79f4c582522dbe59fc4bef27cbabf351eb5a00b636b83f14f958b33399bcab9d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 9.0MB
Sample260723-fb8gcsdr2z
SHA256 79f4c582522dbe59fc4bef27cbabf351eb5a00b636b83f14f958b33399bcab9d
MD5 b3f21850e4f6031473194e2de4a1d851
SHA1 17e1ad9e4ca6bee7b928a7a3279186661aa4cfc8
SHA512 615c57d7132a4942d4b80ef2d14bbcce02e05b235b99ef02a50cf3bd33f52349f57a1c3fe53b98742cbf708aea07698a3bfeac02b57c555f9d556e524e27c90e
SSDEEP 98304:9IvLVTE3Osz8NZDrVqGTgWFu8n7WWKVtwXzph0obeeSiXEZL46qLe2Z+KMp5Dq9Q:96LVffDrsGTgiu87WWa66xZ0Lef6DZ
TLSH
T15996AE30B642C036D9D201B1597CDFBF563DAA750B2960D3A3D82EAD18B85D32339B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4316	elevation_service.exe
4408	elevation_service.exe
3992	maintenanceservice.exe
1556	OSE.EXE
5988	PerceptionSimulationService.exe
3372	perfhost.exe
3400	ReFsDedupSvc.exe
6044	SensorDataService.exe
4280	ssh-agent.exe
4812	AgentService.exe
2352	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\58411e5e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e949acc5d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048223ace5d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091aaa80c5e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3204	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3204	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3204	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3204	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4316	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3204	2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4316	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4812	AgentService.exe
Token: 33	2352	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2352	SearchIndexer.exe
Token: SeBackupPrivilege	3400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3400	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4316	elevation_service.exe
Token: SeDebugPrivilege	4408	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 5316	2352	SearchIndexer.exe	100
PID 2352 wrote to memory of 4340	2352	SearchIndexer.exe	101
PID 2352 wrote to memory of 4928	2352	SearchIndexer.exe	102
PID 2352 wrote to memory of 4724	2352	SearchIndexer.exe	103
PID 2352 wrote to memory of 1756	2352	SearchIndexer.exe	105
PID 2352 wrote to memory of 4624	2352	SearchIndexer.exe	106
PID 2352 wrote to memory of 3220	2352	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_b3f21850e4f6031473194e2de4a1d851_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 166310befcea43dd51145496d055b087c72c429db90780330eddceef22eb9a66
MD5 037a0b6f3ca2af1249f9f188752c6a81
SHA1 b24e14367a6972ebb4bb7af1ae93734879a7875a
SHA512 c4b8ea9b9e833d5ec6dc4e91f2d03d81fdf01ec3d9889447d385b1b744c88c0e1ad0ca782819856945037c193af3b1aa5050e6d6c2d87ed969c5898fde54dd35
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9aB0zj0yjoB2:K3q6HjBTB2Yyjl
TLSH
T11AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 91e774d89982e21f141348b8358f62fb526472234a4762d2a26fe56e8c0f25dc
MD5 50c0b8122a6ea0b12510c5882829ab8d
SHA1 365f18d2c1826ebee19a335dbbc5e459c38d8bc7
SHA512 2a518ab83fd5de0625225debf56976c981a0a169c31cd6370c3ce28431aa623df00bee9be6a2e5d60ac2a04cb2c479757716d5cf6c43560ed78371a9e6f93336
SSDEEP 24576:ZXYfDtczAlatr0zAiX90z/F0jsFB3SQk9:ctcKaB0zj0yjoB2
TLSH
T156650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 de7e21448dbbc67c93253bb7816e7de3cb127e4d8df5ffb998fa347bdc04fe64
MD5 57995329fc3da16d429d85528a49c0dc
SHA1 6f4aba27882008b2dbda3ac513bbbe387b1f5878
SHA512 8fe861838df262e9fd88b55fc23257a3bad6e4a9279ed255c6d5db0e739c6d75f5e2e66ba5073cf71234ec1e26d4de40144dd39cc5a769ecddc167387ac37697
SSDEEP 24576:m0Le5ji0hmxirM8atr0zAiX90z/F0jsFB3SQk/:mPji0AcHaB0zj0yjoB2
TLSH
T11C859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 521d20dda0f28415bb0d70171bb408600225ac24d9795b8b885b64220538b2cc
MD5 4a5f431711627a3027ef1947899967cc
SHA1 9e291f231682d5fbbade5af78f5ddd7abdf6a64f
SHA512 be04d513cde0eca71096afe61866f8f7ae7b131207fc2cd50e7c3cda5ee3443b4f0a4d9939d9f27b5d43cc8f0561f783e515923b80632d0e5137adb69b0bd27b
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuaatr0zAiX90z/F0jsFB3SQkr:W/ezSC6vUzPvxHjyTaB0zj0yjoB2
TLSH
