1d194414085ee232a1ac2da9a4ed689d296079ef1ac7d4c81994357ceace4eab

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 9.0MB
Sample260723-ff2vdagd49
SHA256 1d194414085ee232a1ac2da9a4ed689d296079ef1ac7d4c81994357ceace4eab
MD5 38c7c08a3c596ae840df831da8343e94
SHA1 a99c4d4908469023ce1d474675978bbe38f33a30
SHA512 a8d4a1ab751f5f4070f5430b0c2d6e7bae38125259d60df8173654a399c765f8b1c59da523ad13eef6e06e8dff5355eb03ecc43988021e0de37a3c79f7f979d1
SSDEEP 98304:qa1uEQENDIlRytlzE4xfG36QsGJVL8EJNbOL6OEJ0pdvMbireiRedMV7FToGB2Yk:qSuE+ytlEOfGDsGH8g9azre8zZ
TLSH
T19496AE31B601C136E9D20071A87CDFAF562DAA350B25A0D3B7D82DBE68B85C31739B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
796	elevation_service.exe
4932	elevation_service.exe
4376	maintenanceservice.exe
3088	OSE.EXE
5568	PerceptionSimulationService.exe
4968	perfhost.exe
2380	ReFsDedupSvc.exe
4724	SensorDataService.exe
5816	ssh-agent.exe
2192	AgentService.exe
2568	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44306a12e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064891e045f1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000062b822c25e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cf21dc25e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a6bca035f1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5812	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
5812	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
5812	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
5812	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
4932	elevation_service.exe
4932	elevation_service.exe
4932	elevation_service.exe
4932	elevation_service.exe
4932	elevation_service.exe
4932	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5812	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	796	elevation_service.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2380	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2380	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2192	AgentService.exe
Token: 33	2568	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeDebugPrivilege	796	elevation_service.exe
Token: SeDebugPrivilege	4932	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2980	2568	SearchIndexer.exe	100
PID 2568 wrote to memory of 1356	2568	SearchIndexer.exe	101
PID 2568 wrote to memory of 5860	2568	SearchIndexer.exe	102
PID 2568 wrote to memory of 2448	2568	SearchIndexer.exe	103
PID 2568 wrote to memory of 2728	2568	SearchIndexer.exe	105
PID 2568 wrote to memory of 4464	2568	SearchIndexer.exe	106
PID 2568 wrote to memory of 1080	2568	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1d2adfb8f61c889eda994b4b248c78f5d152abe75e99566d973ee0fff8f9afad
MD5 9f3106b53aa851e97b9113557b7d97c1
SHA1 f3e91a8390af0f9739fdbbf3134ff2cbcbf077fe
SHA512 440a92a1dd507421c928273cca24b8a5435c8729e1dd55cc79ea05cb3fed2ed8982d256bbac88451f59a16da892051f406d1511e0e655ed1bd0ba5a1e44af04e
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAaB0zj0yjoB2:P3q6HjBkB2Yyjl
TLSH
T142D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 27294f5a35b84df4209eee982bec1676f80960d1bc11d57de81d96ee5ecda104
MD5 a6e5aeb88b929ff1df289ccec828d798
SHA1 f3f965496e2151f3bbe533475d1343dd648ba142
SHA512 1ad7d1f4a09e5d0a577a5c3a0cefeda751b8fc8b33b91089151febeac573e80a610c5fb02ce51c4e42342b351f9142bd309740bb81484a43bcc61736c8b9a40b
SSDEEP 24576:DXYfDtczAhatr0zAiX90z/F0jsFB3SQkL:GtcCaB0zj0yjoB2
TLSH
T12A65022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5351bf2828a853c19c9a971d86b8aa2ee9f2a32e8e112376a69c062a71316355
MD5 52b95baf32db98006e5cec4b7f6fa41b
SHA1 54e768e083bdda0b3117f68abd05d0ee23574a55
SHA512 f7d412eb76cffaebfd2d17781319bca20451623f9fff141c0ac49c2d6a9640dae0411b978541439ba9c31f207b77e3ac58a29d5501f1f0e9c5af62a1e9938bcf
SSDEEP 24576:E0Le5ji0hmxirMfatr0zAiX90z/F0jsFB3SQkR:EPji0AcAaB0zj0yjoB2
TLSH
T11C859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3136a4bf032c71ef14bf64bd25e24570024c512496c898482aed1b92ee4b913
MD5 98830fd51a64f85aa63ac4d764c5e934
SHA1 4c9e243eb2fb2d9ff89c307d3469a5eeea1d9ce7
SHA512 865e6289b70dacddf513d93e122667b6d03679616afcb7d04adae4b0a0adc897f01e19b18ed41d14d39fd3d443a7a1732ac029ef30d4da807ddd796d8b81e20f
