef4c0e37b27bda4a01fb2e904822022ddc
MD5 26d8a21ba2a93f3a8d6a8a0552af5aff
SHA1 f0691331a21c6167777005fcb1aa2a4e1ba7b3bd
SHA512 a2558dd25f292c8294425ddf90a12d66ce9332b0089b66a7ae9e37ce0928a80116705b2e2c49eb63f7ce60391b9932fad090eb6ba886bc141572b96a1476afac
SSDEEP 12288:W05T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:W05T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1934523482D6F2810D34BCA352FD39164C6426877B386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6f59519f5bc91b12ed242d2cd10c3eec175ff5563447db0637ed4e489932a275
MD5 872f0f957fe6a2e69c7bf705bf4282cf
SHA1 adbb66dd46e4d4a9ff19566859e4e49a6a09717c
SHA512 a3f2154ee4794fdf721ccd3637850de4b25f77b3f2a494e2b455eb277065db564d807147e8160a177d09e9a2d2a58dc8ca8140bc59ed5f5b971667f63a6c4603
SSDEEP 12288:RV55T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:F5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E64523482EAE14D0D257C6349FE39120C2A2BCB7B322995F5B4695132EF1AF07C35BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ca584d67ff4e9405ff969df98fa4c1f5170cdb0d0ed8ee9191c0110f87450fb9
MD5 2a45f6c9b1186d74d653cdfc605cf206
SHA1 95b56abd32cf9b385add80fab66786154362e5ea
SHA512 284db9b3a428a29ded25b8e1a4d065db993cb619e21871dd5ed50d622e7327b5917add45846c4e2a3d7fc808f83d28f7b1921f0b15fa05a034a4dc4d581ff793
SSDEEP 12288:ZR5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:ZR5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1274523486D6F2850D34BCA302FD39164C64668777386581B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 836b6415d15b8cd9776257e55e24ff10ebfc0f9a379c3338b88d715e37da364a
MD5 af0b1d9b981032bb7f1d8b8ba2435733
SHA1 8df90ebb7b22af3a903aa0c38084d494b5704528
SHA512 d6f8355913d020d4701e7955ef4f909d6eb355fd235b49cd0a65fba094a98e874a055f1a6e3d59deda1583ea47469fb573cdde77a5ad4e4b617daa49cf536506
SSDEEP 12288:Xe5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Xe5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T11B4523482D6F2854D34BCA312FD39164C646A8777386581B2B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b587164359e79ff669193a891fefb8340d102e1baac6ab091206c2048c522be7
MD5 2d6cf46fe5c732092dd54730df799d5b
SHA1 a1ed25ac7afefc6fc94ac9a136f53736b80447d4
SHA512 1e7b0106deb001f3dd2c43bcee79ccc1767afd8f12be3982c5803ac404b79297ee6a633b7c89fdef7dcc37bf0cab8e33341b2fee5b3e76394cb81dbc90b05e1c
SSDEEP 12288:7K5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:7K5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1304523486D6F2814D34BCA302FC39564C646A877B386581B6B8FD123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 51d61bf9a7c5e87ab903dcc3c5c502dda90c56d020e4f9a8309ea0d9211a37c8
MD5 53cf65d18779dc75757d43142488571e
SHA1 0b37f653b6dcb9407a5012debc94125e11262276
SHA512 dcff217acc99f69794ab7c4a5706016876b5ea64c3e5985466fdd306861fb83185468c81969ed422decbb5b72277138e4cc8799005c56db0bd58bbed6e2b1c4a
SSDEEP 24576:3ZM3zFVSOS5T+v8zVW76r0KA3qHwg4xteLG:3ZM3zfWXch/3qHiXeLG
TLSH
T12C65019473941CF4ED67813ECD568915C6B27C6A0760CA1F13E836276F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 754d94f5e5d5b9d92c106602759761ab7bee0d248bba3ef2bb617e9e0e7eba40
MD5 5428c18aca3f02b5b0294f7871282ac8
SHA1 37c6630bf6d8d56e5476ea87ef11d7fd5f26c7cd
SHA512 5e8234d3feacf18152160872e23999743d3000523d05a3ca1d0abc0317c5feb3ad5d07b5b2bf80de935387c9d4120a11504f7379d47ae18d52100048c8f4d8ef
SSDEEP 12288:Zr5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Zr5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E64523482D6F2814D34B8A342FC39564C646A87773865C1B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 69731b50981724b54fa5376469fc47305b3f27cb0a57a490ffcd8a0c4ecea095