T147755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 11db4374b0075d454d7033367f2bcc43dc5ba4c346a2b2e55b11f68599d5d57e
MD5 3285763ff80ab83e9f76e044eabc2652
SHA1 b0a49b12717843a4c4b04a7f1a0efc8bd5367e12
SHA512 0c723782ecf453cc93a3fa3f954b215228d21e29d1b7a54e66c7126bdc33794bbb9449eba9a56ac5deeaade91373264691f4737ab27a9b8ca69f46c930df45bc
SSDEEP 24576:BVbqPb88hv/l+6Zatr0zAiX90z/F0jsFB3SQkF:BVO88hXl+4aB0zj0yjoB2
TLSH
T14555AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 86c237338f6f2124abdd9eab23cd96ab91e6d7a0ba0487da9543bdc537a65ff7
MD5 eafaa9d2dd5feecf7790eed860d7e5e5
SHA1 7de08022b97845d93563af1ff4e3ed20d400d7b6
SHA512 8cd9ec9723e0260759320e6edb75168bb18b26f99bc044a88cb83e3009d5937cf1d6dff989f7799dfcb25d3e19d1668f9c33eb13d549e8be05965058e581eea7
SSDEEP 12288:URQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:URQatr0zAiX90z/F0jsFB3SQkU
TLSH
T10B45230B340E80F2CDC32B3566989C4B1AB99EB061E2AF45E1D17F4F9D3C1C696662C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b8b599fe5a81ae6d5225723b47bed029b7af4b22dd5f9b9d5cdcc399c7e691bb
MD5 85fd26008d38608bcbd5379c6a024792
SHA1 ab6ce0021c4cc984621790db072f4bd88a25e631
SHA512 f3d36f68ec2630d2e87c2702b14f2d0d993a5a2032b4b9392f5f2f4264a3e276c1092d76182c833653b3518bcd34e768ab9ae1be14b9bff8793ad64befb5ff5b
SSDEEP 12288:TeBNUbTVO86UBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:TJIUBatr0zAiX90z/F0jsFB3SQk4
TLSH
T1B165DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cc744c10ff4367978522d865bed1e6782d6b837d8386cfda30f997ff49dee461
MD5 35bf53f0b4aeda89caa39b4c59f68e53
SHA1 9c84e9c6e2861933e0fc120d037672a2de5074b7
SHA512 2e819fbfa9278644fbc68ff7c3f03e0bbcdd915efacd8129ec991a168953d792da5aa8511040504df1fcc991724acff27fa99106d9c6d53e7e334bb276a3fb83
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:CQvGAdlCEL8c/yRNw5CtB2Yyjl
TLSH
T1B3267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fca1dfe8cece07f0a56435eddfff89a92dd5a2c4197ca1f7a5e1f65c5da83097
MD5 cf506db4aea4660726a41d39110919f2
SHA1 06a30d61d4390cd45dd5feba5fc6f810df5eda51
SHA512 47b2071093ef5236f05cd01a252ec7f4b6d2d62b6c05a7bee5691e1c0b715e11173a6d96a725523d023e8abca5ad6824f43ab256236f80330c73124d02250797
SSDEEP 12288:5AwSfxL/2Dc34DLLmt0LDQewsAjXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHU:qdewsAjXatr0zAiX90z/F0jsFB3SQkc
TLSH
T1E275E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c182c2b3f13156da46e5e8e54507f8e7ea4a0c356194bdb49f4d2c6c195c47fd
MD5 fb4fa7409fabac10d5735c8240b88e9c
SHA1 2284eee814422bc8fcb91ba8b90c5515a5b47b9a
SHA512 e94ab261ea0a424c7c9e840f07332b6829b4fa5e048eb5818507fdeabd0a62438c3570c5c13369c2f91f444d0dbdbd77f7ec5186c4a46c2d4fceaa5a2ca330a3
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCZ:6UEtQevvqc2W1cpV2EI32k
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed964c8a2116f5c4f9e09ec5e8c6fae849e0f371aa065b9351981c2c14ed0432
MD5 7c0f57c57ded0fa9e3ba5be1c6dabf46
SHA1 952e8f32e8be976a0d709a3d0b7924dcc56a43c7
SHA512 acf848e6e8abbc8a5606401d24d5881cb7585ef0bd18c6bf68f3da46ec603a7cca99b74a316e71b979fbd6b728715930ee87db3adf4d3f4d27bfd1ecab56eb0b
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/z3aB0zj0yjoB2:9oqtVjnmRB2Yyjl
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d627a26c2a545a5239047ebfee3290b8abcb4d1a8a50a3b7877ddc7aace2c720
MD5 97947f396d925fac94f53e7c5419eb46
SHA1 65337d86cf4617e0a0d90707df9543fe689b4b58
SHA512 4569bf1776df17a6271146a666acfa0f7fd60d83321e626313d843dd92ed5f45ffa3e55b90b5d02d019eb8bc40ce8372cb040679dd4b5449c6871888f3b2fe32
SSDEEP 24576:6AhGLJIFoiwtA5l7S53matr0zAiX90z/F0jsFB3SQkm:6AMyFoiq5WaB0zj0yjoB2
TLSH
T1EC359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5520207580fb9bbf2823d744725db090b85c0b468277a5d3d4e39607092772d0
MD5 0d628efaaf1dd5783a58a4b96b1fd072
SHA1 8ef58771f1595ba6390ff71a2adfbb522b5f82c7
SHA512 4615c9b0439549c0fe57d4c499557cae91e4c15cc2649101cd47c0723e082a4f5b2e224d29ed8bbb7c954937ceb527023d8f78159b5a04b6df537ea42e361581
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+C6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:ywuoOWzatr0zAiX90z/F0jsFB3SQkN
TLSH
T13A65F14A32A90CF9E9A342388597C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5412db0ffabae9936420f04774d2c4e483c52d82ba561783199f75e5d01b25bb