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuJatr0zAiX90z/F0jsFB3SQk9:N/ezSC6vUzPvxHjyEaB0zj0yjoB2
TLSH
T193755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cb5895fb7e8d4b5573af18547164d95c8800924330246e20c71505f1ca325421
MD5 788fb23fe6fdfa4048bf046c98e69799
SHA1 6500763d048f731ff319593d18c212e273636d25
SHA512 2a764e467cd0a2739f364f59bea15e11ec904bef0185f6f5ebdbeff4624935b1e03ff551ec95c9d800b90710641b213a4679e357ca563b906f177ec667743fb1
SSDEEP 24576:YVbqPb88hv/l+6+atr0zAiX90z/F0jsFB3SQkw:YVO88hXl+DaB0zj0yjoB2
TLSH
T16255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 509d557efdf99fd245c23e57a1bdb14768eddfd9ceba9558c54ac1fc4f806dd1
MD5 7e126e74b6ec357e4ffe9b31717e8891
SHA1 6e521f2e39494dbfefb3ed8e31842a38424bd333
SHA512 0b353835b6abd641c6b415e4ad7bee0274bf6794557c4e6e52673dc8fc3ffbdda1b3bc802e2d43fd865255fa73fc57fe1b3a17560fe6bbe50b7c88bf1177c4af
SSDEEP 12288:IR7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:IR7atr0zAiX90z/F0jsFB3SQkT
TLSH
T13145230B341E80F2CDC32B3566989C4B1AB99EB065E2AF45E2913F4F9D3C2C695652C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e04f105de38658d0237f14eeb397617a843efcfc7b4afa40ea8f4b505ccd95ed
MD5 0c72fa8693c677dd1832d8d9c070a1d2
SHA1 93d6585a662c97ed240815dc40972567ef5df782
SHA512 50133a63a41cd10e834f108b2a99e9ae3c6314605713081684c596e48362d363c0cf3c0b9dfdc038eb3a1cc800c81090ca62c5a368f3313a8b496b4e4fecf13e
SSDEEP 12288:9eBNUbTVO86UmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:9JIUmatr0zAiX90z/F0jsFB3SQk4
TLSH
T18065DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8deabab1e2c003ffe50d29258fbd9de58d3ddf78d03366f09ee3b2c58b625ae8
MD5 2c128946e78e8730f138e7d277e8658e
SHA1 ede534af9310fbbc73b5f636d80ab3fc34fc0cc6
SHA512 957af3918423ef0f040922809dd9a0b81faedfc68a8c2244c019997816fbb047b05c0b0ad3178259a5fd7296ac6829b86c6ae7112eba34209813563ce14fba05
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:XQvGAdlCEL8c/yRNw5CgB2Yyjl
TLSH
T15E267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 aa315551bb90e7ec7d25382f8dae9497406f0781013e976ec2803581b30c4091
MD5 4215f2160d60c002d9f3a282fde4688d
SHA1 79cc928ed545df48eaeea5ef0f68ef17b7033264
SHA512 2a524da0654f36a968ee7dd1ae85ee5ff69ab4993d36248af05f6c2b8ed4a6be8c806303cfcb9c3a9df882d9618d032bdf4d528ebd53fa7fd0614146a6716a05
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHa:jdewsAjQatr0zAiX90z/F0jsFB3SQky
TLSH
T1E475E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db74e113a96eeef8d7f40f303bdcb56462e654e20c3895340f38313e1aabb267
MD5 1216d57c18645ab520612f9b1a240bc1
SHA1 43ab0a5aeeaf3fb10475f642abaf2cd2ba24d9a8
SHA512 200c09ef8d31ae3ec4232a65d301ccff306463610805ccc6317355930b3d39c722e22f81bc1bc5a55a71f57a09bb1ced8479b1fe7feddc6b9ac80c630ad40974
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnZ:iUEtQevvqc2W1cpV2EI32Z
TLSH
T19E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cb83c58ae32cb505ae8b4687ee01a719fc3f8b6a6f3c985ec095d7a1e90b7e7d
MD5 34c406308d987a0ebd5a3a0fda054497
SHA1 cc4eab0b3254551f6f587e2345aa29185cf6669a
SHA512 f424aa61ba5c7116b4e36e3eede1e64e6a45e551c0e2e05bb84088f98073a7f1e423ecb0ea12beaf09687e724a0253086e21c540f5366afe8f275d9b11ea8243
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zwaB0zj0yjoB2:1oqtVjnmcB2Yyjl
TLSH
T1B9D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 027d876e758b68be3ede360501356fb763c3f1662aa629b2080c519c7988c105
MD5 245311006b73235ed0a114cc3fe594c1
SHA1 25c9770d2afb4ae8e10e3a71f6c15009de3076be
SHA512 e33ad19657ef33e410a13e5886aecaeeb66a37e64e5856710b8f9af9d7cb05bf5e95e0a93d85d605d866139528d93a34121761698d4cefea329f9bb7e6ec7e22
SSDEEP 24576:IAhGLJIFoiwtA5l7S53Natr0zAiX90z/F0jsFB3SQk4:IAMyFoiq59aB0zj0yjoB2
TLSH
T103359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c7e98de71c29b194bb970736b59851170df40f67d56351649601f20372d850d0
MD5 9b77176c0b93098a2173ea4211a2411c
SHA1 32f37a8c226568daec76a4fde2a9a46071257854
SHA512 f345ef9d5f6de4f2d2a38fb1ca61a503b9425141b3ac786fb0b53cf8046c8ed3e0bbd33bfe6545bba18f93f4df5aa39e700f899a47eaaf010e73707cad156e20
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:5wuoOWkatr0zAiX90z/F0jsFB3SQkD
TLSH
T17865F14A36A90CF9E9A342388647C536E7F2BC112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4fa397de50f488fa111b1cd19d745ec60bc78487e5570dcb5dea7bcf53924f1d
