d2ff4b22ee9b7773295db880429d054ff7caec4ca612de2aa1cc42fd56b6ed46

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
Size 1012KB
Sample260730-vghv8awvey
SHA256 d2ff4b22ee9b7773295db880429d054ff7caec4ca612de2aa1cc42fd56b6ed46
MD5 d02754a0bfd6cc456871b28d571dbf32
SHA1 1436ca022231982c436faf5beb10d3a532966ecd
SHA512 06e4c256a4c6968658ab6f02748d24c7c677a255dec9f1e58497407e6c526a11323bb34d451230dea38d0b6880795107830a4798d6268a23c9ef32efb98b2a65
SSDEEP 12288:MwOATJPv0AhS3NHm8DTWnBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwae:MwTdPObnWnB6mctvE/BT76+1NCE
TLSH
T10725BF9876625473C5B40AB05BB0FFD8423A4FF33F09219672433A6B7D79B42E91B096
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4724	elevation_service.exe
4408	elevation_service.exe
4108	maintenanceservice.exe
5284	OSE.EXE
2960	PerceptionSimulationService.exe
5624	perfhost.exe
3716	ReFsDedupSvc.exe
5972	SensorDataService.exe
4220	ssh-agent.exe
2928	AgentService.exe
2388	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e2d4bfa024febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4492	3048	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005349fc8c4420dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006d9568d4420dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f20dd8d4420dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058ab2cd34420dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3048	2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4724	elevation_service.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2928	AgentService.exe
Token: 33	2388	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2388	SearchIndexer.exe
Token: SeDebugPrivilege	4724	elevation_service.exe
Token: SeDebugPrivilege	4408	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1704	2388	SearchIndexer.exe	103
PID 2388 wrote to memory of 3472	2388	SearchIndexer.exe	104
PID 2388 wrote to memory of 6132	2388	SearchIndexer.exe	105
PID 2388 wrote to memory of 5176	2388	SearchIndexer.exe	106
PID 2388 wrote to memory of 3864	2388	SearchIndexer.exe	107
PID 2388 wrote to memory of 4516	2388	SearchIndexer.exe	109
PID 2388 wrote to memory of 3916	2388	SearchIndexer.exe	110
PID 2388 wrote to memory of 4144	2388	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d02754a0bfd6cc456871b28d571dbf32_amadey_darkgate_elex_hellokitty_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 448
  2⤵
  - Program crash
  PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3048 -ip 3048
1⤵
PID:3512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5624

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2592 1524 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1696 1708 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 1696 1708 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2592 1524 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 efa17dd423f61ba1544660477ddae18072cb14350bc59ce4aa9fbd3a9e85818e
MD5 c1102d9281206026a97c319b203dbe0f
SHA1 554e82c02ddd5d60028741edb12a59cb07f98fbe
SHA512 b725bb1cd8c9fec41e02746f63f34b7f9a6c139eb951d0fb156949fb139686737098e07cc73e9441288ac7e63f0ebfb903e9b24ae77e717c156ab9e9adcb4d18
SSDEEP 49152:Ub+632BuPkFKRrdE6ohrstBhuXjfS4LWxnx6mGvKVO+n1:O3q60jBiXeN+1
TLSH