MD5 1fd58e9f35f20db4e9622603f034197a
SHA1 4e19c0e20f1dbaff71414da185e452776ab0cfd6
SHA512 1eb84a7e4ca0de0d0b782c782b58772921e17fa6b9507b0a8287d475d42e0eb1b7b68be78486e4b71e65e1466a7912a3eea66ba1205f00074860b6c8f2f876c6
SSDEEP 12288:/BZ1IynUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:JZuEatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1B055124B32A960F6D5D3523CC9E4490AD7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4af7e5ae7a3ec2ad51c6c7995fadf3cc170fb531e22bf88a56275a9390156c92
MD5 c21921bc8e1bd33aa1eebff71647d248
SHA1 a0bbd7a919b5114e8ad16c9fa60c3ebdb0235de2
SHA512 926a2c0b77a3d14a37f524f74e803ebf7fbd87135e792063a9a22089ce30620c55c1f937da9c3a16ecf6492b33616c6c199a541bcbaf6099163d2817cd005dd3
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:/QRQyi36YOcPQLvw2gAf+PN3cB2Yyjl
TLSH
T15D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 58459c8267c06232ede9fd178919cd393dbdbef01fcb096c76a4dc0220816566
MD5 1e1519434385de2c5ea2c92fdf710fe3
SHA1 2965108a84567cae27b4632cae185168be417dac
SHA512 b67aa8966faea2d8e7a971f49d6e10c4b77603d96fbb9c1dfc9cac89381c1848838a4e8c926accd75ee8eb40ff351508f94a14186b296daf69b4a603e2cf6b8d
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:tQRQyi36YOcPQLvw2gAf+PN3cB2Yyjl
TLSH
T199667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c534626ed95522b15947ba5b955bd47d8314e3aa1ee4babf1e6f0017745077f4
MD5 4d3e5f19678350b6042b85dff2780120
SHA1 7f28131df318d73fad286036b2581e9d0904bd4b
SHA512 d20e391c2f27c520e1c92a1ed338666afb618511dc842a035661f6acb3dbff5af01e2ab37167d1d0866b33e5dfc4dbe22cb78e888a7dd41d8aad00e096efc608
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00atr0zAiX90z/FI:f68Qg55nhheWu7PNU3/HaB0zj0yjoB2
TLSH
T13CB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 774599ea20d576c0bd152430c6ff9a0f9aee491e2213b3c3e2083e1f07e67d93
MD5 061d1bba12eb2542cc81535b14a2934d
SHA1 5b3fff1ba729ca7405e3c13586f0f044564fdff1
SHA512 f733b05d19afb40a94c7c1cc2a8680ac06c2d92e3eadb0925086bea0e5a6a9dd5a1c26d20941b071f3eafc677adb2c022752383e05d0405248f32352bbf21ef5
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:Iy5112gYy5azzVvL69nLKnhZvB2Yyjl
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96adceb8edcf29f959bea8246bb9d06d10a8cd2953e291e25536bd7548d2a8b6
MD5 3d9f8084cbdce37815ede07b0b0fe7ca
SHA1 1556bfa16a408b74a8a9a472729e4dc24ac8206f
SHA512 562fa6220c262e6b7bda746801dad6bf6cc294aa9ca53f55cf8c71c385707017c2bbd6dd172ff4b1917fabf692f556137a8d1a8e2573ce6f4f312213cb5946f5
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgaB0zj0yjoB2:Tu6JmVxd2d/B2Yyjl
TLSH
T1BDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 986aee980530f23149c459943296b2075b5ccf05992f2d0666da3b69e0badf60
MD5 ce02375389e807be1306a941b9387851
SHA1 15e63996f732c1ff5ed82484a73a82904d24fcb8
SHA512 08875992441ef5ec3f3581adf2c6d8fd26f8643fadd0edb9c8803bea4889af7bf0db8b06e3b3a6bcdc794ea4d0c37d0b79a25f90b70258c56e4843c380579c6b
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xhaB0zj0yjoB2:emifPbRRB2Yyjl
TLSH
T10DB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3278404f2e3cb3cef6b1e97d0e6877c08824724f1aeae45aaed232b5c30f43df
MD5 af05bb0b02441d53c17958fb22a1f1cf
SHA1 92945b8cb16fcef54adce7be73f9f772e4803d02
SHA512 0cb815b0ceb5f0ea41e237dbd8a64536445afeebc8e1d8b94e8a69ac83dede2971d3b5af3cd2b7f0da0ce6c9e372c0f66cabc06c9e3411e6733fa48c6e625200
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqEaB0zj0yjoB2:x5dKTi617B2Yyjl
TLSH
T1AEC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 815491b911ca867258727daacf4c48a8188fa3c6927d859070626659a597e506
MD5 86ed1b6074ae4b6b8f6731fdb548157f
SHA1 20960c89a5ea21eb073c8fe3913835950863feb8
SHA512 1f19601f76dedafa75add304907ade8997561947576487a42adad2a50f134c6ef2e1a46db11a689deb7c833d7668993788c64626a8c3c746050a032759d39bb0
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wlaB0zj0yjoB2:vX2iyphlB2Yyjl
TLSH
T15595BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7d1ad8024846c7f99d813524d44951f1c2e33f872ccadad9383a2291e16d3dea
MD5 67d5e4e9f0395211d001c8c6b0214919
SHA1 3e85a93a6383d81f9b62747b8c6378d54020dc4c
SHA512 4c92a65dcaf723d4656faab3a6eef619691e1d6dd6ab187867ef11a30d9620ea7ca8b9c3a2c1b569bc396389d8cc82d94e35ea4146f687a51e701add6322e575
