8639f3de6ba89afa0d4e2121a69e19b5d3715e800e34ed93accb548b8e1b925f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260716-pcbnfscw7l
SHA256 8639f3de6ba89afa0d4e2121a69e19b5d3715e800e34ed93accb548b8e1b925f
MD5 112d0faa568262ee3a2ee77d19cfeca7
SHA1 0468b3dad571779cf3c46dac89cd1d369108b56a
SHA512 118f54313a943a5f215cffe37fa487e46cbb9513a6a4eab6a089caedf1919c855f26dbffc4a001be7be48c4391eee2b93b2c3237feb7b437eadc10672bc6f0ec
SSDEEP 24576:dMMF9m96EJz4ddUIsVsjo+NHruc5T+v8zVW76r0KA3qHwg4xteLG:lF8nz4ddUI3jo+NHruYXch/3qHiXeLG
TLSH
T17875E02139E6D072E57346304DBAD21155AFB8310F3189DB37E8562E2F759C2AB32B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4976	elevation_service.exe
5588	elevation_service.exe
2932	maintenanceservice.exe
2784	OSE.EXE
4176	PerceptionSimulationService.exe
1620	perfhost.exe
2140	ReFsDedupSvc.exe
5104	SensorDataService.exe
3020	ssh-agent.exe
256	AgentService.exe
5660	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2bc8edb23e529ce.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a14f2691c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cad64b2c1c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8f31a6a1c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030eb292b1c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf90fc291c15dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9e47a2b1c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
4976	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe
5588	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2992	2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	4976	elevation_service.exe
Token: SeBackupPrivilege	2140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2140	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2140	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2140	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	256	AgentService.exe
Token: 33	5660	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5660	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5660	SearchIndexer.exe
Token: SeDebugPrivilege	4976	elevation_service.exe
Token: SeDebugPrivilege	5588	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 5464	5660	SearchIndexer.exe	100
PID 5660 wrote to memory of 4436	5660	SearchIndexer.exe	101
PID 5660 wrote to memory of 5964	5660	SearchIndexer.exe	102
PID 5660 wrote to memory of 3016	5660	SearchIndexer.exe	103
PID 5660 wrote to memory of 3696	5660	SearchIndexer.exe	107
PID 5660 wrote to memory of 4580	5660	SearchIndexer.exe	108
PID 5660 wrote to memory of 4536	5660	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_112d0faa568262ee3a2ee77d19cfeca7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 1608 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 1608 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0177489da70e3b501bfd113dea084942048468db3c94d7bef10e890e72981eab
MD5 5fb4e21605fd268ba19f006ae6c9729d
SHA1 3d57564cacbd7b05193f54c8ea4337db02c29550
SHA512 c0707a4d0840d0b571f3f7692c99ccd0c33d93777dbea52d5887db118cb17492ae17a6bb7287280716d2af6a7f58dc0648aedd0ad7187239bfddba1d601a2d47
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNXch/3qHiXeLG:O3q6mjBoXA/6CIG
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ba4e41eedf374d1b4b7cf8d1e87fc08156217eea0de313b9c1fce536f87ccaa8
MD5 81659f54292165e9eb1978f3bc262d77
SHA1 3da6fa3b9ed21715a3844594458eb50e1efb1fa7
SHA512 743e1aabb7203fe9d51836784d4ca93d72afb47848d1fb870ece966217a690f9fc6332236bf9391e496bf2f34800a633295a2e17aff8855fb2bb37009b1e15da
SSDEEP 24576:AXYfDtczAg5T+v8zVW76r0KA3qHwg4xteLG:3tc3Xch/3qHiXeLG
TLSH
T1E465012877E908F9ED67823CCDA28511D633B8514360EB9B03E4D9261F736D46E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5f482262356950139a583b3f8ffc828520410b91669008bbe50202a3164424c7
MD5 52fa008699cba17f0ea6e02ae5893326
SHA1 0f6797a5189e8d40944eab07240f3f731040a75a
SHA512 a2285d0b912cb4d21cda36ddf82c9858ba9b7e2c8d434e0a46ef0c93b5a3be006fc36250d9e3154b937baba4eec0e27baf1d826d9bf011690c3d634451271c67
SSDEEP 24576:20Le5ji0hmxhrMP5T+v8zVW76r0KA3qHwg4xteLG:2Pji0AziXch/3qHiXeLG
TLSH
T10985AE15F6788731D073C0B9C5D2A69EE972308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca6c2e18516f04ef9177b395eb422d401122a5f7216d26fa534931a1ebd7134e
MD5 564cc665c8456ef8ba1bde7125718c4d
SHA1 8200c6f226c077ad3921f4655b27f979c87fb358
SHA512 4278d9e583c968700a43d034a3c2842f2ddaeb839dd76fa3a6b0400415c79634f5308915df9c15f0fcf983930e0e42f6b6cff75551d89f42b0a43f30bd5238eb