MD5 868a984ce9d8068cacccf57d8fc90324
SHA1 3b85aedfe22d9ce5b01bb52034de310497d0adb2
SHA512 473253b9020e679c91f740520243688662f648128fea80db72cf6a76935131399d5c164dd207ceb92965ab7b9776b8c5fb139cffc2cf48405015054bf0e42554
SSDEEP 12288:lv5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:lv5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FD4523486D6F2854D34BCA342FC39564C646A877B386581B6B8FD123BEF5CB03C056E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 50d8b7b52aa7fd8d7abcaea05142b62d4b701996bc09bdacb7ad3f437e9c195f
MD5 f50165501d57315ab58d81e9b95d4b0a
SHA1 d3f1058a98d0779337fc91acc834f7bad37abda4
SHA512 6a9876e39cf9c57db0f32dd3a57cb51c3afdced6d24c0bb256e1b2b7e980839f553e1469a6f052a2726a8bbead4c696e174938b8706c9ee50a0221995048a090
SSDEEP 12288:ryPz5L8m5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Gzym5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T17255024777A930F8D16782388D921A11E772B83253218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ef5aed15f6cd00031db4d94c22171fba251c4fc989264bfa06938bc2521737a4
MD5 1347f6bdd2f25cc0a452d9167cf6ab1e
SHA1 d5807477d15734a779058fe045c63f0ec315b3e7
SHA512 c749b2747400e17588f81c6501b1e0c7377bfca89b3604220668a5c16ff8cf58f9366eb03d9b744aa14695d3feab31522cc2455f92e07e421402c9144c6140ed
SSDEEP 12288:Yr5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yr5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1644523486C6F2854D34B8A342FC39564C646A87773865C1B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0991dbc653963e8c75b064b04cb40a3bb33bab64ec468bf4ca9ba2c2e4d6005d
MD5 e3b033f4e825455b8c48ae83df825824
SHA1 ea785e102353ed192183080a8c216c2a6dc6ac33
SHA512 c24a7aa143e44d9fb1fee6f99d8692543ad15b9d31a28d957dc8cbc4c027b62dea5a1c0f97dd562e3934409deec81dd224e4fd330a299757a80a6d226db0f7db
SSDEEP 12288:Ar5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Ar5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T10C4523482D6F2850D34B8A342FC39564C646A87773865C1B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 069328dbd734b63c15275f757534d303ccd0a77cf43792fbe555e2a0c0d73e74
MD5 26779eefcc2decc7ffbb3c8056787874
SHA1 62282f7af4b7c043f6ce11aeb4c146c3cab93eff
SHA512 0cf28a0eda268d7034a46d9b9b572fccd1e5947e7e0acef94c5374b2e3b6862f2caead4aadece8012dda9c657d033f8e71e41eb4bc7678e377f537ef5b4992bd
SSDEEP 12288:KyPz5L8m5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Xzym5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T12C55024777A930F8D16782388D921A11E772B83253218EAF179447772F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d502307dac6bb2902f4b52ac9cd5d00c99f5ab410ac298652a71721fbecb91fb
MD5 39c571ccc6c41202b271a15fb8362af2
SHA1 2a612a0db61c8adc69768a34c8a128904f699798
SHA512 e67878e5c18d09e8f70b611eafccc3546c4a83a124e596b2895391fb048e9fbfde72515ae734fcc6ab760400c8db91f532b3b692bacda6c1c73aba82b372cecc
SSDEEP 24576:LT8aLl3z0zDE5T+v8zVW76r0KA3qHwg4xteLG:LT7LljPXch/3qHiXeLG
TLSH
T137650294B3541CF8DD67813ECD568916C2B27C6A0760CA1F17E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bd0874b86e7e8f78ede8ac2c0334265012ff845853eee28cfac069377b2d9d4d
MD5 44fc1dc5b5c773b143057b8f86ba3c79
SHA1 a658f16cab085893a987e3ac156c1a7e2e114db0
SHA512 f6db1aa3b475c9c0c1e17bc20150d36710b3712dd0ea74c31a9bffe6a9de099e582f83f5a48214089fca893f51ac7ca446267126f9ac9aa93c53cb1d071f3808
SSDEEP 24576:p3rd9CHKy7GZg5T+v8zVW76r0KA3qHwg4xteLG:5rd9CHKyaWXch/3qHiXeLG