SSDEEP 12288:x4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:x4atr0zAiX90z/F0jsFB3SQk1
TLSH
T11845230B381F80F3C8831B355684984B1AB95EB4B2E36B85B2953F0FDE382C715656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 02ce4e0987ac96d4caf8ed8f0706d073defc3d718ab44227d08fb848663b82cf
MD5 7dd348bdfd217c55433589727a46021f
SHA1 e56bc75398f844192336502ab421385cec8eeddc
SHA512 257d7f58b093fcadc089394614098f7a482359703fba9070273ebeebb81a6d87ea1afe42f85401250a44d0fe88c6224e7c1deae53d8fa00f938b41258a57254c
SSDEEP 12288:FrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:Fratr0zAiX90z/F0jsFB3SQks
TLSH
T11A45230B381F80F3C8831B355688984B1A795EB472E36B85F2D57F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 78d83c56fed2544b9c0df23325838c02aaed5feb68acfaa207c7835dcef65fa4
MD5 83d3bf5227dc3b551889e86902c35612
SHA1 a4d62b4dd2b1e4b52773ed56685047af07590e36
SHA512 cbf6271976609913b8ecb33a3652fcfa0ef211fad610e9ce702f59836c31e19a46282dd1aada75468974cf1b776e00cb25412798b7a324d4bb65b4bec9261772
SSDEEP 12288:wJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:wJatr0zAiX90z/F0jsFB3SQks
TLSH
T11945230B381F80F3C8C31B355244984B5AB95EB476E36B85F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2a319e4e2ceba5b9ea2df3473044d2707abfae25449fa73ed6cb0011ac07d7d7
MD5 91ecb9860529c80bf4b2fa1fac01172a
SHA1 2129cbfe563d876918d5d822d2e3b4d877e8a2ac
SHA512 e1132b4ce3892fe75bfd5820a04bfa77070d295bcc8fa981c2eac3fc0434ea0021747d7e8254367f8b05781b3a23a29213334b8884845d1e61f7d01ba194ccba
SSDEEP 12288:DVGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:catr0zAiX90z/F0jsFB3SQkU
TLSH
T1CB45230B351F40F2C89397358694884696B9BDB0A3F3AB9FA2413E0F5E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7a72d38e9ed622483cff5d3d9b2899283dcc09aae5d371470f112b70fc14558e
MD5 30bf3b125513ac18aa8fa3eef3ed7d54
SHA1 bbc43ab806f040860b9e19346c1d6f7d40277744
SHA512 48d172314b5db8e7a6df4fb797442e2cda86f5c317af8517b4f9174687a851696bf6591b944b100f18e23e23ff8963b6fb0f271d6dfdc59e4805e631e1d1e6e4
SSDEEP 12288:qeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:qeatr0zAiX90z/F0jsFB3SQkn
TLSH
T16E45230B381F80F3C8831B355684988B1AB95EB476E36B85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7f1d385248b8f7f42e0b93c77ffb97970915a8c47aaa55a64315bb09de3f272c
MD5 af713bdf833710cb2206ce67d732d7ad
SHA1 2625f98f0c8b3f65a4c1510804bdc376dc9ac009
SHA512 625575441470a413cce6a76dea60ef851871094399d013b30e57f9a91d2d6fc262a5a8bc30cfe0de062fe10bb6566b20ffb646a0055635ac504587ba5137608d
SSDEEP 12288:TfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:Tfatr0zAiX90z/F0jsFB3SQk4
TLSH
T17645230B381F80F3C8831B355684984B1A795EB476E36B86B2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a717525c09e73cfa7131881818631c5f85f95c56ebdfa917f6b2be6ab2c96247
MD5 185cbaad9825dee42213a8e5b73e42f4
SHA1 2148a35b83ced17b563d27be3d0836f3df592142
SHA512 4eee4bc605b0dd4c1d497c576deb1021798bd94c4fef31376947902b9f8bf3d88902b54ed5a0135b993382caa64843ddf9dc8df592ac594da2074cf7ca527737
SSDEEP 12288:8jUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:8jatr0zAiX90z/F0jsFB3SQkQ
TLSH
T17845230B381F80F3C88317355244984B1AB95FB4B6E3AB86F2957F0FEE381C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 170c0ec5d2e018bc5d298c1b86df5e489d4a904a67b4f69b33594786d3a159d2
MD5 13c8ecfb6b3817d98af8a6acc758b831
SHA1 20cde7a559667f34fa1af37889a9d6e48f236bfe
SHA512 c840f9aa9b54a739dd57c148d4fbf7f3c0694cef67197c11b33a7309b04ae58e581885ccf112455aea30a15addc4e976e93474f35ddde818e64bdbce6a628669
SSDEEP 24576:CZMSzFVSOLatr0zAiX90z/F0jsFB3SQkD:CZMSzfvaB0zj0yjoB2
TLSH
T1E365019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cdcfea23496cc00c8a4531fc6b1e39c3425bd4b5da526a53f0e742990b53aebc
MD5 d07508845fc335b03d23c248987ed802
SHA1 edefc276765dd8f3e0a024afec501e27672eb873
SHA512 aaa4bbe139ef956e4eb2d44fe6049dcceb0acb54ce7cf1575ae416e27b0210fe21a76f57440b1d23e96e1da615b2c45364768e102398e2f6610ef48e62983ec7
SSDEEP 12288:tUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:tUatr0zAiX90z/F0jsFB3SQkF
TLSH
T1DE45230B341F80F2C8831B355644984B5AB95EB472E36B85F2D63F0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5f1e33fed83b0dbafe1b3b304ec61d3910fc80f04c13817e1de708913fb9cd8a