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyut5T+v8zVW76r0KA3qHwg4xteLG:m/ezSC6vUzPv+HjyGXch/3qHiXeLG
TLSH
T179755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 19e789597ace35dfbd2a789d5530a997645a8ab188f667dd1904fc2eb523f200
MD5 8ffb068e8316399350b544498073353b
SHA1 7e20e5bdeb12b137b07fe001f5626c70fa4eb124
SHA512 439428962c90934889f75da4ffbdedfe912d399bb28c0a85d95ad70e29f796926ff49dc57ca6d15702d2bde69de77598c056dcbfdfe300eeb0d460aa3b2aa513
SSDEEP 24576:8VbqPb88hv/l+B85T+v8zVW76r0KA3qHwg4xteLG:8VO88hXl+CXch/3qHiXeLG
TLSH
T11D559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 94649023ad46875e72ff1ebd1f338fad69a68ac181e473a57d466b28b0f51563
MD5 6ae988ea5fed9ee5891df359044e6c6f
SHA1 9c3fa8994941b2d2a9a5ee1fc9e39990c8922502
SHA512 09bd92a3e0a4205d38b0c04e2904858e3f3a17efdd4d2cf0788bc7948e00659534922ba01a0f1cdfd76f98a20302f7e66c5c80fd1f2d7d1cac2b58d4057d25e3
SSDEEP 12288:JGL5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:JGL5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D14523485E6D2850D39B8A303FD79560C642AC7263859C1B5B8BF6237CF8CB0FC166E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2fb0951a0e5c1d2d28f274343a18b452d5c532bd21c54c2fbd1d276ba7316b83
MD5 7f72ba42c851e0c08dd9dfb6b9bed6e9
SHA1 dc15303aa06e592b0d69b9758e833e8064c666b7
SHA512 a57ff6d7a68ab1055b5b138dd0be98a8d9e146c125c4930c79cf908ad92512692ee0c05d1dc84dbd83e66b1e738bcbca3279706a1460ea588439278b3acfbe2b
SSDEEP 12288:BeBNUbTVO86UE5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:BJIUE5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18C65CF3BAE28FCD2C27E8D795B918600D77278714B52A3CBD165C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9069113d1c11657d908470ca7a126533104cad6cf0b4fdd967341c8324104dbd
MD5 f1dd77c4d72b2dbd759e29c3eadfcb2e
SHA1 6d103fc68b60c6d26e6877fa93fecd0a6fb78ce0
SHA512 8d5f6184825744055b4670079c51b89edbbe9009d76072ff8e447082c78fabe44e343accdbdd26c67b05180763ddcc67ec73787b36b1147397dfd0b90ccf0583
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:IQvGAdlCEL8c/WRNw5CXXA/6CIG
TLSH
T121267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8dd86e5bc0fd65d7638f284b24eb558976775252cd0a26d7abdeb3450ec5171d
MD5 31a78665014d155f8e12c12f7a979529
SHA1 8d580c0d62f7599f67898c212794d019db01c823
SHA512 26110b744e51aee3f887acd4d570c12892e21f9cc0206be1ce8bf7bcf2737a373bc97ac32ceaaf9715fae1e06980d05c6ba9ba072163bee827b0120d6dc1830c
SSDEEP 24576:NfewsAja5T+v8zVW76r0KA3qHwg4xteLG:RljyXch/3qHiXeLG
TLSH
T1DC75E030FE78E432C3BF0DB21B66C716542DB9204B5219C3E3E88E9E59702D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c096b55dd8f2381ec23b6c0215af047a96c1aab29ec9533cb62c5c4127c61cf
MD5 eaa54cf2250a1744c3cd6f72d844f7a4
SHA1 a3a08c00bc8a8781162ee537ed566c446acf509b
SHA512 0c7f06ac052b99bc4227e5605299f4a1461002e1a7f148fc83939d7111e11c57ef61511ca56330b967db3f607f5047e84c3561ea8befcad1e8d42e27842f7ed8
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgCIG:rUEtQevvqc2W1cpV20I32gCIG
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5525f1069ed54662f4d6e863fc5958b8be7806413a4a12930c64d81dbc492247
MD5 5f107a0854b137f82801765d1791d86b
SHA1 5679be07c17228d6e007f1eda2f09799cef1be44
SHA512 065ef06385ea226dd42c8abfed9479c25f6db872735d267fcbcbf48af7af156187480557b9222668e74415ce70c79d87d604fe357ef1fcd87430a2a4cb2dd03e
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/zSXch/3qHiXeLG:doquVjnmrXA/6CIG
TLSH
T149D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4e81b2ff94c230254525436af7f35c82c12b2a5857091d8e23dccee4bd63a2d0
MD5 2b94c62e8d8d5c70af1740b5fe277d27
SHA1 97493cb8a9bfc5f465fe850abc34113e9b2f1b70
SHA512 ea900d3f9baceee86ed9be85351ece16d5160196081d48a192215f8ff466bf7ef08093c343cbf39237f7c39481242eca4551346caa12e50263c78f87d828946a
SSDEEP 24576:IAhGL6IFoiwtA5l7S53h5T+v8zVW76r0KA3qHwg4xteLG:IAM5Foiq57Xch/3qHiXeLG
TLSH
T17235AD80EBF955D4F5B39A7899B68170EA76BCA65E31C20F2250D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f8b1abf6c27552f6489df6e53b61a3b2a6335a177e6e04f3f0e437624c2dceeb
MD5 1591494ab29385472b9414d3d78e28cd
SHA1 1d8188ae35f755b349f4753ebe930bf551058e9a
SHA512 add0db1a8f0d5be5a4ae275c2f10f096a28cb931d42af05e1835185fe72eb72ff9659f17afc891005b52a52e30081c578c7fdfa4935128c01a6612cc5aa215bf
SSDEEP 24576:zwuROWe5T+v8zVW76r0KA3qHwg4xteLG:zwSO/Xch/3qHiXeLG
TLSH