MD5 96e0e640452126909824c8bf497e6a89
SHA1 744eb99da2621920473b2931847f832824842715
SHA512 5a102fe1c6b2ac50752d5d1112070fcb0ebdd09e9527d7fcb29b20416227c95bb1888ab054080047b600134a4074cf738065004275c52b4dca9b1b6babf359be
SSDEEP 12288:bBZ1IygUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:1ZuHatr0zAiX90z/F0jsFB3SQk6
TLSH
T1A755124B32A960F6D5D3523CC9E48906D7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a28c235eed8259eec307c571d15663f2e1f9156b2c784c697126f596cc62890
MD5 6698683f8e7b7f520dc43ca2a7471b77
SHA1 033248c36aaeae7093afaf79bf88f672023e83cc
SHA512 7407bfa65e6a71c95aa85dae670854074a7857d977513947cff320ab6d98a3bf57c48762b9cd05d30f8f498d1afd5b116cebc5ede5ad0a2771bb7cea5a7ae215
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:zQRQyi36YOcPQLvw2gAf+PN3tB2Yyjl
TLSH
T130667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 81393a773351e2d63f8099da987b7850cdd142f1aee7f4c6437675a7e963e317
MD5 15c815b368b47da9177fc6a7f6f2c62f
SHA1 cb24dae505cfa8b724392a09a8c1bf11563c2914
SHA512 7cc173e43abfdaa71f34dfea67e0900abd4c3b9c3fa83d21c2cbf0425f83803e19cf00037e19dee7f793e01b62f7aead5f8b17fb0e7ea4ee085031a2e139dd6d
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:wQRQyi36YOcPQLvw2gAf+PN3tB2Yyjl
TLSH
T172667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d477f0f7f1c4f812aad13a5a8ab2b77ead295be5212d5b8436e18b370f2b85df
MD5 664ef06e34be59cd140473e0e756a272
SHA1 9121cf7b5f3262c40bbe7bf0f44b5b1e72bead31
SHA512 888047503a7e48b85b9da83126049f98fb4fc67a3bc4d6cc75217ea85e8356937d05f5ffa2f844ccec218df70140e293c303e9ddb8811ec891fab016d376bc74
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL03atr0zAiX90z/Fu:n68Qg55nhheWu7PNU3/AaB0zj0yjoB2
TLSH
T1E6B55A33B2F600A9C44DE1769F4A872196D17C718FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff7caef619d58eac8f7b565e429d21f62461c5ab77465bad82158791253cfa94
MD5 d9b6c9e9b44f79e4857487da6dfaa8c5
SHA1 351de4a83efd406c8b3f377bc41967b8b487ee9c
SHA512 71223f5df3fc414df909c50f15c80e4d31bc2f29c9931a6e2aac23c4a8a9198cb4c0b5858b545e8435dcbba830fc09f07d1808968117f970c8e8866f5400e7a5
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:ay5112gYy5azzVvL69nLKnhZmB2Yyjl
TLSH
T128167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 013a41aeb947561f0660a5bdee27a744935268055176a8b4a19b8e6183137912
MD5 2c5a6734adbb561b8055d3d63073979b
SHA1 3ccbcb9746fbf4f3534e9894029a6d0ae350c28a
SHA512 55d3f9118205fa723e8e54154728c8d018d78c93a44175a78e39011179f4bd7aabce404252cba15bae1a0540a3371f88f8f107de6ddc1b62af6095370f1846c7
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRaB0zj0yjoB2:3u6JmVxd2d4B2Yyjl
TLSH
T10ED59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a35a6837155130281a2ca6ed3f3046df56f6206521c6a4ead0ee4b89fc4b73ce
MD5 f6b7688002ec6b494bce50daf7e060da
SHA1 641a355f3f6631c0cdf04d4da1ec8458d30ad83f
SHA512 35061851ea684e202a928b5af39373f33ae8ba4b80eea1f1d68a0d3015127f9bea7a229d10d5cc420674a7bae249ee382cded62f2a9fd0955f3cafad7cc6be30
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xGaB0zj0yjoB2:PmifPbRcB2Yyjl
TLSH
T13CB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 858b0f390acd43c347685934790140200679b4b8d6567af3a23a1b362e925ba9
MD5 609c34210a7d1489e4e13713706762d6
SHA1 33426a7df858c45bfa640be832b2ba7fdbdfa79c
SHA512 5b16e4c8a65093da65eb3c47093bc5a13894c2edf8599d18b51d5104dc84b82e5d7180a86c3649df443298def9a108666ade8314749742360701932b991ecba2
SSDEEP 49152:NSuZQIY0Be2KRRVtOnks6NMHqHaB0zj0yjoB2:D5dKTi616B2Yyjl
TLSH
T1E1C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d4bac18d7ecd774dcb23ecd924a13f32e1c49f751a1f1cb546bc88c94bfd7913
MD5 b4e3dbcab8cb4a4dc1edd29cc6e834b5
SHA1 01d9b790cbd1000e11ef6bf7d7b850ffd39df326
SHA512 7daca232b3e929473ea870907d44ac8b1f953b760f1e7e36f56595404cd6463a2cd7469bb81abbac8780b15a5f152bee8def3f8c75ba1816f837f9b9480e5f9c
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5wCaB0zj0yjoB2:gX2iyphYB2Yyjl
TLSH
T1CD95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0c72d73d4b6cbb010fc8b6eb653e972575782cc7ee2a41bcc931538cf002c43c
MD5 0364b17580f264785e40a36bffb108ef
SHA1 578fe05253bcad101ad841bd5e26873955170e5e
SHA512 5c4c4593c8b1ffe612bec958ae2476f7d0a5d0e5c8d59a0832ddeb0961bf19272053ea4773a082a9201b33a29b9a8def5726c8191f67d5c86455eb560d882bb6