MD5 64fc9c3c398bbf606d83c6c920c89c95
SHA1 2f93298765e1d796b708d1a10262992eadbb3119
SHA512 52a150b58101446531ddc37fb45d7d34ac9edbb28d16915a06149f70e32db176752308e227982055c0f8a1838732dda0d196f3992003a5bea152977066e0af6c
SSDEEP 12288:YgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:Ygatr0zAiX90z/F0jsFB3SQkK
TLSH
T15645230B341F80F2C88317355684984B1A795FB4B2E36B85F2957F0FEE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9ebf88df4e8efd9b535ba2695eae25dec2abbaf667807c2ef5fee6e35e487f2c
MD5 2d7aed30c52d6a7e81efe793d9160f00
SHA1 631e167d99be970dc8739c504fb748af94b6c502
SHA512 97d5c69997efdd6a356eb31a190947f3b75615c5ea9a265297632524f7a4bbc11be0c04618ead90dcb53471df0fce9bd9fe709b9540ca4da73c91f9ab93561cf
SSDEEP 12288:MyPz5L8nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:Vzynatr0zAiX90z/F0jsFB3SQko
TLSH
T122551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c72125086a1c33ca606bc079792f0ddd4e7ece6472044c9d9fb4ddaa4d0324e4
MD5 5ba0a5c1197d3f84c7d0c71cabae0075
SHA1 4ffadeef1c35830814445210ad3a6d25781c2bab
SHA512 cd50977fce5af8d52d113531d0ca6db430a6d2da8a2fc7dd67529a2447685f2ce75f21e14ebb72e615f08ec63552b84b7c077259040b50d61bccbce2b6583018
SSDEEP 12288:LUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:LUatr0zAiX90z/F0jsFB3SQkO
TLSH
T16045230B341F80F2C8831B355648988B5AB95EB472E36B85F2D63F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 30b5c9caac26f2e29a4849cf3fbfdb1b1d3f2cb9fdbcfbba26c482c32de13467
MD5 b6d39d8218c2af76ce6fdd0c56096e1d
SHA1 ed236ba900c9e8f992ce0b85a03c225e6ada25da
SHA512 22a56672f865b622d4a24c3388b226f6d820074507982737d166267b6c5870950a3906184ba99a26c1710f2971a90af05035663cff444006d51070f795d69b81
SSDEEP 12288:RUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:RUatr0zAiX90z/F0jsFB3SQkO
TLSH
T1D745230B341F80F2C8831B355648988B5AB95EB472E36B85F2D63F0FDE381C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fc9d9d5102164766235d2902a5c975eb0a34eff2bdca4245a8a06887298a59fe
MD5 bcb57965ec28031198264892352a12f1
SHA1 c6a8a2a2f855d0b0940155232e848d56b3b50944
SHA512 f2bea3359b27a8b3ee471fa0f6bb9d3a22c858829aef2866bea84c6adad1b7a99a8b15a4f0e7d643acfbe0cd0d712e0b81fe4b36069abd0370a1389e55e6b4c5
SSDEEP 12288:1yPz5L8nUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:czynatr0zAiX90z/F0jsFB3SQka
TLSH
T1C0551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 18dd77b69394cb58920fe89d8775a449121f7d98683e375c14263dcca1b7d9dc
MD5 353f23ccf666a5ddff85fbd49fddd7fb
SHA1 0ca9a0b1b3f68e060eb7c5b97947133c553094fa
SHA512 4c6e429d128c45bf3e8d1e0e3f78de2ca690e185bfac5907f95c1d5ef4a36911674cbd2f5b18d5b2ca4925dc929efbbb4d42699889ab9125519656fbb4cdf897
SSDEEP 24576:hTHaLl3z0zD5atr0zAiX90z/F0jsFB3SQkC:hT6LljaaB0zj0yjoB2
TLSH
T11E650199735018F8DCA3823EC9558906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b06669ad806779c3ffd6f806f40396fbd8e0a2ff31faa04976854fb336cec2ad
MD5 c6c2e9b5981f561477bed4423936a955
SHA1 9e5e9e26cc91c48508b4a8cb34a0fcd4903e04b2
SHA512 e43fcfcd182539f7885aac277428ff0d6ae7a060e45f10db1b6bc1aa356ca809e0aae8e32262c69b0a1f18a7e4f4532f0d1e9c81e3877fcf574c219dfb040663
SSDEEP 24576:l37d9CHKy7GZNatr0zAiX90z/F0jsFB3SQku:F7d9CHKyavaB0zj0yjoB2
TLSH
T15375CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2a296a2d887e3b05c5f9e1e784b8d1aa7054ec60929f0f3606af30a91cff758a
MD5 723f2d47dd038f9d5b4d756af61fe760
SHA1 3274b8db3ba600befc33b9927da1555d9314a520
SHA512 e6a5a7103160cd577566009124bcad8c5ef35cc647beb2627176863a815ab44ca97082540a144d23421cbae0e0b3597830c04516cd5c8d78807da28a6020ea79
SSDEEP 12288:IpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:Ipatr0zAiX90z/F0jsFB3SQkN
TLSH
T12B45230B381F80F3C8831B355644984B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9f39367fe99a91d2e090d8531ada33e7cd1249170ec34431f11186f70d6bcdf4
MD5 54094c78844d623236e07788e5687bb3
SHA1 adc5c89bc948bdcf2d888ac1eab99d4bede50ca4
SHA512 7566bda7e3b4fd5fa20304ad6af43a952cff6d6b773d562fa74649d4650ec85d1cc52e53b1efa8046f3857636e6cb22b2d10d9e4c56a753ab38654900ce2e54d
SSDEEP 12288:KHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:KHatr0zAiX90z/F0jsFB3SQkU
TLSH