T13065F14936A91CF9E56786388697C136E7F2BC122721DB1F0760C61B6F37260BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 09effb59fbfcfe7b1fc75fcf0df4e8e6eb4e0c6497dfcfd82ece4ecca23ee95f
MD5 730f6df4bd6e8a1166bfe94e320f9815
SHA1 a02957ee19de792b813fa452df5257c7ad37caf8
SHA512 329775629f645a4bc77a1903cf9057c42992a76aa38fad0d89de8142270098e73167976d60880d87c0b6934080b6dc12dbcc0abfd7ec2fc57c7f71c1810440e7
SSDEEP 12288:qyZ1Iyq5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:TZu35T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1E55512493AEC30F5D29782389EE28604C7727863237647CF165582672FB3EE16D39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 98da885288a34542c93bf0d58cd01c3ff05657bab65143f9daf14b809febf289
MD5 f1129cb442fd76e0c393eb5f150e3055
SHA1 2335a11575fa01dddbb7e675859a9c7ccad7af27
SHA512 0156a9894c1b7cdf3deaf6a6fc22689f545b2a78cac3cd0717b09a3d9fecc06c413229d6547e1e1d2a335cd2c6999dbe3b5198d103d4b2bc81e924ab4504f494
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3kXA/6CIG:JQyiKanX+PN6CIG
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 22bffb4dc973ae54910fe85dcdb0ed61a1e2de1f931a8a5d56cfc8dfb813025f
MD5 8656a800528743ed0de082e70a4c7ba7
SHA1 ad94a66dcdb8c4615eb5cd4b0e17eb5daa2719d5
SHA512 4eb629cb4ad0392250b2fab28f7bd7e718b718cb6bf06a99bae233ca8bfd0fee2fd9dab832cb8488fc64814687fa85b8b1ec4c2e317a81d15d281699fba8329f
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3kXA/6CIG:dQyiKanX+PN6CIG
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d9b3427b23b03b256d5aacf1e96e7d22c8d53ed8c692aa79ce260d59dce4b39
MD5 0000c6ef7959fa32fce8daa4127cd191
SHA1 1c6805ba6a931be58c398aaed2e44a0985b8e3e0
SHA512 d15db53c8d189ae40254ae39c0821ec8395e3af6e7b07f95b5c1c672848cc33cc08065633dc9280fd1bbd5673a5404cb00c71754aea34696ed1d0d7cf235a65b
SSDEEP 49152:M68Qg55nhkeWu7PNU3/iXch/3qHiXeLG:GthTRc/iXA/6CIG
TLSH
T1D5B54933B2F600A9C44DD1769F4A872196D27C758FE0E3DB860572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 559e350a73a7bcf32a9f741a7c4db0b2f7db650690b6806dcddc0252a3a90940
MD5 b374701e452432882f63ac17c2adf3ce
SHA1 04df16b619f32b44563d10f6c642cebb47b93daf
SHA512 12a7da0cf6fc8c9dbf555b47a00c542d9a6ef7e700db609cbf67e11d63b6cf444df86ed43dc9ddcfd4defb96712fc04d319448b6655f06fc8787e2ad8cd0ef1d
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZBXA/6CIG:+LIHRWhHCIG
TLSH
T17F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f90c5cb88a1ee90a1712dd4e52805713a48ddd2f1e80dd18fd2a83261ab2485e
MD5 721bf4279e1ee6c4bde01231c90a32d0
SHA1 dd0c69a8d9f72d530d00e44b556e395f539af34f
SHA512 8242cc5fa883ef7a72bbb89c704cec4ecb41b12d0a2fe7c57f6ed319794fbb797dc08b3e3d82304e07b9eedf3663e00b5a6a939fb160b808cac923e08d23e902
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPXch/3qHiXeLG:Pu6JmIxd2dPXA/6CIG
TLSH
T147D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5fdcb793cce7ff1e1277574758ec277d490376421aa3363702fa3bf0384fa173
MD5 c5683b69c042ccdfd8c9a38742f4d9b6
SHA1 f3b1f0a6232977af9b1004588e5e4f491052405e
SHA512 02d0ef7c5e423340d20aa891c9accda0e1f2d846971481397ab088ae6b19907a8661f1143f72a262a4af2058285e3daad43709d1943477f10ea5ae4eb3dbd389
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4xQXch/3qHiXeLG:amifPqRrXA/6CIG
TLSH
T187B5AE13F2D900E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a96955fda4c37127a0ec7079a07d181f24712ddabb6c7e581d3b16b5f7d6e618
MD5 640dcf7ea9688fd4f32141d4064da827
SHA1 0bdccf4f4bbb88a91931f8a28883299bfb57989a
SHA512 0df5363228cb82d9567dcf305dd60563879ac1e1cdca24ea82c761658a17fe1996f4033538095993bb51285c6cda593a18716ca9131c50042e4afb73c05f9c0a
SSDEEP 49152:HSuZQIY0Be2KkRVtOnks6NMHqdXch/3qHiXeLG:d5dKqi61dXA/6CIG
TLSH
T1D5C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5bbb6715c4a879f1eade1fba3e75f0e5e40d98a1464f686a8ac2958a6df66329
MD5 3df81d0f9805aeeffc889bc0f74ed86b
SHA1 c6cf1bc4479742f5031456c9fd11623187fd14a8
SHA512 74f8adf30d2b39ae121e308b7dcefcb2ada15a859a4427bc4dc8a64ccea26ef5fd15244e08345549345015830422a88f5881b77ffc42375814cf79d159fdee13
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wsXch/3qHiXeLG:sX2iWphfXA/6CIG
TLSH
T10895BE13F2D900E8D05EC178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c330937ae43fef3acfba43fe43bb5cbb3c92b9911b4629e3de561d26f6324c84
MD5 91ee10b3906349b9c9de2fecc2120952
SHA1 dda38d907a0ea50566b3c7b2e1baa9482f8e9f69
SHA512 d0ab49ebdaf1d937ca214b6da1e66cf646cc926614f8e0f3666acb31374f2369a8771f6e6bf01f9f28559671aff4f3bdf1e790768564a2afa9447a3eaa670113