TLSH
T18475CF90F3E814E4F1B7CA358D764511CAB67C5A1B21DE8F03A8661A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 040ce9448ccf4f8f8d76e76e774e8640843f0a82647b370e31d3d6714386264c
MD5 c965a93e1d6c2d78f5e6476b34b90cf2
SHA1 7d117317f5f4fbb384739db6c2d1cbeb3d8e0f05
SHA512 ceda313d3c93aaa80e9362f8b5ea3dc8ccf1b03f6fbc1386d6c3adbd89dc29081f8db79d914f5b3418f0d534963968c0e92f5c15ad0e1ed79f02f9f2a4e2b261
SSDEEP 12288:vU5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:vU5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1A64523486D6F2814D34B8A302FC39164C6426877B3865C1B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f52f81f0bc1aca4b5f565faaa5931dcd45d355b08a8fe70a983ab52e619c0a9c
MD5 6a616c00070df3189adc6760049e7e2f
SHA1 d1993f9faff92fd9997bf5cd91ae8b14ee6d8755
SHA512 97d06873657a6e62f32d037833faab27efad5d24aee587b32d64248fcdd33ce9588cab242832d868294e4ac664ecfaf0ce8a20fa125cb1729ca3004f54ac1413
SSDEEP 12288:aG5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aG5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1834523482D6E2864D34BCA712FD39560C6466877B3465C1B2B8FE0237EF5CB07C166EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ba07edd57a0fa8f3affb195a7ad477f1b7669e804677d1ec55c3952a9664db0a
MD5 b1cf3a0b0c4ab44923f71601f479de5d
SHA1 75eb809e136a6c63ca7f622e095b788ef0f59003
SHA512 532a36548ded2f71e8be5e3e3da5cb54b1cf764139fa1bc7ffa757f80c093b65e09368c0bb68c530eb3e190f9e13bc0a75f8c88573c8dc8e34b8474887f5a143
SSDEEP 12288:bd5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:bd5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1514523486D6F2810D34BCA342FC39564C546A8B77386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 bf2b5a2e99b807016c3bca86d3cd850c821ab567a569f279bb3880c7bbae6a6a
MD5 e23d013e6ca0f0bb0019fbe5c1c90558
SHA1 fc6ffaeecb75cfdf0ae79913af6210c137e2cdea
SHA512 598b684bcf8fdaa544828767b93f3d0e74fa94e3cd206e1d604f64487bca2628b38223a0502f43cb40db57a90ba98b2c85e1d296e648101ac754a128049f3bcc
SSDEEP 12288:Yr5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Yr5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T15F4523486C6F2814D34B8A352FC39564C646A87773865C1B6B8FE123BEF5CB03C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 47d27e4e0878cebfcac86270ef03bfbd342d7bc73e1db5bd6d5e9bcde76085f3
MD5 b883992deebb8e6810fd2a179d2d6b3b
SHA1 1bc5abc11e52d05c7d7b6deaae18c01f53ec40c3
SHA512 dd85dcf4a141da0e9059511ddc0736aaed56b53126b8465dc7d9494a64db1ee4348fc14c1a6b63f475847febc936025dcdc4e460a8dbaf8dd9def690cd055084
SSDEEP 12288:RU5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:RU5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FA4523486C6F2854D34B8A312FC39164C646687773865C1B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8d5e67c46259aea9cb232f5806b56cd5513e3881a45d367067f1189b5a092229
MD5 fa75abe8ee59fcfb2edc392e6e50dbf2
SHA1 1aaae969bceb183cb0f5ac6ee121349e9b4faf55
SHA512 73b49986707ca6b39d40b2d3f99afe13a6a226ba75c2c1ee686133478a49a2219d6c5144891da19707086b6bbed77e975d6bb025f83ac84b0df3ffe91ad30b89
SSDEEP 12288:tD5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:tD5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T19C4523482D6F2854D34BCA712FC39560C546A877B386581B6B8FE123BEF5CB07C066E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b82f5da34769782b8718240ccae9f8ae61673cd4148088218df58f343755853
MD5 8dca66c326d7f4780a2d243d42020fe0
SHA1 44893723337ce3fbbf661fb4398c964a28c8e24e
SHA512 51e5238ef49ff9d6d1b5202728e6b91b41259870b883f44dc84b465a8803d7d6d6f769cd630be53185dc426f0bf2d30f849ff745c183de3c8740dfd08feeb0dd