T1A7D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8df385da6c9a847287909ce355fa1e71324ec96068d4de5c45ccfd1a71369889
MD5 f9854f3b2b797f5afdaed1f9f9d52fd1
SHA1 97c5d34d780503f7de5d321002dc7da3bb331571
SHA512 95fb78ab13434a8bc65ba76300b318d93507835ef91d92d7640d61838e84e95d9f44e8f1e0f8daa17e252bae022aa839f91998a6dfc99d9f559652b4a52fe457
SSDEEP 12288:E1XLsswWkxy2lRq2czAetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:CXYfDtczAe6mctvE/BT76+1NCE
TLSH
T1C3050224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2f13393b7b86a6a0b1123a8dc99a4bd57439c2d7c61cd93f4e1db90ac6c03954
MD5 f000f205b0567e1b8fc05a1d2005cd27
SHA1 828b4e521b39dd08c9a58d530724a3dbf44daa3c
SHA512 9f7b848033ca8192296605daab295bec40b30f27d83816d9f25e08e77111a6fde6d78daaeb4c138c4f5dc01e4fb0602e5492115a0c02e0a1874a72e80f62ab42
SSDEEP 12288:RXZNYVLeyUji0h90ZD0wxpGZIVuqrHsptM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:X0Le5ji0hmxNrMp6mctvE/BT76+1NCE
TLSH
T18E359E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec1cbfae4c46e86237705b462cb0bf215d6791071e750411af5a217ebef0d237
MD5 f489ea7ea8ca346c9328ea81b429343e
SHA1 69dd7c8f1370120537b95d5626662e5485e617f9
SHA512 d9b9707204fe8b637a614febef503e578b0a75a77b18eb03aff62e7f461c8524d2c783c57f6398aff0a3bc22a749bc44bdef1a418a126639a9754e4574151022
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWr6q8wyuX6mctvE/BT76+1NCE:C/ezSC6vUzPviHjyI6mGvKVO+n1
TLSH
T14B755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2bf07c1ef6fe3a32615f44d0d8ea94965442d5a45a1551e72ecaecb8cdfd341b
MD5 a7426a4ffb2a298b58a30b513f57d620
SHA1 b16b80f950ce1496ba9a0d8eff8c04a7e9b2655b
SHA512 0d7719b48cbc413fe4627d34114ad14f771e31fe108e3a40e2529aeab1408104e24c311fa300c80a62df0d1bbe3ee5ce8603b42998244157d935f45010a430ca
SSDEEP 12288:gVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98OtM6hct28uP18WR/FW2Gb8JTCMx:gVbqPb88hv/l+bO6mctvE/BT76+1NCE
TLSH
T12655AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 acb4614c43ab041af22acc4e4b0a66904d03270561f38fab80ab172bd8c897bc
MD5 7ed9ab674042e1d4b46b549d4c27729a
SHA1 6ba892a13f4d2bdde034b4f4193e0ed2ad7bf9a3
SHA512 577a15df74da228ba4fb2124d5565f9d88a6db6b85ef11dafe783639be3f0a37c8cb945466dd82356f6e528305167f17af6fe390b222e53eb64d61afd4e5cdcc
SSDEEP 12288:kjNtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kjN6mctvE/BT76+1NCE
TLSH
T119C42382C81B11D0EFEF07F16399E296E8516EF934DA1C81D322991F9D30162FD4B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b8843a2e1c3252448d232c385e425630c6649d44ae122ed4cc7c8f4adc5f3b15
MD5 d56495a7e80e3aa2cab6b5a9de2e1fd4
SHA1 600b451c05a8faeed3fc4b5891bcd1d40ed3baa6
SHA512 6043f156986dc7490c4b24994e6fff747f83385190d62600f54a3369654f89c2baae4ffc4e8a2a8932c51c4f0d46d54091edbacc4f57ca4834204916ec577fad
SSDEEP 12288:OeBNUbTVO86U2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OJIU26mctvE/BT76+1NCE
TLSH
T17705CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 86de482bbd0a6e96dc8a12bdf95ebe6c32f77e48ae9d2d84e1614caf5e27ec28
MD5 ba0d79deec47d062669215959031a6d3
SHA1 bf9900c314d1865993c864c6d4238ab482032a34
SHA512 0df1132d5de8038a7b5b2c789e4516c50b2431427b0ec904a7feb2bf81db438a6e66883cd0464bdbe3c79939babf750311b3a5c43f4dcf0bc4b0aca5cfb77305