SSDEEP 12288:hz5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:hz5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1604523486D6F2855D34BCA702FD39164C6466877B386581B2B8FE1237EF5CB03C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7c23265f98aabf770f078740042be43414dac557162010bd0de4e99f806a36be
MD5 31bc35116440edb8a6c806de60a558be
SHA1 8318fcfd97701e8fc8c822b84fd5048d860bdc6b
SHA512 58ca1239507ad0706d80d4ca53cfae95a23dd9d33a80c1208bcf8b2b17175af0b93be78ed5ec6d63dfdd31a72b3ec9c8502589862f2929f9b13dc3c9953000ae
SSDEEP 12288:sW5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:sW5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1BD4523486C6F2855D34BCA312FD39164C646A8777346581B2B8FE123BEF5CB03C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 851c6caef860b5e0ba8d3812f01ac10771e945744f9f7ce68a11d55f2cbbc6de
MD5 3f05e45e389037ea3bdc59d2c8652408
SHA1 6d1bd672b1ba13bf08923c9c6fb72b05e7d6240c
SHA512 5aa1b03c7200240e338b005726d753ede6fe9dd4e6fabe80982658e08e8cf67db53e1b2e280eaa5c687f993774757a1611365ce12a5b844cc353ed7293d2d682
SSDEEP 12288:5s5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:5s5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13A4523486C6F2854D34BCA312FD39164C64668B77386581B6B8FE1237EF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 be12dc71f8d54b16edeb59478bc3499a50a1410fce00ee8c739382e2728e858c
MD5 b7ed6e92be93e397d8753dba794218ba
SHA1 1eb0cad1864ecaec617ea059bf7630b8720e9a1e
SHA512 4b2c65b64cb112027b430b156e9e3f66dc967c7db8cab0185f2157d18fcbc57831486b575941781407f1d8a8d6a5f83ca252f12d55e930e720286430315489bc
SSDEEP 12288:jVB5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:P5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1AA4523482E6E14D0D65BC6349FE39120C3A2BCB7B322995F5B4685132EF1AF07C25BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 42fb5f554ce948a119bcb3b23dae7e56ece250c7d524edaef5d0674bb569a729
MD5 718fdda17c2a2235027b61d410a4e95d
SHA1 6c476bde8073647cb9cf8c4103c1c7c60b1312ba
SHA512 2172c1d0ff5f824396f172fade1ac80394d97f044dcc123cbea1f9e4a407ce457995b9ea848103aacd3522d4343640d313cf173c3358173200837de725abdbd4
SSDEEP 12288:W55T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:W55T+v8zVW76r0KA3qHwg4xteLG
TLSH
T11B4523486C6F2855D34BCA302FD391A4C64668777386581B6B8FE1237EF5CB03C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 483d464866fd8ca0efcc43907dbc1788f1358a7ed6765e640c2854f5fa2971d0
MD5 26e7d298b1b63281cf1d3fe4b96579db
SHA1 34b372cf805970724e3a325d7ccd9890fc099ed7
SHA512 58251f4d8fa2649351583531a916599af091691e50fed3ad2e7e6f0b9ac0140a25a3250171b2aac3d27162800146ba9c7980a9c15bf44768ef427eeb282e9366
SSDEEP 12288:kC5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:kC5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1DE4523486D6F2855D34BCA302FD39164C646A8777386581B2B8FE123BEF5CB07C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5bad529c4e6fb83c84d058a4024b089e7d6acd021748cc3d160fb3c3548a8248
MD5 f57e4f02966f97e9040bfd432e0a16b3
SHA1 9b6c364adeeaadd6c6d79c2f8715f146a8804cef
SHA512 fa7ff2178c5d3655d236dfffef6d123407e9387ca6960e3f9c7a9dd9071719535de472e3bf3db7187dd288ab07b6d1be852056303120335757d211c99f8fcabd
SSDEEP 12288:IO5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:IO5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1FB4523486D6F2815D34BCA302FD39564C64668B7B386581B6B8FD123BEF5CB03C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3d00986d1f1b07f49610438b3b20ca00c016dde6463c41267fab689c4fef33da
MD5 37ed84f9aac8f5e0e4c3a5aca89e0493
SHA1 dee2ed76461726b4ce5da446e8fd3e6485bbe36c
SHA512 eb283b23a38f97fa4fd3edb1e6e7b3c99e7aa14306e5f2bb25899b40ceb75081e543f62bdfbbacb2f26d40d7201c2574bbef28434e816b3bddf975d26c364182
SSDEEP 24576:XZM3zFVSO25T+v8zVW76r0KA3qHwg4xteLG:XZM3zfaXch/3qHiXeLG
TLSH
T15465019473941CF4ED67813ECD568915C6B27C6A1760CA1F03E836276F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4836561ffaec69fd27061d5748de32e840a35c662429a676dc987c300738e439
MD5 e46e12f04ae5d4cc728cfc4e44837a79
SHA1 ac744220d0347cd161bb8ce516fe5de4e134fe19
SHA512 ca7e42ce15eec58c2a72616403a181a64183e12a0d34e40d3e8dc60fd1eb88942a3f26aa804900cded0f9a54ec949ce260757088dd12c6ea17ffaf2fbfef1bb0
SSDEEP 12288:AH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:AH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13E4523486C6F2854D34B8A342FD39564C64668B773865C1B6B8FE123BEF5CB03C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e7969068d5b0239baebf7b2083a83594593fef2a0ad0c832b97c648743b4e466