SSDEEP 12288:pR5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:pR5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T19F4523486C6F2814D34BCA312FC39164C64668777386581B6B8FE123BEF5CB07C166E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 cce4c4300c9844e012faf8b103b07ff33851f1f73cc0e06f3a7d9803f01f8301
MD5 77b1c128cf4b3774e61cadb034928e89
SHA1 bd613dfbd8ee772e64e766619eb84ff8e1300d56
SHA512 ef45c8c466452a2def0686f0ddd6477f9757f5a45c6b4b19fa221d5799506ac9c037d8673101f0dc6da131d114ad28a1014d5461b69a3c52cfdeee9f4f96149d
SSDEEP 24576:efwvzk9RX6wkyAIf5T+v8zVW76r0KA3qHwg4xteLG:tMnYI1Xch/3qHiXeLG
TLSH
T13785C029EBDC04E5E177823C99B3460AF6B178691B31C6CF129A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8bfa8da5dd6cf7f8de514c2066894800b3b22746ae45dea63f9cd3f95a74b88d
MD5 5057cdb27208f9a03e6585fac391eedc
SHA1 c1e6df1fb05184d781ba047378e2d1d59fa9df1f
SHA512 c52faceb9f12014430617f7cf5790166f3191e48a709d27f455be57bfeb4002897e3541e71bb26c4a6203317d443b4b7a53546c8ab54fde32a4d92c9db2054b2
SSDEEP 49152:xYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Xch/3qHiXeLG:IySzPsXA/6CIG
TLSH
T109066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c312439d59b1a3335b1845a2fb2a62bd668deb8976032f8c1e162eb1b11d21da
MD5 56836e90347a6652b0bbb8da09bf82a9
SHA1 d5741b122a5f9f183497b179135d9f105fc5513e
SHA512 b9690a0bd5cc279473ed79fdd05f9c4d40017ddf70d0d85744297510c5cdbb874137e5d590e3c11c6e4d54b189f6ca2251a4afd5555a552af7f3991e5379260e
SSDEEP 24576:M47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYC5T+v8zVW76r0KA3qHwg4xteLG:M47JUQjqirIhCnDHUPfF/kXch/3qHiXj
TLSH
T17165AE1DA3EC01E5E1BAC27885554A1AEA71742E1B31CACF12B0837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 483b7f2afb3385d9b6f8b650ef2ce17db2b40b6b0f5cf4bf6d0558a0f533747e
MD5 bab71e69824e9f386afba0a99ca3d64f
SHA1 93866617cb321c719758d0af9767371553d3ff2e
SHA512 b8f0d9788c5afca1f1ded546720b64bd2ec3df9e744d742792706c1e175b605bd216d8e096eb16b5a4467ebd43c921ab8d7381e7a7fe99bbc76f0ab272b1a642
SSDEEP 12288:Qpsf75T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:h75T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18055F009D69811E8C16E8235CB924640F3237C2693E1D7CB57C1F53E1FB69A06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0b6b4b5a3a84285e2b679025705ba8f59aa924967b4c612bcac3e840bb3aba29
MD5 e65c42c4f57e8c8d45f7e42e27c90ddf
SHA1 cd68be7e32433de753b6b2f759f5bf1a2cd24635
SHA512 60e1faafa2c586a7187077f64d2b3ac89a905a6b0485167175f9ab17e80df65e4ef18a114b21a95e5924f9cec143421b3a857a41b8b791658a01dd092f3b5be1
SSDEEP 12288:Z30iU3fLkzhJ0jZSv2sEkcMCv4lmewvWc3uxoE1x72FaRMl+1j2n:Z33UPimPucMCamewvXuSE1xqFaRMl0y
TLSH
T1E73528007667C74FC66940321E32C1CCABB07D51EE45AF0773C88B3F9576A59BAE2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6ab4506e1eae20557bf01dc23aac4c626c05c8c9fbd1cd97fc69957b9e662eaf
MD5 3c8a9e1d2eb5c7bf39c1c3699ce0a961
SHA1 2ea14fb413da112ac5d1eaae7198a29e43bf63f1
SHA512 50b900fee2c35758fbb3c09b8fefb892573cfd6bb24073c34b4734ace81314a6df7c1c7ad704a8a7ab552ceb93833693431810657f844f034a6930a041533844
SSDEEP 6144:I9SZnuYZTTgAgXM8iSqtMxESqtMxh6dV8hYilOudBRyRSwSlXDhYK5TNS:BgX7NOiCSvDU
TLSH
T18065F9406537A38FD5BA6032072A5B4C77A4EC16B7496F22B3C8443ED86AB15A0FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fb25da564c683fa7a37d96607a1dea6249f2b560a17f9ab2bebbba0caf8af9ea
MD5 5e64a8e10751cda86d7166585da51982
SHA1 fa80e502c5a717f64c30362ecee2420e3fe94300