SSDEEP 12288:uDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:uDatr0zAiX90z/F0jsFB3SQkb
TLSH
T12145230B341F80F3C8831B355284984B1AB95EB4B6E36B95B2D53F0FDE3C2C625656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f5616b8739ae9b61322695cab3a57ba0c9d9bc043200408a306246832b4aad94
MD5 dd4b4321cdecdda8ca8af57d52c50dad
SHA1 820406986a6d31098546fe3e015ca27ad39eed68
SHA512 45396222a9c7143be4897ac9585693bca6c613864f281d259b71ed4d642a38c2b10a741c8cbeb18f21529bcb33e569a020b4e27485debde64387fb4372ef00f7
SSDEEP 12288:Y8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:Y8atr0zAiX90z/F0jsFB3SQkz
TLSH
T14D45230B341F80F3C8831B355284984B1A795EB0B6E36B95B2D53F0FDE3C2C626656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b4680045eaf10d591220306a66a242026911e127be4c3821f675a460388bc35c
MD5 4b31225d5fb3cd6f3e1dd573d9abf3f7
SHA1 9f52f2be67d3fc662c37260a4761cd256dcd09a4
SHA512 d5bab8c6eaf048ae059822a59794cda0d43f774c0bdde8a952f677b25e59d928f93545dffb06b396e6c1caceadce582e73113cebe7c6332ec87bf02e1cdd67cf
SSDEEP 12288:auUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:auatr0zAiX90z/F0jsFB3SQkD
TLSH
T13445230B341F80F3C8C31B355244984B1AB95EB4B6E36B95F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cd52919e1341c09c69b3f28ea6d5b60988ff4aedf4fcdea222f9e74b7c28fe26
MD5 6060691eaa95f3dc88cca95ddf67b4d5
SHA1 da97ae0b7ae27067c5a2c4edd30873e0cafd755f
SHA512 1ad7588713b7d73455dcfb84336432d549b392ae63bac9061238d6d59ee8043ff0855a72920a243280f9107343a239129f6631793416fe8de0b3d30f4cf91f7f
SSDEEP 12288:NVtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:latr0zAiX90z/F0jsFB3SQkY
TLSH
T11145230B351F40F2C89397358694984696B5BDB0A3F3AB9FA2813E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4fde99b061ebecc4396ceaf45cfaeab876f6fd8dba7e943e194fa4f1061a2569
MD5 de772ce4ee41b91f9b8ecbb8c80c2c47
SHA1 a7e74d8e8539d0d40fe4c7834eeab318a2ac4bbe
SHA512 b7d87f4c8ec569e1ae6d7c148020a7ee3ff88d90b7d8a79eabd3db7fa0110eaba4151136e36e34a06ef7db29c2e91fb3e7eb0d7e061d0d0b7a1a88858dca25bb
SSDEEP 12288:olUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:olatr0zAiX90z/F0jsFB3SQkz
TLSH
T1EA45230B341F80F3C8831B355244988B1AB95EB476D36B99F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9f2bc7e2fb524eea1b76d81c2af61663c77632526015efebfbfd32c898c4313b
MD5 b29c88c7de26078766c39295ecd6557b
SHA1 7cf63bc7293446adbc2e7f67b9bc6b0ecb8fb990
SHA512 07ae05f4d90c076c2e8e7b893fa3f8689cf55b859203e63feb654730482e70a71fb0b9f43762a42646ddb3901835d2d7076052780a76c21df07ae525cf09f2e0
SSDEEP 12288:p4UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:p4atr0zAiX90z/F0jsFB3SQks
TLSH
T1A145230B341F80F3C8831B355684984B1A795FB4B6E36B89B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4fd4cb99c26e833cfc33d4f4f5f84cec834f942465e17672b643b8ca29917345
MD5 c78b88c1aec0974f93f8815b2e1f5d00
SHA1 07e2d65be55f98967067927e4e8722f1399e1550
SHA512 c13f230a070428733b7b20bd75cc6d3214d9f6544bb173bf0ebccdce8890e13b28b273f5e847f985a196ab380b0781e785aaa842239c3d8c816f90e49c36fcf5
SSDEEP 12288:JUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:JUatr0zAiX90z/F0jsFB3SQkV
TLSH
T13345230B341F80F3C88317355644984B0AB95EB4B6E3AB95F2957F0FEE3C2C625256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8a5dd78701fd5a12c77f4b9ecc0d1a492a8b9e495fe82f86d03a53b47971231a
MD5 db430eb3b1fb010dff5ad3d6f8c82c6a
SHA1 68626b45b2a5863691c7ec545b881f87380a04d5
SHA512 27683379111eaa014d48330b18e15a04e811163ec4b1c8a6e5960f06855a12c5632c6c89029f167ab19b3b1e8c6c1b843172614f47eed4f6c033ca780d3fbef0
SSDEEP 24576:bZMSzFVSOcatr0zAiX90z/F0jsFB3SQkZ:bZMSzfIaB0zj0yjoB2
TLSH
T18165019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4e424663d9e7970f8fce829b334824a74934bb3b2c9972e6cc7c732f5c78c18b
MD5 7458a6c716d9dda25f88e88ebbfcb33c
SHA1 38df93f5344e181deb166004f86215bf5ba61ce5
SHA512 615832d824df08e10500dd82ffe98c15157b78616cc276fa820d092a355776ceff91b252ad73c389e694f603ce7da08a9725410c69d3082464bdc52f3db7dcc7
SSDEEP 12288:TXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:TXatr0zAiX90z/F0jsFB3SQkX
TLSH
T10B45230B341F80F3C8831B355644984B0AB95EB476E3AB85F2963F0FDE3C6C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c3425eaae25e9fd15650ebc454003f3c81ec9d880b328974e6f5fd1b8a9702b