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THo:rQvGAdlCEL8c/RRNw5CHXeN+1
TLSH
T1BF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 285a9eeb06f8afcfc22fd0f976e7e962ad99aed1e75dff36d89f70b9677cfeaa
MD5 5736e8f5fb94733238b8a74220490c62
SHA1 4f3cf5435d314871fe45819f1d1dea9fddf1989c
SHA512 49263d5e90395f871e6c10230dd7ffd77d01258b7bef8b6eeff8924df17d9751fccc56fd0dba05dc1ca5d307395f257bd1e27a479fae17eef880cbd4f8ad2ea3
SSDEEP 12288:tAwSfxL/2Dc3DDLLmt0LDQewsAj8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:eSewsAj86mctvE/BT76+1NCE
TLSH
T12A15E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5380d12b4bb799494f5308a390fffab39db4606cb35062bcc79a12719a58ea69
MD5 25fd01cc4d792269b10cb93972f0622c
SHA1 896f8b05810bf73afdcbef355048ab8dbecd9f84
SHA512 790f372707e5031a6e937f0e6084f4d91b03841ee089fa18f355337c4f92d5d1d07ece6efa125f4f8d1a40d4c0e9885ab1d0932501b275adfc7750e17ac7f730
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH0XeN:oUEtQevvqc2W1cpV2RI326e
TLSH
T175474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 08f31d5bab58bf0c1fc50d6fa689ca7ed36d0d59762d86cb8a737ada342a6087
MD5 7dbb76e8999a802e011ca7380d28f908
SHA1 1f3890a8dea452c4a157e463b692d9b2d56266ab
SHA512 96f32507161ed22e580efb4c7983bba0d94f29eee88eb26104d7725716c01f96e8d5592bee527b8cad9cc8e499fcc6c393a941516646d1a2e5797a3d68c5ee0f
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zc6mGvKVO+n1:foqtVjnmjXeN+1
TLSH
T130D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 05d3271c530f9866e9adccf3cac9f9683fb49ade54981df999e55f5b8146beec
MD5 1ba915c8c3dc7dfbe7981f689b684154
SHA1 cb8872879a04555db4ec7d69dcc141b8c1bc6fa7
SHA512 a7fba682d58a699fcfb79bba25d7fdcf214a75df0c975eb7f04dfab325a22817e89ea22c1a10e34b78d2a936354f1ec0c7f8cfa732915a6852a3105235351f25
SSDEEP 24576:fAhGL2IFoiwtA5l7S53D6mctvE/BT76+1NCE:fAM1Foiq5T6mGvKVO+n1
TLSH
T167359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 38ecf83744fdb5b4294a17f72ceaed201d2a2395067a92052ff88c4b84657b1d
MD5 f99f65ef2c7f50357dfe73e645e0f152
SHA1 31106a199626fc5f14a3bf6804384956fcf65995
SHA512 adba2afb3926957fbe59614bc771f695d4b4c85d116cf1f3faae55d4624575d118ecb8ea5e6e92878ec9530ec38272850a5b836d6547a1cde4d6371b1d7514d5
SSDEEP 12288:4mw5HEjsChNSBFgl0WDm+CbtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:1wuXOWg6mctvE/BT76+1NCE
TLSH
T19A05F14676A508F9E9A742788657C136F7B2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e71ed6d6529c0258a539fffcd9c166a0c9f8e34ecbe03cc518ac417646c39c0a
MD5 1fafa06d0a6f0391d24d2afa9e7f47cd
SHA1 c2b00fd0ff8fd466f68bf354eff61b86210d648a
SHA512 5064db0dbe92d0f9ba016f7555a294b5f7f742079aaea4929342267c875018d40da81de4357c7cb3f5e7e6e0c278b13c23f583be24d66e49693b9b0a6fb9cb07
SSDEEP 12288:Y/Z1IystM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:cZuR6mctvE/BT76+1NCE
TLSH
T1F0E41286226520F5E5E702B8C9E19245E77178E6337603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 055df20f2a9ab7be060330d59e96c4a99100244c97208c1eaa311740d9da4d92
MD5 c6f2abe58736e94554a127ffc6f13e41
SHA1 371f9a83c08c88ce5e2eacc97fc5d94cde7e2247
SHA512 82ceb0c6b232e7eefbf72339b00549eb22dec7ad629d5fc2e76d668204bf810233f0d01c54192f5ee0c4f28c2c0a23d492242daac023c800dd3d77357c95146e
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uc:mQRQyi36YOcPhLvw2gAf+PN3yXeN+1