SHA512 2ced0dbed587596e6b34f5c65ede7f608919877230f5690bf8a29e11e40efaa1c7f85f777b71f01bd5ac210ef801edd3a1148bc22343841098af323179354444
SSDEEP 12288:s07T5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:RT5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1C14523545E6E2C14E26B8A302BD79130C60AB876634198D77B4AE2237DF5CF0BC357DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0971feefb2d549008b67871f8020df55391c6884a04b61e78ffffcc1879861b3
MD5 4aec7e008555576bfaabfa550427adb1
SHA1 8dfaa4272c944dd660e8c8540a455bb519097da9
SHA512 bedb78c594fead2a4af26fe7eb89398c9ad10107bd1292b24ec1b5ddf16833bc860566bc9a2cf08d31107d5e641d9b8dd918ebc4df6c592ff05238eebaddfbe7
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYl5T+v8zVW76r0KA3qHwg4xteLG:Rgb4mBIBhGFKXch/3qHiXeLG
TLSH
T14165AE1E22EC02F5E1FAD2B89DA64417D6B278161331D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d75b920759c0abfab52a33cff12f385e64309b884b292ebe321c829e1307b82d
MD5 c097c1e8cd9d06ae8d8e21c421f036a7
SHA1 2c552d4d82b77f282e182a31ea76626c6786bed8
SHA512 e09347db83b18b68d614622b9ea957af58dfba5b46eb3c248f7fa84e2f3d9f48af21d66ee6dd45b10b6edf3398ee91371340f6a132e820a59a6ddb74a1246290
SSDEEP 24576:1G88u8FpJqH1vzria7/mS5T+v8zVW76r0KA3qHwg4xteLG:47ZFPqVya7/XXch/3qHiXeLG
TLSH
T1CF85F16576E501F0D47BC1388A864663F6B2B4251364EFDF07AC8B521F23AE15B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d84496a6b320cb4a315e4a677274f88fc4b042e1400888ea0621d4ddd834d7f7
MD5 e4195fd8977e3067d1da41015ab14876
SHA1 87c8a84bc6741911d3cb22526d7b5894c5414019
SHA512 1ea75582c55cc75ebe7837fad20a3de43d0d2bd94f6208c26d0c95f6b09a92007f2f3f460622fa4b33d3c62414827c5ba4ccbb571ecf31ca154b2fd01fc8387c
SSDEEP 24576:iPUr+NQO5T+v8zVW76r0KA3qHwg4xteLG:iJQWXch/3qHiXeLG
TLSH
T17C65E11E26AD18E4E67BD17C8A828619E772B462131296CF02D1813F5F77DE8BC3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81ed1338fc9bb0e1e0a4746d1ef5b61b2c8dd4cc71651bc03d17a07092be1043
MD5 c2afced28943ba09c5951405dae052fc
SHA1 0cc80345504e32173cd8b645b5304f995d015c9a
SHA512 544f552ebf10fe145145cc55882abbc1e6b2f9bd57ebfe73e013dc8c24614c1d1cc1016018823d8f4fdd6741cfec0cd957830399b9b1d70bce139e900d76f6c3
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmXch/3qHiXeLG:5G05lO43bdXA/6CIG
TLSH
T10ED5BF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1842daf8d5fedef6b71df754bb3fe965b4c01ce710cb8c212e48229e76278d7c
MD5 5110e9a8849176817d66d261e8252c20
SHA1 fe0f3acabc8e18686053d0c61edffdde17643595
SHA512 6dc596e9da3df4121fd8354cf99c2f7958304cd5a46ad7bb35acb931da55bcae68114a7264101b7e18f69e7a2cb2cb31946c8a040a4efda18dfd8deeb11ca95b
SSDEEP 24576:Mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnY5T+v8zVW76r0KA3qHwg4xteLG:Ua5POZ3lJt2pasx2+m+Xch/3qHiXeLG
TLSH
T11565AF5DA6FC01D5D1B9D17DC583861AE5B1342253329ACF122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d41737850e701d77c2786cffb7955ae998c99edb413e12f005383e7bf9d87ef
MD5 09906bb1ab56ddae57b9467cff162ace
SHA1 d22aeb7fc1f1743c9dab3d0d339a610481cf0233
SHA512 a604ed828d4778598a90a7aa50d878521378003f7db0edd3ea73f0a6557c66d86ab6a01509a689ed4866700156c5a453b719c7c9bdea7e8f45f737a52c7bc5d9
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fka5T+v8zVW76r0KA3qHwg4xteLG:oNc/zEOVHF3Xch/3qHiXeLG
TLSH
T1DE858C1623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5261f11bb4fa25afdeab021123f00f7ab29c54a3618a01da0083a64481154d27
MD5 86813ded70009d17126670311b751ce1
SHA1 4ec6b0b69d42d396b397f3de3b4e898ff41c582e
SHA512 b7d186ec0ee64d2d1e187ae0fc239b74e6e4cf49aa0bf89bbc759848a0c39b8ae38e82bbfe37c8ed3f9d2a622a8bbe6bea60cdc29ec7600f4c08aa92eb8659f6