MD5 a22d0e3032d96280662862544615870d
SHA1 70d0f8de97e421a49b2bad51bf903afcaa91e1b3
SHA512 ab4ce93588f2b1766c5ee3ccf4eaf3946629e584dded5373b05742a7b453c7fdcea4a187163fba9a7c4e4b3c699ad83205c95c2973e26124adda1f004c050ffe
SSDEEP 12288:Qb5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Qb5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1504523482D6F2854D34BCA342FD39564C646A8777386681B6B8FE1237EF5CB03C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e4d74d4db77d8f8c510dbae4e175b91c18ac3b0a0294b9ead6f8c7a0d19199b1
MD5 e92173b016a4264cddf71142ab2b2c4e
SHA1 0505b68b17512c49db58730aa1a6d4f2b63b1a35
SHA512 510b879d0d6897f0ee3d62533fd0841e1c5066febb5cc16e50d48ca0a0effeb68935c0ca3f3fd542030afa2679b1e083781b09acffd0f2ede7c16b1834c9ee95
SSDEEP 12288:ioyPz5L8q5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Qzyq5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T14455024777A930F9D16782388D921A11E772B83213219EAF179447372F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 771daffeae1524fbf44523d697d16b03722eff70f9d8658dd17e0b0b1860527e
MD5 a3aafaeb41d593c732e820c9d60b4c41
SHA1 22227c7fb86ad8c34a3e0d4c4e4665aeb890f172
SHA512 eef688f2dfc94edd6fc2027531a144577f3a06ce00e06be16c37b03ccc4c5b8d30be424887229f0c3161c1bd652555be9c15e48c47e3f96208a6a021c2c0250f
SSDEEP 12288:aH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1684523486C6F2854D34B8A342FD39564C64668B773865C1B6B8FE123BEF5CB03C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3e32b9ab7569b1c8ec040873d63e9554b60fce340d70faa83660b1d2d37bd244
MD5 2d40e14ab84e910e2507a806b6c8de7e
SHA1 5c7addb3b228df3ad0ee7e25001dd3b139ded4b8
SHA512 420eda7f7b8b680aa025c9a0febf171949df075b5e0c505e3cc5b21345ef2ee9fa057a7e1bfa5872e94b62f9b05136159b92ff22ab2660b3b54bbd874551a6eb
SSDEEP 12288:rH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:rH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1F64523486C6F2854D34B8A352FC39564C646A8B773865C1B6B8FE1237EF5CB03C05AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 730b5a99500811c264b7a932f292b2cf5496233adc3bcc5fdd9451a86b811584
MD5 6b584940eed176abe399c6737df3e06c
SHA1 6a8e035fdb34bb82f72320ffa0b9fb269a084dbf
SHA512 b96483e649edcae31b6bc02915159610b68eacfda1e2b678f3c2671b5293394990312e2137f2699ae14d8335bd9b3cac4a2fa86b70ccd2e550727d70ba2cf0a0
SSDEEP 12288:gyPz5L8q5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:Rzyq5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T17955024777A930F8D16782388D921A11E772B83213219EAF179447372F776E06D3ABB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a81db53cf23ccef5910c859829054c5843d87c8b9413d4b3e92d9a9c19c55afa
MD5 bc5cbf4ea6c3e6aec8e5d5e19612e518
SHA1 702eb400cd9b4caeb14384278ab3bbcc57411dda
SHA512 4cba1a15bd1a8e9585737001bd1906f514f8a06b0052e1fa29d34c630b1c32e0df17c16451c9af65ca86e4ed30066a9a7e29144e192cd61b315d84ed819cbd25
SSDEEP 24576:zT8aLl3z0zDc5T+v8zVW76r0KA3qHwg4xteLG:zT7LljHXch/3qHiXeLG
TLSH
T150650294B3541CF8DD67813ECD568916C2B27C6A0760CA1F17E836275F737A01C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b4a8e7810eeb16abb1a5a877f51a309e1ee622044c7e44effbc602ce0f7ed839
MD5 ad0f63719a6afcb5326f327d23b7ab49
SHA1 7975c7d88aa0e98633959f550b79080b2465d486
SHA512 64712a157ffe70aa859602d08fc1c3d7d236257a0f0945e54a93276cc16440a39ecd797edce98d70c8cf9915638b9dd18664daefe9ec0b35b363bca652894756
SSDEEP 24576:Z3rd9CHKy7GZo5T+v8zVW76r0KA3qHwg4xteLG:prd9CHKyaaXch/3qHiXeLG
TLSH
T14575CF90F7E814E4F1B7CA358D764511CA767C5A1B21DE8F03A8661A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8a973a9a0a85e742c47f32e58911cac86af6f0b6ea511204388eb398bbdc98c5
MD5 740fd0d08ac8c21bbf215229e7480e5e
SHA1 5bfdc7ec6208c94f94aa118a50a149a578f8810b
SHA512 06ade884068514d5e106e86cee49ee3864018f34bca26e5369a2f0d941c67bc3cd2f76da2c80ae0c3a55039489daab7cc1ca29817fcd072f9f2732f08c40730a
SSDEEP 12288:uM5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:uM5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1F74523486C6F2854D34BCA342FD39164C64668B77386581B6B8FE1237EF5CB03C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6d13ad7de59f2289937717c585714825cbc32cded557c4b60ce00d0fae39a591
MD5 3af8b8f5f293683ffab23f4da8eaeb18
SHA1 6410a1a1572895f377c02f1129bcb5045c712888
SHA512 3730eb779ef8e5a1cf150e4b9c904263be19b148dd19a8f736de075e0d8c394d03eb4dc57e3d6ba115c439c713defded5008e44ee54fe3f6e8077b23b41467b0