MD5 cdec39d4bc43647f4436431db60e4b81
SHA1 2be26bdc8f261ed1e114341c9e1db162f981fc86
SHA512 275cb51eb4ddd842cf72feae076bef6300d8d8b8a6942017f9ff9038f64dfec978f326da2da93a864b7fc6d6171a185b1e75d91b3ba869d6cd811f44b48e377d
SSDEEP 12288:BLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:BLatr0zAiX90z/F0jsFB3SQkV
TLSH
T1A245230B341F80F3C88317355684984B0A795FB4B6D3AB85F2957F0FAE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ec88744e5c75b50ba88e9ce08201ae77ed6c08c9560fac3f6409ec69e74bcd57
MD5 190ea50a159048333d0f1752c433af9c
SHA1 8d6ae8118288f19c1b029cf4cbe896c84fda250d
SHA512 eb459abe1c777736371bbf7065600267dfe9f4d0bb7088fc98e66bd1b7a67e4c7b4c9723a4e8da115a6dd93c9833bf1f21067ba339e1edbb204425af61c42fba
SSDEEP 12288:8yPz5L8gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:lzygatr0zAiX90z/F0jsFB3SQkr
TLSH
T11F551207326620F9C4639238C9911D06F776783117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 99a52239981574ced31ee5c1b1fc005433d26d582dc9fcb9abff537c43bf73e3
MD5 b0693aca021ebe43698924a4503f6117
SHA1 47a684b863f3e79e6202e683c2231ec0bbfaea69
SHA512 abf2bd426df54ce04f21090f1721cf1105bacb0e18b64b8d809b9b9a3af2d8e41f1313afc28c08c220e3cb358725d1fdb59a9db5cdaa18c73013c3546cca2804
SSDEEP 12288:+XUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:+Xatr0zAiX90z/F0jsFB3SQk5
TLSH
T14345230B341F80F2C8831B355244984B4AB95EB476D3AB85F2D63F0FDE3C6C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b8106636285b24a100da62f8f9532a65188b8a4c37aecc91fa850c699cda149
MD5 4b1da6f9cd6873cd28fb48ee40cd171a
SHA1 3ed0a30926597a73f5ef8aa1f9dd9bd10e2cdf68
SHA512 d2df1834fd91fed848904db4d89d73649d09b93ee26a7ec2cffe60e8062eca90e85e3d7401e7548031b653d528e893723c072b69de3aae0753fd9a998f895684
SSDEEP 12288:VXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:VXatr0zAiX90z/F0jsFB3SQk5
TLSH
T10045230B341F80F3C8831B355644984B1AB95EB472E3AB85F2963F0FDE3C6C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c60dd1d8715d9315fd8b180640319035ef0b1179b91056215f9325d4620d5f7a
MD5 b14d0369bc8ac8f88078b87a394be14d
SHA1 9be2eeecbf11b86dbc211813b6b8abd877e7bca9
SHA512 7dc0991a58f255eb2b3262b38bf3b9dc84751b3690ee64f2e5d7c12e0fb90efc0ad7ee55e7ff6dcbe167cd98634dbfcd2189a625abc8d78d9148d6ab915f637c
SSDEEP 12288:iyPz5L8gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:/zygatr0zAiX90z/F0jsFB3SQku
TLSH
T17E551207326620F9C4639238C9911D06F776783117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9e0071c8766c1152dcde82511c47cf0c64182cc74477e3e332c503846ddcb5c1
MD5 8d8dde8792fdf95ae77a574484b621cb
SHA1 b9976bb6dc3b08b4e839350817b8ec264d62599b
SHA512 d96f26a630272b6a82cc1a69ea26a74ef503a6f3e0f0ea1a913c3a3e858038eb43dfbbea193ac305fd98afd4aa4fed088fb54957fa13a0a4e0674c606eeb9984
SSDEEP 24576:JTHaLl3z0zDeatr0zAiX90z/F0jsFB3SQkL:JT6LljJaB0zj0yjoB2
TLSH
T1C5650195735018F8DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ebfc35ae2c1ea65d71c9d03561562c42d01e6f18c9776506d6ec6e16aef8650d
MD5 975738fc1647881ef24f35a00f988883
SHA1 f0bab68b2a2addedb46aef3f7236685aed1eaec2
SHA512 8c47885563ccb8a6125a5928ecef620fe033d7d419b0ef8c1dba63d937549d507ac342b40ff79220a6f6b4df343c1e4b28c7e29aaf39de9d2d8956f7e6d75056
SSDEEP 24576:R37d9CHKy7GZKatr0zAiX90z/F0jsFB3SQkT:B7d9CHKyaIaB0zj0yjoB2
TLSH
T17875CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4ae0cc0a9617cebaf93cce2a353d324a879c354b324f71203949003e4003f634
MD5 bf2413b1e077c4f72efc9c19fcd3cd12
SHA1 ec3fdf824450b42009782e3a943bbcf85917417c
SHA512 d3c56ff683f810d3ba675d2fc4ed02987bd34286fa5c51c164759d29ef65484fbf3cc63254ed908906164bbf5350e5563da5f901704db7e4f1573de83d5b2cca
SSDEEP 12288:7OUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:7Oatr0zAiX90z/F0jsFB3SQk+
TLSH
T19E45230B381F80F3C8831B355244984B1AB95EB476E36B95F2D53E0FDE3C2C626256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5e42f6092f2a8c7ac471c9ceda0a068e01abc97e16df73055c7fa0c53902d4d7
MD5 559b3eee00440cd685f06c162e4d7caa
SHA1 fcbaa7ba8935ce6c6102eb5c2222e443ca7d7536
SHA512 9442ae71c3345662e7479bc328defe17dab85dc922c96d74f1422215aae541bb05e9f2a6c2d0092b038ac938035e79616045ac624f30acc72d8052efd15f7f1f
SSDEEP 12288:XAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:XAatr0zAiX90z/F0jsFB3SQkA
TLSH