SSDEEP 24576:izkNvNnaFeYhJNtmZBmU5T+v8zVW76r0KA3qHwg4xteLG:izMwBtOmAXch/3qHiXeLG
TLSH
T10E55AF6EBAB805E4D1FEC6B58E238512E6727461133293CB5390C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2456d1a3caa150d88a83d513cb7689617e797c344025e661571f9c95f9e25396
MD5 f81afc5ffceee132256704ac268cc29c
SHA1 2284b6225952d0b5681b805e602dfd5adfe747f6
SHA512 9a52c5e9ccf99c0286effdbf7f8ffb9c6f9be914512cad1287e5b609a963062269f997025168ab09ea823268e99d30d3a35c4509021db19e0b82fc3563366a5e
SSDEEP 24576:vD3FHshBIYQgAn5T+v8zVW76r0KA3qHwg4xteLG:vDVHeBIAANXch/3qHiXeLG
TLSH
T1E675E17DEA5C04E4D57BC17C9A938A06E77138A9032269CB02D4C1B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1928-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1928-54-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1928-43-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1928-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1928-50-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/1928-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2476-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2476-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2476-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2476-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3296-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3296-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3296-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3296-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3296-123-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3404-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4032-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4032-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4032-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4032-111-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4152-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4152-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4260-91-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4260-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-323-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4312-6-0x0000000000B30000-0x0000000000B97000-memory.dmp

Download

memory/4312-1-0x0000000000B30000-0x0000000000B97000-memory.dmp

Download

memory/4312-7-0x0000000000B30000-0x0000000000B97000-memory.dmp

Download

memory/4312-14-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4312-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4624-17-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4624-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-23-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4624-24-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5424-308-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5424-98-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5424-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-104-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5572-272-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5572-65-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5572-59-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5572-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5744-289-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5744-77-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5744-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5744-70-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download