TLSH
T1FE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9526b79e684eb0f82eae4ee8c1257d64880a58bd6273f5987970d8c6311e998a
MD5 9c09688a02550007fb704ef0795745be
SHA1 f894fdbeee6a87f669ec8d88a0c1864f5f477ce5
SHA512 4e6447e506bc76ffa3ea182ec30fe128b5d1e463ef1bfd22c7f714de5914efe14bfe26e64560df90924bcce56c7fe5bb5e90606443ba3bbe0baa4eb270ed6933
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uc:CQRQyi36YOcPhLvw2gAf+PN3yXeN+1
TLSH
T170667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cef3c05b704e2c9391fe150bdf6908ef3276f1576ab0360f54be2cff23e2ae2c
MD5 1c7a9248c1a3a7d66b29836f08befbd0
SHA1 2a4464b07f58379a292ba469b9f85776734023d5
SHA512 3568bad103f4d4ccca3fda29986d3355092b9bf3689d8d5afc10ea143d93194376ece40fb422f48c188c84e30f3a9b7ca3c80dc447920c46287be6579d35f9cc
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0h6mctvE/BT76+13:x68Qg55nhceWu7PNU3/M6mGvKVO+n1
TLSH
T103B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73854fc2fd17d3071f1b4a5e735f793584ab2130d7e096870817e3d21fa970d2
MD5 00ff328de3a52899879655832b23d8ea
SHA1 8b0bff47ce35e65bdbde7ff8eca4d7d16dcc7c51
SHA512 fbae5864f39c94a5abcdd3f85db33727373174ae82901b1b2e338245f16f94a6bcb3864a9b35ce478530a1f79f161d4117aada1548a4195b816e0a37dc7e1723
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk992:By5112gYy5azzVva69nLKnhZNXeN+1
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 57a08b548eb8486d7d4244064e74b40c5df2446dd15e059652f17275f9dc2d66
MD5 6848c1500ba0b20058ded712d79aaa0d
SHA1 1a0a93c4e07f45752b66effa55979615e7beb971
SHA512 da4a78164239def57cb94d198cb13c85b01464635ea93227268e4968060aeda39b9dd449ff2624c8def915076d322a9d4ccab076a19fbe88a265b98626c643af
SSDEEP 49152:kB+taZ3usBWOBr4tEG20bqx0z+n217aau1glO6mGvKVO+n1:+u6JmUxd2dOXeN+1
TLSH
T102D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2439e5f91629622bb8c72f980643367d05ab36b55b46d220cb44747a96794aeb
MD5 572549dd851fc44efe5fa3d0acb875d6
SHA1 21c3115762b1873339e2bd41fd9aa1424f2b2d72
SHA512 692af0a8c8a29de07febd736a68780acc3f04a90babd64a9b8a4465eace7260dffa0f9b07f7d4efc0dcf4295c17801c82e2c922cd60e8b8477ed9a1c05189f17
SSDEEP 49152:o1hpsNoJpF1A6BU44CwH7R4xW6mGvKVO+n1:omifPkRjXeN+1
TLSH
T135B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e7fbdcae1e8258916946e498e0aa82b879c7cf8194111dd838719f3960cd0b69
MD5 36f727e2ad4c55ea845f1923f60a0a77
SHA1 6b2b37cd5fc778671900e271f35271ef636c5456
SHA512 0705e8cc2545a4cb92d9034af9b485ee29c2549e297149354900425df77c45033fdc5226c6bc41ee808e8fde2a647de2b85b96f527d3bb2fb9cb31b0bccd86d7
SSDEEP 49152:4SuZQIY0Be2KNRVtOnks6NMHqR6mGvKVO+n1:i5dKvi61RXeN+1
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b3885af92b19cba8d4f74f984a6e0fe10b3d49b86c24a8fda7cad0ac5e40a10
MD5 29eeedde881aad721ceb2dc44aa80f54
SHA1 7efb4ffb748934fc118806de300ed4fe4490b6ad
SHA512 49da1fe3b8fbe4f44ac78535b25935dac179b8e64eb08122154d82e0e809fccce8548d0679260b9f708c52a2967b178efb53c91f93bfbdd5af0516d55ca784de
SSDEEP 49152:7htSn8EApI0figXgiDn0AP5wK6mGvKVO+n1:aX2iyph/XeN+1
TLSH
T1A995BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b8a93518a938965ff7b05a9126e2817288eba5abffe84758635ad2e8dcfdd213
MD5 5019e5540596bcf8022f7724750d9e07
SHA1 6303522de6dec0a9b5e7b5140b7e9bc1dfdb04f2