T1AC45230B381F80F3C88317755288984B1AB95EB4B2E36B95F2D53E0F9E3C6C715256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b4a6a6fcc4cc324d7bff0c37a2ab68f466ed71d9e6fe62962cccfe68d57bb464
MD5 6aef1bb0c0ea9a31209be10d31d8cd61
SHA1 28e0a0906aac0f2ad70b9fad40855c5adddf1400
SHA512 c2c66464e5b7ccb3dc5a24b905269e688f60dd1cdb25c15380fd0f7c7d7d02126f7e277a89f0aba32cc3352e8bc9ba9b176139a3ad568f9ff6cdefb46ff01113
SSDEEP 12288:+BUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:+Batr0zAiX90z/F0jsFB3SQkM
TLSH
T11545230B341F80F2C8831B355244984B5AB95EB472D3AB86F2D63F0FDE3C6C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 02c6084af349a012ab3458a8cf64580328af011ee01d40826bdad7be39d80367
MD5 80b5b6d7f8c55eb910a2e8eca264a68a
SHA1 89883cefc9d1cd8ffb3427632e9cf5b55710b525
SHA512 f658a4fc46e971e91f40875b92b313dad4885ab9b9a6de3877af9e44e13daa3dca0ad36b0542d57ae3b0511d4d0354d59017847d81d3ae1a58fd54961451c60d
SSDEEP 12288:bXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:bXatr0zAiX90z/F0jsFB3SQk1
TLSH
T14245230B341F80F2C8831B355244984B1AB95EB576E3AB85F2D63F0FDE3C6C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e1e8b1b6e178242bd9859d12561b4b14a32dffadd4a08f8464bfed72cd36b312
MD5 3d80c117a17bc5ff2ef8f58efb27b371
SHA1 a279ef6c094d5b0c7905cbb97296d9b94090dccb
SHA512 71ac639ed90123fcfbc47b5e4826f675bfbbaec600f7e1ee94ca144638965c7f925403253ff749a2a2f6f871b4a4fd7cbb9ac9bdc9d383d3ea8297cf250642ba
SSDEEP 12288:AOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:AOatr0zAiX90z/F0jsFB3SQkj
TLSH
T1C045230B341F80F3C8831B355244988B1AB95EB476E36B99F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7fc490fdd194e8315047153718f8ebfb756099cf28668d6580bf7feed3483de1
MD5 21bef2dcf6d46e29111e6bc6295f1776
SHA1 b20201972ae0460537f9fa18f24c7be9546edf6c
SHA512 a43cf8b862d02e80050fc7b05666f93605afcef3fabd1cc19bc9f2feb240205809e29afc6a282630fa8046c5f2dc65477ae5f895fa5e8da7108edbed53f4cffb
SSDEEP 12288:oPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:oPatr0zAiX90z/F0jsFB3SQk3
TLSH
T1D945230B381F40F2C8831B755684984B0AB95EB4B2D3AB95F2963F0FDE3C2C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a7fc4ade50484ea361544821f6673a39ca45af2cb34f826b429e4393d4e5b726
MD5 27e7c202c51476c6482b750f3f7bf3da
SHA1 59ed00743e3d08bd0cae50ce4f5fe92b24838bce
SHA512 cfdb5ca637658067b49a2a3c68fa8f64fbee908261401f66a4ae9ce159236c2f4d94b39eadd8ef55f88cf23b39ac5178550a49d015b4509b7d16e4d76c37f604
SSDEEP 12288:zlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:zlatr0zAiX90z/F0jsFB3SQkX
TLSH
T1C145230B341F80F3C8831B355244988B1AB95EB476D36B89F2D53E0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ceade15f597c00e83e25af6434373744179b7f8a6ddbbfac2263090ac91104ce
MD5 88ef5eec0e93c2a1c1512dae4226771a
SHA1 61d56a1e481576402b28ad2d0ae1e8d0a5f69375
SHA512 c0b854ca5402b0cc6f92f51d44a90a902142cd01073fc46c21a7fad1a5ce4f7239ecd9b2ef93c7be231d3b0d4d4376b5bdb4c6b4c3242ecc35380513869438a5
SSDEEP 24576:8fwvok9RX6wkyAIbatr0zAiX90z/F0jsFB3SQk+:cMnYIbaB0zj0yjoB2
TLSH
T1B585D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f82e15c23fe9f35739c369eee5bb649df1159b5dd9ae20ec5220ddcd7e84ad68
MD5 e402d9aa926653c89098bd19a953c6a2
SHA1 2b5262ecd4f1836c82ba45c887fc825ab931a202
SHA512 cae749f82d89bdba3c0d8b6d93b988e89baf8897690c58d61228b117f3dcee0ec6401b25aa2736279e0ea53fa257a35253d5e5c8e70274c73a1b9e000328baee
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iaB0zj0yjoB2:TySzPNB2Yyjl
TLSH
T174066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ee0e47cb78b2248d10357e83205c949e432cddf00b946cb042398c91f617dd11
MD5 1e42520813891549fdd6d9040fa1d9f9
SHA1 e0b0fef87fa4571acbaaa5797337958b18a4c503
SHA512 41282b2e1be21ac1c9026924e65db2c56ecf4d45fe44a7d8f0fd32f946a2d3ec91df8fa1630c03cecc3bb0e7f58608877f19d129532c28cbc334656b248a9311
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsatr0zAiX90z/F0jsFB3SQkI:C47JUQj1irIhCnDHUPfF/yaB0zj0yjos
TLSH
T11965AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cd191ac9aecb4e9ae678f43b9799ad676a087e427b17a9cf045baa6c558b459e
MD5 5575faae0aae33bd9d78342afaabe8e3
SHA1 905054d95b04a297358978e804f31013f13bcdd8
SHA512 d5181367111059dc57a7f5e65eebd9a9c9c091905d71fa3f8ee890486efe4a74cb69d771ec3f042ec33c6917d2813404b9361c9ccce3eba87bcc7eb7c9f8571f