SSDEEP 12288:7K5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:7K5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1104523482D6E2864D34BCA712FD39560C6466877B3865C1B2B8FE1237EF5CB07C056EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e29b0f1cb2e79a3a40d84552345b91a48376de886e01d89be2ed56dffd7a35b5
MD5 788d57bcb404677c844ef137cdcb991e
SHA1 905a0560cded82a05a5ea522323b4658802980e2
SHA512 ffe9f73f0215a677d5c37d34def5775a3423286710817ca7bdc5c48b24d6e5042f8a98981961e1846039205baf7aa8e9dc9ec794274702489560b171b9f2a72e
SSDEEP 12288:oF5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:oF5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T10F4523486C6F2814D34BCA342FD39564C54668B77386581B6B8FE123BEF5CB03C15AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1a93dfa3f510047394b1cbbe814e3f2034b2e7752d74f11338595560453df7b0
MD5 a61c72ffdf73097d390cccd666820410
SHA1 1664efc47d6e9af5d0020bae85adb45ea6daff38
SHA512 19726038736a9777812d3634565e81d56edc4d04bc62e07300edb218caa4d1d38570908b387f5de3f69d7e2c0a58ff51e5f25376bf9831d2b4f2827be3356c6c
SSDEEP 12288:aH5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:aH5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1154523486C6F2814D34BCA352FD39564C64668777386581B6B8FE1237EF5CB03C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fd9e2327bddba350960941e7da53f1ae4acb600390dad0bdde9d92ee1950d67b
MD5 fc8f9c2dbfbad71d948c24113d2125b2
SHA1 9aed789a5803581fcbd6db7c6f68a38f446bcbe8
SHA512 54ee8a4a87cffc314b41d8443549077e40623a272945bf995a800f5a5818a1da7f9669552792cc459d248bfe902c861b3171be1970d5eccc9e2108408ef75161
SSDEEP 12288:QM5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:QM5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1D54523486C6F2815D34BCA312FD39164C64268B77386581B6B8FE1237EF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9c563e940bc130d5c8ec38828ff454e005123fc72af1fd5a82c35822716ddd2b
MD5 55716791c78e5e975beb9a03ebd56b4c
SHA1 7ccf42c995518720c13d6e752256fe4bdbef3119
SHA512 b76122e37d8fad5ca3708cf73549845b99e68725a5015fa40b21e54d80ccfba5e8fd95f1b66f3fb8cf39e6a71a00d4804556f1094ec33b36fa5dcd9f944dc1f2
SSDEEP 12288:L/5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:L/5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1CD4523482C6F1854D34BCA712FC39560C64668B77386581B6B8FE123BEF5CB07C06AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4935ec08dbe27e0a07c5c86d47d5a6aeb956ea0593fb60f5526bb4ee655c8ee9
MD5 71657fa1b05dc53dd236945318238d1a
SHA1 0aeead98f7e48d47a8fc01fa56efd5dc5a515409
SHA512 67281ece8d418f2db8895e6328d39501ce4b2181ba2430fbfd4d13ad8073b9a50ea8e8d3bff368d02e7d68cd3c4d75d8d7d8c30aa3fb61d167fe5467799c5af1
SSDEEP 12288:055T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:055T+v8zVW76r0KA3qHwg4xteLG
TLSH
T18D4523486C6F2815D34BCA302FD391A4C64668777386581B6B8FE1237EF5CB07C16AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 737e760d980609930b1413d77f5cbd8847637d3b7c90cd57ddc2beb6731d5ef5
MD5 752da9f5782172b42b2e8f4b2974d00f
SHA1 02b5c6a97d14ef8a44426013920cef5cdb619d08
SHA512 5102ec43de8e6052125cd6f16d51afb6d5aec2e6825820a34cc874a5862024e22b2ca7d785b3e404e47a29200a4c20a0ca2ad50e3b0976bdfad20a04a15237b3
SSDEEP 24576:6fwvzk9RX6wkyAIr5T+v8zVW76r0KA3qHwg4xteLG:BMnYIhXch/3qHiXeLG
TLSH
T10285C029EBDC04E5E177823C99B3460AF6B178691B31C6CF129A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 de098e0fc04608286c40f94a2898be059a6de237bcc7958dcf8e50196fb13edc
MD5 267e20bc0ced7aeffaffb0c8443df877
SHA1 24842ce7e5bee86dbac8c74d1816619c6a61872e
SHA512 14458717cb69c99c931bae94ee9fbe45b5066849fd5669713d5c1dba8ebc719e7f37ce31e823d24dc4f75cbe939d54a2a3dceaa7330e5caac461acccb0734e96
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MXch/3qHiXeLG:KySzPEXA/6CIG
TLSH
T1B2066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5c0f8c5487d17cd6bbe9865ab2dfce184a4ccaf7b1c131108f29dee96dfa4f48
MD5 0df2e6431eb3f0be201db22a07170985
SHA1 ca8698de525f3ab4a1886977b53e6a614dcf0f63
SHA512 8b1a3285058af9b87dffeed3a327286f8dfac93d4b8dd556778c15bc44ff19bdf3aef0e5ac71622a0c525084ff1037f07c109c996890cc0ad83b4e0717a53735
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYG5T+v8zVW76r0KA3qHwg4xteLG:847JUQjqirIhCnDHUPfF/cXch/3qHiXj
TLSH
T1CF65AE1DA3EC01E5E1BAC27885554A1AEA71742E1B31CACF12B0837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b31ea0e2e8cdb39dcf6651da3cda6d2685855f46423f04dd3e9a6fe4e3840fd6