SHA512 10f8c3461c68c4dc9a5afe3264d6336d8828b38ac388a10dd181b998c32354ba62fe4220cec436971b184b5b7dfae5e06a2ca6b72de162b2de0ce1f64c891c00
SSDEEP 12288:p1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:p16mctvE/BT76+1NCE
TLSH
T1F7C42381981B01D4E9DF07F19395E29AE8502EFE74DB1881F316851FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 34b625f87fcb9df40f31c3d0ad46ecd2b6db378b760dc69ee06cf522155e47ae
MD5 094c10c3e31e73ffbd43afeb07306d6f
SHA1 8e40a23c1519ba2345047c19462620722d625106
SHA512 d364204d68e61f3c3135b488b5514c17f9a53bb4e4ade222951729368ee0743c8591f445985e9a96350a27686bbe27f4b343d62e9c3cfd3a933ec80435fe0887
SSDEEP 12288:iAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iA6mctvE/BT76+1NCE
TLSH
T1E1C42381981B01D5E9DF07F19355E29AE8502EFE74DB1881E326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 812f244d67dc317f038429705a827eb3b97038decc1a6a332825c97064e8ac4c
MD5 12a1905bb9027c786790c7d857f7e0ff
SHA1 a1156c89d22a00676da3379cc59b56f924b0e999
SHA512 891ee748d9210153a3e14a821a9e8fd1eca1bd12bfe50bdec0879733ed34818ed3223b023391c8f9fee68064cc25e28695b361d5e95f9b4e76d91fc65c7194aa
SSDEEP 12288:RetM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Re6mctvE/BT76+1NCE
TLSH
T1A5C42381981B01C5E9DF07F19355E29AE8502EFE74DB1881E326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 40644a960abd27fdd4cbdfbcf85ac63283b999b25df915d2d4081346a4956325
MD5 e2a092dea53458b01929876f68e0efb1
SHA1 e3281b9378e71d2049e712aeae9568a7248603bf
SHA512 238270409da03ce9f46bfef9f5662c1d793cb6710ef236539a7b20511496f365c542898a005ef73487150bb3f6342133758a8115580e070d1fb2cd8f9ceff9a1
SSDEEP 12288:uVjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:86mctvE/BT76+1NCE
TLSH
T115D42382692B01C0E8EB43F0C6A2D256E5B07DF975A719CBE311491F5E303917D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 bcb326a365742ce2349fa2b5882d2949f653b9c2bba48da9368282498e3ade40
MD5 d98bc16b3eb68a84a85217d238658240
SHA1 21d72812f704a4c61f1f52d10f1526b7785cddfa
SHA512 0b7f41568751933ac73b9ffcca8f035eedd11bada7cfedcbbf42c011d643af8d2087c2314ecf4c4d70c95ffb4dff5c79aafd1e9c5e6ce5867e254079c7ff7113
SSDEEP 12288:b7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:b76mctvE/BT76+1NCE
TLSH
T1D1C42381981B01C5E9DF07F19395E29AE8502EFE74DB1881E316841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d3be5c49f57c21a97c4a8ba385def3f6b60d3acae4fbf93bdb59afaa3d0dddae
MD5 2934d19ffd8a64b6bef06031454138e5
SHA1 163bae82339b90b178404b398288f8e91ebbd6e9
SHA512 d137932ee82a8835bc984e7e5319dcc625b170afcec28af6fb641325df896ddf8c012f00ae46e0eb2dba3ad70ff0c3a98af3282741c41907a0000550f16706ae
SSDEEP 12288:SktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Sk6mctvE/BT76+1NCE
TLSH
T1BDC42381981B01D5E9DF07F19395E29AE8502EFE74DB1881E316841FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2c357016db2bbdb8193c3f67aea2c993ba374260e3ba643da3f7a4d84d5981db
MD5 356361f631a3ac08ff3d26750ed1f899
SHA1 a905788205a625a4054cc24f3fea9615a4196686
SHA512 b531eec477e825ee378ca8dda06d28cb3ffa995fd04b45298827cf6f60b5e2566396f0d97168ee3d00871cb523a4ba486b0bd23ddd80000ab2553d6bd0286b5f
SSDEEP 12288:U4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:U46mctvE/BT76+1NCE
TLSH