SSDEEP 12288:oNsfHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8N:JHatr0zAiX90z/F0jsFB3SQkw
TLSH
T1C955F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 40d391168b7e72a181cb2a27724470f9e60424aff34466986f50ddb645cfe3fb
MD5 81a8263a37c157fd5103e8bab798cfe4
SHA1 1660e01d839ba48acbd38f7d93b93133a43f2851
SHA512 157335da50873ffdbe542dd1a9f7f4faea847ab62da8c54cd05e7c877bff31ba909e03f98b9cbda6a031dc3a55dda5862882503dbb72fa39a6259bfe2868894a
SSDEEP 12288:gQ5d+BU3f++zyxe1Qyp9oloseIvLbpbjyU:gQvOUPMNk9oCsemnpv
TLSH
T13A351840766AC75FC6A940321E72C1CCA7707D41FE05AB1373C88B3FD576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 2e266a36520066dcdd894bf6f3b4b777da234aa9eb74a24540a1fb2491ab502c
MD5 81efccc1ceb55f880a539b96f43b6e80
SHA1 40ed057dda86fd92a8df1101fcf5862fb8d58d86
SHA512 dae7fa0ba4834bc3c62f7b97df87ae63fff1f5c5be928460abd361b79a5536053621266324f280e682bf638bd5132878a5c1a4c24f2ef1c5f8f868dbd9790ee5
SSDEEP 12288:H4qCGkMlb1ayQZAXVi7iUg5abakaJoCHsuC2:YuIG
TLSH
T17555B7815537A2CFD1FB6031076A5B4CB764EC06B7096F26B3C8453AD82AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4ac32a65234549ff86a85caae1460ffebcce51d79dbd6f28642bf683160643df
MD5 281baf2770cf78b38030131f4899d7bb
SHA1 92ff246b097a8f1cff1cb23ac63fb2ceaf40dfc9
SHA512 67aec27ac882c51a5c9652ba18bcc6673f99e4ea218e9704201faefbd0f04afa0a4cc396ebcffe0ace718fcb85a12bc62c7e70ab23da96f727985b84b50f2997
SSDEEP 12288:DM7/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:I/atr0zAiX90z/F0jsFB3SQkX
TLSH
T18E452307351E80F2D8E32B3452589806167EBA706BD29AC7F1813F4FAD386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 47c3435957a6832f42a1fb002f3e73c91451ef051b0ed7382eec4ecd48149c33
MD5 3b7118d4a83973ef1231c16809c91da3
SHA1 3605c52ab2f359409a8c65fcd32b8cdf628c45b2
SHA512 064b53ece1d4bbb491af8c0a461d6385d99f7330dba920e41a54945da472ec365e42601f34809a007080c1e3d72b3b3103f03991b461ceec99a5616f0f5abd05
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYJatr0zAiX90z/F0jsFB3SQk1:Cgb4mBIBhGFsaB0zj0yjoB2
TLSH
T13865AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5d42a2adbce7432e1824a2ecd19c7e675945e070fb1692195e2e6f37d462b602
MD5 672834a4bc691a27f013d21cfb0dbec2
SHA1 5b559c0cbeab0f9d32473223634d25e53ca3965c
SHA512 024aa143310762b12cb8c47b0106600100d0db4cb13e184c8b819e0ad79bf9ff5e7cad3c78d22eb566751a365682b6b35dfcf5f9f25be3c3870e34066b948262
SSDEEP 24576:cG88u8FpJqH1bzria7/mcatr0zAiX90z/F0jsFB3SQk5:f7ZFPqVea7/haB0zj0yjoB2
TLSH
T17085016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 353daaaf4f126dc4d9e35bc176771a6f5fb60ce89bdabfd2f282ae5c1e1866e2
MD5 205eebe10c6997baffef60c2e5691268
SHA1 1f6676e8e34e88d66f9bae262c7d4428170f7550
SHA512 308bcdd4946a46698b43ad3e654a3664c582d9bd93e1338f1506703b08b57ddd6e450961529b69437e5893ac97dbb996e85a56fbe8fcda770509c2b76e9addea
SSDEEP 12288:kHvUrBFrEjwaQIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:kPUr+NQIatr0zAiX90z/F0jsFB3SQkE
TLSH
T14F65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F27ED8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 83376bb7bc071bd44792fbbb1dcb8834c26e3769ddb392eeee686898b03c3352
MD5 e02666bcf636458601baae00495dfc05
SHA1 eb15ca7812910ee94fdba6b11d18361930fd2bba
SHA512 ae3b5d27d7a49a778b2b7629323630f132e1e15d5843b5241a1c0c2616e16609cbf9a57901a61dcdc7af5d2de39b111cdc58c91a6622f10a9ac002bca09e0e7f
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4aB0zj0yjoB2:EG05lO43beB2Yyjl
TLSH
T159D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ae299c31296b997ed08db57816ef9792539002093e7aa5884656e11ac700ed48
MD5 d88f4898b303e47a30a4dc92253f4e2a
SHA1 efbd1b1c32b69af4fceb887a257e1fd723e7bdc4
SHA512 9d987e706a65cccbc216af0908d28369662840fecc96ac73624e8d9192b7cd6225481805286ff4e57cfe0a87406589be88744e0112215ad71ecb3f868c28bdbc
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidniatr0zAiX90z/F0jsFB3SQk9:Ta5POZ3+Jt2pasx2+mAaB0zj0yjoB2
TLSH
T15D65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c27f54a2abd41fd5100e23992127bd480076b21739b478cdf5e189de5b1404c2
MD5 27107ee8443ab656b6898969b9c7b67d
SHA1 2275aaa3be5caf1f088573ae672af54bfa0af634
SHA512 0ec41c2d2e5ce4469dceeb8e36e22788202f77d96753f72e6657d22ded7de7bfdcd4fbd1ee036e917d89b443fd2cf16abf14675d81445207aef1e67090b29e9d