MD5 1e91cedd863650e56c2f6c57fcfcaae3
SHA1 69667fe5c316a4fd9d47db51e272848a29b4d3b4
SHA512 9a48f1bf8507d5284ca6faf0f186aa61c7a9c77f93c3dfddf04650442ce7687f80a08dd6909e0d9521c61efa3ac8d0b8a9c593a2f05321359d36e699ba7b25ca
SSDEEP 12288:ppsf35T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:K35T+v8zVW76r0KA3qHwg4xteLG
TLSH
T13A55F009D69811E8C16E8235CB924640F3237C2693E1D7CB57C1F53E1F76AA06DEAB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 adbc3edcca998252e34e63795139d71b02ccb9fa8e9dd962088871f020d07c8c
MD5 101b579e1f865fb9df7c36571ebd61ea
SHA1 769a7195fadd51a8aa707d41c93409034dbdd3b4
SHA512 55abd1eedd72e2eaf2c57ac72fe08ab9beb8d51b25305599a5d6948133ab8d4a1326e08c3c610e52f55f92113b62b375c1e214073e1a643b4b0fea934161c353
SSDEEP 12288:Y+jk6U3f0Gk0bV0MGQR+qzMaoBEjrmPOmb/pKv:rjPUPZbV0lK6EjrPmb/Y
TLSH
T12B351741762AC74FC6AD40361E32D5CCAB707D01EE44AB0772C9973FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 07dfde7445106c23fad9811cf598475c6e0b236775fbfd120d9f184402c93a53
MD5 384d8854d22395d9ab6f3ab7ab35aaf7
SHA1 f493ea86984657bb58d5dfe871eafa88e0c3fc0c
SHA512 94a51d97d1bf10247f93675b6775830755b00ddc97d864316f17eda7afa78309549cd31b3ef5f8cc644f516785cb6851c382498a686c9aa521247ad0a5b2d944
SSDEEP 12288:vnFoVcSBWKIAV/xbSps928WjbJFoXD7jMcXIa30qJCj3qeMzJWIj/d:UWkOqzrj1
TLSH
T11265F9816536A3CFC0BB6071076A6B4CB7A4EC16B7495F26B3C8053AD86B711A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e1e2c3f583bd9d19855e7191019a2cfcd7de1db46221513199f72d7fc4c9f0b4
MD5 8b4e7c56d3a77b8130f487142eec407e
SHA1 8e4b21440794e45c5485097fee7832550d53965e
SHA512 e195a7199908c34bf9837082edfd669c4ca1cf79f21cc88309525c44688ad6b09a6ce7ae4fa254bba6444b705ecfa346a0d02e93414ac9e05090f6d7f375c009
SSDEEP 12288:y07v5T+vHcVe02y6njHFtqr0K8hd5WbtakutMHFCIaI4xte+ecUxg:jv5T+v8zVW76r0KA3qHwg4xteLG
TLSH
T1554523445E6E2C10E26B8A302BD79130860AB877634198D77B4BA2237DF5CF07C35BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f3f004f456f1060fb68161369aeec24c40078e3fec8dc5cdcb0629ed70c32c6d
MD5 a2c5d4051d8fcfeaa44b80c4c7915c88
SHA1 0c74fbb938177e3a6cdb6420ea3eb35b604432da
SHA512 a820b97baa95cebbf33662fbfc760af6b588aaf6020c88871d7d1a335946f6dd4d217fd7675d97bdd6e3a5eaf30de72454886817bc4827ca3e3e8738c73ddd2b
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYt5T+v8zVW76r0KA3qHwg4xteLG:cgb4mBIBhGF+Xch/3qHiXeLG
TLSH
T15765AE1E22EC02F5E1FAD2B89DA64417D6B278161331D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 012480518c1fe0f33a69c47f7c0d17dc566ddde8b7241d7a59ab4bd6c7e2899c
MD5 ba5c71aea33de78f8ae3986dc27bff44
SHA1 c6ff704067ef770dcfaeac5bd811e4b86fad7692
SHA512 24550a5e0997444becf883f05ac9c7acee29953fa369f0846e96bec7db24ac994739f1203081d10fed6d71b4300ffb585a03e4469a00c9e5374d155ebc21f014
SSDEEP 24576:+G88u8FpJqH1vzria7/m25T+v8zVW76r0KA3qHwg4xteLG:V7ZFPqVya7/PXch/3qHiXeLG
TLSH
T18385F16576E501F0D47BC1388A864663F6B2B4251364EFDF07AC8B521F23AE15B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 25a12394bd3112982bccb0325a13be01fb6d672c4d3c75a9c4cbb496a1dc8fb1
MD5 59a05fa31f771b6c9e9b699940af0b9a
SHA1 dd1f418d5d0f3e40955a1e36e983ef0fd7a8da98
SHA512 4c1871b85441b9f1a6bbb676b398aeeaf24985f9e0099730f594f9492f2087890c80c4b8640cb643a684955c4e7d8c6efc13c0151fc3da6c51701caaa652d000
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKXch/3qHiXeLG:tG05lO43bJXA/6CIG
TLSH
T12CD5BF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c1bbfe48f222a899a66b703001c2a335683555ce4d30881a9a0b5d11ccb08467
MD5 4a9b102794ff69a52b3217d0a202c3ab
SHA1 a911d18fa620f071d2fce350121e117cc61d48bd
SHA512 2004f661c28c0e4dfa916bee0743fe1ee6b0c4f0acfb3ff8abbd9c4a9da557189c70e8b7592d0f92a502f655d4b13011ae200392aaeb2342f96a69c146336d42
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnA5T+v8zVW76r0KA3qHwg4xteLG:Xa5POZ3lJt2pasx2+miXch/3qHiXeLG
TLSH
T10065BF5DA6FC01D5D1B9D17DC583861AE5B1342253329ACF122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 405daa0ba056c5a00c397fde4e4dbbd88a18239d8d0ba3fcf07a2f775b53deb1
MD5 5b4ae575de58b5b2a31e913df1d1c7ee
SHA1 7e64e1a2fe15549d6fe72671c22fe73a13a431ee
SHA512 c115a137a393ff53c55b3302369c28bc02f9587614d237f0e36c9e066b8b4c95e761a94cce27093652a6b9620a9c814dc605607a4a3367f950c841bc84c64663
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk+5T+v8zVW76r0KA3qHwg4xteLG:xNc/zEOVHFvXch/3qHiXeLG
TLSH
T163858C1623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29cc0688f88e2a6dffd20e59032d798d526730b9e14e5be728f6a98f8ee546e2