T19945230B381F80F3C88317755698884B1AB95EB4B2E3AB85F2D53E0F9E3C1C715656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 61f3de44c4f36e0edcf0890d2e320832b4e9d5e572552fc78850b2ed932cc4dc
MD5 ad063e589be9997486fac405e36c9ccf
SHA1 1ca0043ab0e16c8807cf64af668d55b32238dd4f
SHA512 fda26ac013e2685ece8b6eac7cb922cbb96feaf156560297b21c5112845597cf1c01c4f09a4bcc63115bdb7ce2c48da6f73bb6dba344c5adc1910082692e5345
SSDEEP 12288:cyUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:cyatr0zAiX90z/F0jsFB3SQkg
TLSH
T16E45230B381F80F2C8C31B355248984B5AB95EB472D3AB86F2D63F0FDE385C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 963b7ca6f87254d872e203352e056c48d82bbc4402691f6d7463311c64b3ab2a
MD5 1303bb8f4f568667b565a2f286064538
SHA1 2c026a50b07a823dd66fc79a18234df2a310db31
SHA512 46b6eaf19a5a49ceb053768c2c7d721ad4b1e5ec6d47951ac4f83c8d56d6cf0af5cd93cbc8309d5e9f093c8277fa81de46aa416d151944baa923a2baba821066
SSDEEP 12288:HUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:HUatr0zAiX90z/F0jsFB3SQkg
TLSH
T12845230B341F40F2C8831B355644984B1AB95EB476E3AB86F2D63F0FDE3C1C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6554fbcd014b48dee5e4db7f4dda7bcca9c0e3f2238634374a7544aef149b64b
MD5 405065e354e3d7882ae4762b8a51c999
SHA1 150a4fa3647f67cabc697106bbb128327e677fbe
SHA512 19b6094785734beebd6ac3a87055c710f3b5764f7794ed4ebfd05818f73c7b9a0fed2bb974ffecaae7d3370ad7ada86c29e3d6dbff162df4671a5f760263bf09
SSDEEP 12288:ZpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:Zpatr0zAiX90z/F0jsFB3SQks
TLSH
T1DF45230B341F80F3C8831B355644988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0717a9efd1172ead649a63b7a6b52a0396c0b8d1e5a4d80a1ad67218379858ca
MD5 42e6817ee514029c2a53a25a4f6cb9ad
SHA1 b63cbdfcae6c012e8af914a8bbb0d1533476ff50
SHA512 0b47884e19042c94ab6ffad000f98878b5615d282332dd922d189897e12ce2ad356189b87b9fc3b3bfa482ad00d4af5e71038d65c4966ce0b71affb1f15f29aa
SSDEEP 12288:0sUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:0satr0zAiX90z/F0jsFB3SQkX
TLSH
T11C45230B381F40F2C8831B755684984B1ABD5EB4B2E3AB85F2963F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 94a0925f5284032abffd4bd430819df94bdac6b44380933d3dd75153302e91fa
MD5 464d01fc573d0f8ca5631d53ac038e7f
SHA1 7d0cabd35e8c781eae6fac3452ec662d3b4f4752
SHA512 7db358c39d500974a470d04e1f69da6a09f2d084d0848436083fe8c9e8e067e200797e12e8c672a65444b7d9067f850f909208c565f78af01ae4022e94e409af
SSDEEP 12288:EeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:Eeatr0zAiX90z/F0jsFB3SQkr
TLSH
T10445230B381F80F3C8831B355644988B1AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6c7a997c1762b1dc64615028411f29753d0869225b9539c2c8e9667cafc989f3
MD5 3e20e85b749a6b72a1c833e623f567f1
SHA1 104d5019588643d4bff2faa8ce2f93ef055aba01
SHA512 3536c4fdfecbb131d69cc41fb98c4f261a6f38ae5c6c0776a604a9b7f2b7eec925cc97a2e57567a297580539c6e995934a98bd76b409502fae25d228398e51cb
SSDEEP 24576:zfwvok9RX6wkyAIwatr0zAiX90z/F0jsFB3SQkb:VMnYIwaB0zj0yjoB2
TLSH
T13285D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2e106e0d4eefa43d57cdf0bd18db4f097fb86be3b4cb7af017161953c0e3af6d
MD5 dbf715b17cca4978d2f09609237f4d1a
SHA1 0e03af003a8fb3d18e9bbc716f33a6473c7c9702
SHA512 f59e10005a903b02c49863ad79ddc6def07b1a238ed6cb53b6602d799930c2053b47de7f0d4cef2dfa4259a4135eec48cf4ecb0e35b0163ce226112685ec004e
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FaB0zj0yjoB2:4ySzP8B2Yyjl
TLSH
T1FD066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 537604558c89ba151b5907dc395888bae3a35df40775d0b3852fa0aad502f0e5
MD5 e9050076bd4004b5a7856fa2ded6fd51
SHA1 2aec2a94d025983cf30c97f2178599145933b1c6
SHA512 421745f009aff892105d2ef95ce644f02cea0f7d425ee926d2ee7b86b8ca88d147b1b4056eb269e06a96284b3a1ae085d1f2d7a4bd8b9b2a750e156f0697e799
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYbatr0zAiX90z/F0jsFB3SQkO:B47JUQj1irIhCnDHUPfF/VaB0zj0yjos
TLSH
T13065AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0c605267d751e30180e346a466c3f66691392b384458c11e450f83adf0b1fe62
MD5 66a407736d12feeb0e7acd493712c14a
SHA1 23f4134a835c0b6843acb2827560ddd404c191db
SHA512 0ead9e413c07d30837b32eb5296b3badcee91831f30ccff1de7b94d91829190b3080eb0fae04bd270e516d9dd7b38ba2ac17db31884527c482d78bd15b6a6521
SSDEEP 12288:ENsfEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:VEatr0zAiX90z/F0jsFB3SQkZ