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkEatr0zAiX90z/F0jsFB3SQku:qNc/zEOVHFBaB0zj0yjoB2
TLSH
T1EA858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5563a68f450152077037c62207c5f7042005bab8be956ebe256598f07bac7fc8
MD5 204017e40b24f272e436ef1c66fe8ed8
SHA1 44f39205684395940322777ba2e8799dd350910d
SHA512 316c4bd7f9b777dfa7c3ab8d836326e1070d40d527012ef0cb29864c2e577da0a5fe75f9422434fef61564e3394dcae64110e4662b728a311d8b0def9d20ad87
SSDEEP 24576:l8kNvNnaFeYhJNtmZBm9atr0zAiX90z/F0jsFB3SQk5:l8MwBtOm9aB0zj0yjoB2
TLSH
T1D355BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f2db87f8440272b9356a1ef413c41050d26e7a0631a93840d9b50bff34cacbb8
MD5 06bbf85f16ff0be9f87189fabda6800f
SHA1 eba53eab75665620cf4790d023c1f2902e337fc2
SHA512 551c4a5fce13a79fc3472ccd066d44871d17b0c8a6e1cb1fae845da7c18509a8556eb911ec85669a0e705d96b1c2ee994778f8c14b65f404986f65f7c97e68f4
SSDEEP 24576:+D3FHshBIYQgAjatr0zAiX90z/F0jsFB3SQke:+DVHeBIAAjaB0zj0yjoB2
TLSH
T15175E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/796-20-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/796-22-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/796-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/796-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2192-130-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2192-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2192-138-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2192-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2192-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2380-331-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2380-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2380-99-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2380-93-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2380-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2380-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2568-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2568-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2568-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3088-245-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3088-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3088-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3088-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4376-78-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4376-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4376-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4376-40-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4376-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4724-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4724-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4724-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4724-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4724-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4724-316-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4932-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4932-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4932-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4968-83-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4968-88-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4968-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4968-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5568-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5568-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5568-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5568-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5812-52-0x0000000000400000-0x0000000000D34000-memory.dmp

Download

memory/5812-0-0x0000000000400000-0x0000000000D34000-memory.dmp

Download

memory/5812-37-0x0000000000400000-0x0000000000D34000-memory.dmp

Download

memory/5812-1-0x0000000001340000-0x00000000013A7000-memory.dmp

Download

memory/5812-8-0x0000000001340000-0x00000000013A7000-memory.dmp

Download

memory/5816-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5816-119-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5816-125-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5816-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download