MD5 978204909dcecd49b7891378ed5dd0ff
SHA1 72d442022036a6164f4ed0efb7c0c02ea1462d6e
SHA512 4b8c4d2aae7fe035344b030f4d6ef3367fbdd635d3877488e62f475a61c2defffe097a41a5d7e9163d72de48c2aa71cadf68d1a9366d0901931f38064dca8715
SSDEEP 24576:YzkNvNnaFeYhJNtmZBmx5T+v8zVW76r0KA3qHwg4xteLG:YzMwBtOmbXch/3qHiXeLG
TLSH
T11855AF6EBAB805E4D1FEC6B58E238512E6727461133293CB5390C13F1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e71e973f320135f5fb9255db58b9edd20123b602c91bd262091ff3aa2ebdf2c5
MD5 1e1f22cd92f498be2452535f00139772
SHA1 57a5a54a0ff6506463ae1ece5966faf94e727991
SHA512 48fe2f1f2666cf952012ba80af19613ccb124bca5bc00f973a638b8e4ab823ff80cf009cff19d7988871389420541a70b43d5a828c7cbf20d4d660ac560064ef
SSDEEP 24576:3PUr+NQS5T+v8zVW76r0KA3qHwg4xteLG:3JQaXch/3qHiXeLG
TLSH
T1B265E11E26AD18E4E67BD17C8A828619E772B462131296CF02D1813F5F77DE8BC3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ef0343d47719a7f7c81e52086cd4822679a897cf0c653c5af9ddfeb55b64b753
MD5 2f699247b640918341c77252912b7f50
SHA1 23aa082515365dda6ee275d0147deea678eb4e84
SHA512 8d2532e119dd8357777445f477f2a5edeb802b86a0650e488360a80309f4980a12796f469c2f0cb446d12c35a701e1740b561e21f8ffdb63154babfe355c2289
SSDEEP 24576:hD3FHshBIYQgAT5T+v8zVW76r0KA3qHwg4xteLG:hDVHeBIAAZXch/3qHiXeLG
TLSH
T14F75E17DEA9C04E4D57BC1BC9A938A06E77138A9032265CB02D4C1B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/256-122-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/256-130-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/256-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/256-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1620-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1620-290-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2140-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2140-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2140-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2140-85-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2140-322-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2140-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2784-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2784-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2784-241-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2932-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2932-55-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2932-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2932-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2932-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2932-43-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2992-2-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/2992-27-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/2992-8-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/2992-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/3020-110-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3020-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3020-116-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3020-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4176-275-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4176-76-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4176-70-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4176-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4976-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4976-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4976-13-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4976-20-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4976-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5104-308-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5104-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5104-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5104-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5588-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5588-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5588-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5588-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5660-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5660-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5660-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5660-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download