TLSH
T10455F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 35c91be999970c3f123f4dbe6ad9b6155d8f84ba7c8cfdec6c3b351d3ec34873
MD5 dbc793e990cbdcb23a90beb04bece342
SHA1 86ca98a99a6c89fb289b4c5d172efef2b63981f0
SHA512 40f20b464a1ffc8319df4fe28a621da37de4104c75c98c0b42f2110abb78e24e1f2ee51b3be607518119963b1ff23079060eabff733d058d104da75dd1a30f60
SSDEEP 12288:9R27+UU3fPHjqSMJgAhSV84c3u158FZIrpb1:9RqbUPuVJgAhSq3s58/I
TLSH
T15C352800766BD75FC5AD80321E32D2CCA7707D41EE05AB0772C8872FC576669BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 12d4a4ae479c0f59fb7d84b0e5c6a1dd0d12d305b1e0cbe714ca717478c2c26e
MD5 b852e66433e5d15f2afdccac51bbdfe3
SHA1 9268a2e1c56ec48d5447b2896fd10cae811de79f
SHA512 c922f74056a379dca082ebadbcadf1c3e5661d544b34c6a6e1d62bc9bae574a8eea00c84b916d492865b6cd5604884fa9608d95fbf68cfedd450ef37174cb767
SSDEEP 24576:oCecj+5+SVVJfzYREl9ANhxSgg9vIJyCDVNT1SpZL:oCecj+5+SVVJfzYREl9ANhxSgg9vIJyX
TLSH
T17555C7815537E3CFD1F76032072A5B4CA764EC07B7096F267388453AD82AB26A4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7677255e4a525e23ffb5cff8c5d9d6c0a4dea0c3f05a003143005367a12ab42b
MD5 e69fa484f39f06386e77c43da02a9fe0
SHA1 259f43c5d3bfd4311158f002a5930c0d5209c782
SHA512 f9d07d6831f714bdb857fed9090aa58eeb9b8dbfcfd2796a63a5c117ab313f98c7162f4e92673ba97b238e1b20db4a81e42f16eab76b1116c9bbdae1cc4e4859
SSDEEP 12288:BM7cUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:acatr0zAiX90z/F0jsFB3SQkj
TLSH
T158452307351E80F2D8A32B3452588806267EBE746BD29AC7F1813F4FAD386C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ced2489f0d7d46017759f0960cb0fc722a4137bcd7982e3356ce9891e62878b
MD5 2ddbdc44e7b65bba50b131f87791d1ca
SHA1 cbb7dc1f622bd693540f3cca263b9e497e70117e
SHA512 a5d18e4687fe1a239fab9269592cdabad50451a36aaee61271111567f7ee71918b388e310695e95851b50d88e652c65066c577b9437e5230e0f7e32bf8aeec9f
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYaatr0zAiX90z/F0jsFB3SQk5:Ogb4mBIBhGFbaB0zj0yjoB2
TLSH
T16965AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c63f799566d7c947d29e9884c7d3f9600fbf4367bc6ba76ccf3950d4c20cc1f4
MD5 25c68d7997c3b29647c7be426c3a5e74
SHA1 dc8d6e6333acaab39b53d9b8c8359c57b642fa84
SHA512 3e3801a7e0335c7a40735ed4746087fc7752c095a0a2a019d9b6be5285c765dd22807a03780fd826ced3b4526dce38d33b399a01d19bbb17a990f70aa032ae72
SSDEEP 24576:5G88u8FpJqH1bzria7/mLatr0zAiX90z/F0jsFB3SQkL:s7ZFPqVea7/SaB0zj0yjoB2
TLSH
T1BA85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2a3cc1105036fd2a5e6b82ec3644cf0f5110c8aeeee7c21838bfde4c061add5a
MD5 49953a7e9988aa3f1d9862f256a5d75a
SHA1 08c2372fe40eaf48b4718952758b85e6e618be60
SHA512 8c927038526a589e8d3e69c5ff74054987ca4b6ce0601149bdc0fe3e95edfd508b1c37b658aefac630ef07fbe9b10ffa8c1813bb9c3d2f4fa8405128aabe23c5
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfaB0zj0yjoB2:GG05lO43bHB2Yyjl
TLSH
T10AD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8a3f3577599a2715e5c85c7c6234b90140289dc08974a9a062c8fb40c1da5e62
MD5 c1aee3cc8cfa89f514c969e44fee732f
SHA1 0de898cd502b3f6fb8a935bccdb9a5d1c993bc0a
SHA512 eea4a17be3271f914049ceebd5479095db0128126551928ef09b3ef8b9e76366769bdc08336a399538b1e806c43877c54de33b25bd4875daf3ea8014eac5146b
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFatr0zAiX90z/F0jsFB3SQkP:Va5POZ3+Jt2pasx2+mHaB0zj0yjoB2
TLSH
T1CE65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9fb95ee7e4258bdb527f4f01bfa59e4a4e5ae10465b4fb60e93390fac6283f23
MD5 5ca6b38c6d33c5e8d31c6f6ed6ab2260
SHA1 fb6f1b104d3737ee741e3602b9bd5da5e4026767
SHA512 fdda4a7b7a16e1771707e69222879487c11db015c3797f2b4a6a913bf40af26d1c7367dd816efde4094e7fca812ba3cf5d2e76b35d943b8d52dd2e7141da5a00
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkTatr0zAiX90z/F0jsFB3SQkt:INc/zEOVHFyaB0zj0yjoB2
TLSH
T1C5858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 273eb7a8aa1802159507bae0c9779e691c93956d9632144e82c3847063f80eb2
MD5 1aafc913f16ced872fa1a8341ee0d38a
SHA1 41e1af8782790749b64fa59fdc05799bfff10cf1
SHA512 c4e2bf08d12b22f60f544b965ef37a60f170975f7bff6e2117d9dd0dc4ffec2b2c372d5495965d4d7642aef62f027555feb9430e289cab93c7dbe48573f125f3
SSDEEP 24576:t8kNvNnaFeYhJNtmZBm0atr0zAiX90z/F0jsFB3SQkb:t8MwBtOm0aB0zj0yjoB2
TLSH
T1FD55BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ec0f1a8b55bf527a1d4ecede4fbf64cb52f2c9e8974fd2701ba5f7f877511b34
MD5 34cbe4956f91043a26592425e84417dc
SHA1 f547d96871b4dd990aeb01e34a37f22785afd537
SHA512 3401cea8a82b8bd9d5dae6ae31fa51c86c7728582d35bbf250015e022f5193ad3eceb1e779276d6c523ddf6cee39f179b889c08e9c1b8142cd989ee1e11a9617
SSDEEP 12288:4HvUrBFrEjwaQvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:4PUr+NQvatr0zAiX90z/F0jsFB3SQkL
TLSH
T1C265E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e63581c24e0ee57caaacdb1023af93b1a3b89082d42c3127959c7d5fe2a40dc1
MD5 bd5443077fe3860c55429b348361f887
SHA1 ac7952062796c2ca25e9870bc2501b9d23bca613
SHA512 842be21657f23a4311a452648046adb95be7c4cb35a557847f0810ffd32112ddea7b4c4bb2a66626206b40f13ffa2eec945f55fe93d07f2aa5c6c34d1dd00fc8
SSDEEP 24576:lD3FHshBIYQgAYatr0zAiX90z/F0jsFB3SQk0:lDVHeBIAAYaB0zj0yjoB2
TLSH
T1E975E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1556-67-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1556-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1556-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2352-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2352-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2352-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2352-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3204-24-0x0000000003660000-0x0000000003661000-memory.dmp

Download

memory/3204-1-0x0000000002C20000-0x0000000002C87000-memory.dmp

Download

memory/3204-43-0x0000000000400000-0x0000000000D31000-memory.dmp

Download

memory/3204-6-0x0000000002C20000-0x0000000002C87000-memory.dmp

Download

memory/3204-0-0x0000000000400000-0x0000000000D31000-memory.dmp

Download

memory/3204-7-0x0000000002C20000-0x0000000002C87000-memory.dmp

Download

memory/3372-84-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3372-314-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3372-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3372-89-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3400-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3400-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3400-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3400-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3400-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3400-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3992-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3992-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3992-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3992-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3992-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4280-120-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4280-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4280-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4280-126-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4316-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4316-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4316-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4408-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4408-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4724-332-0x0000020265990000-0x0000020265BD8000-memory.dmp

Download

memory/4812-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4812-140-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4812-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4812-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4812-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5988-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5988-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5988-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5988-299-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6044-107-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6044-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6044-113-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6044-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6044-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6044-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download