T167C42381981B01D5E9EF06F19355E29AE8502EFE74DB1881F326841FAE701627D0BDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 faacdd7353013acfaf3453f58186110de3177f1116b4c7f6628298e10a9e088b
MD5 cc0ae7f88b5fad63ca56185ad7875b02
SHA1 2ae1f9f3802779c715de34414e8c840aa02e866e
SHA512 4bd4b1adec49ad1b2c24ec5fe76546e14e91c7bc91c72ed5e8dc10f57486418dc889a9ad971a9bb8c4ca4087cc49ea2f12121dfb322b69f1d19c285a4d726d7c
SSDEEP 12288:JiZwbczzFEoS2cPvygtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:MZMMzFVSOg6mctvE/BT76+1NCE
TLSH
T1A7050295B35108F4ECA7427EC9558506D6B27CAA16B0C64F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e8f0b0e95ce41392413caf05b55d0111d61ff5bfbfc604f7b6a1eb8a41b71543
MD5 2488efe5c849a923dcb015d726ccb7dd
SHA1 81997cc51c836556b18fa9a75219713c5af26356
SHA512 d66e0a50185eb2fab7f69e4e398fa34cbb998a605bbe249ac524c2c515e60405549bdfc01c8f47e1bf4fa56d2c03862ff08e7bd1ab8fbedd758975df9cc8a42e
SSDEEP 12288:GBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:GB6mctvE/BT76+1NCE
TLSH
T132C42382981B01D4E9DF07F19355E29AE8502EFE74DB1881E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 93497367b0ce67f5c1546d51613423a54c06d2d1d73bff35f66e224b91544186
MD5 6c44c4b2226a572a761719560919fa33
SHA1 0f3556d7105a21513b80159b03c893334244b917
SHA512 4d2baf5b5892fce85ec050b25a8f338c2bc4c58471cd817aa78cdf8b65f0a3792464e25e8634553e2cd078d60f9caabd21dab838be4effbe2b6918420e345a01
SSDEEP 12288:f9tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:f96mctvE/BT76+1NCE
TLSH
T16AC42382981B01D4E9DF06F15395E29AE8502FFE74DB1481E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 add48ff4921f06d58bdc8425afed5fbec12fcf97343e02bad417bde87ed1b7ac
MD5 8128708a38071a31f7d254b9ab427574
SHA1 42d6faa6db888c826e3380b95d4a9ad35152e960
SHA512 e8177e1bfa1088b52120f7d7af9dbb419c6ca94dc87a6088853d98a9b5619d9c88a63babc2dcbd6941473ac6b141ef1e2ed0508008d4ebc940fe689d93f1f7bb
SSDEEP 12288:IyPz5L8stM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Jzys6mctvE/BT76+1NCE
TLSH
T18BF40143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 758cac4abf17c0b6aeb77ff043b45363beca0f04e2154c52e085af99b1964b8f
MD5 60b5737db8aaee37f3649b0ff5c03cd2
SHA1 41a74eb2a23671596a26dfd2cd901c0b725a3699
SHA512 756f6ece6bb0a75fd44b06811c5f2f401a88ad41d13bcc666a019d1fd7a71a7fa93838c3e9158cd92b2a3121ca1f256b15a12b8cdb060a3f87e77dcb52574b6c
SSDEEP 12288:9BtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:9B6mctvE/BT76+1NCE
TLSH
T1BEC42382981B01D4E9DF07F19355E29AE8502EFE74DB1881E316851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 11155a39029c22a8ddcc1212cb097c3493b03b0e715defaed35e2c96214619f4
MD5 2be35e72b276a2362a023a0f3d020831
SHA1 f59f4384578dda10654e58e641a434e80ec1c6b7
SHA512 734173edea667e2404ced78b80b27d4cff38676eb2955d62f632b77f354323c4797d7be1f4852cfcbf23aa2c9979b5e75b367f18b59920b1bae739f057f44151
SSDEEP 12288:XBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:XB6mctvE/BT76+1NCE
TLSH
T1E3C42382981B01D4E9DF07F19355E29AE8502EFE74DB1881E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 87564dbdebec2c70a1fe588ef33fbab9585197763e72c1c246526203048d045a
MD5 992b082b9f6ce040f06693f71cd03509
SHA1 34e0709a0db5ab78ffa3c2e9fe58b4b7579a1d92
SHA512 97ba5e86ae14087546748596d099fcfd519a5afd0b135d8df8adbfc3b020cec25528e93426f97e5d196a1151edd4fbc22cb351384843ebd077345dc39cbf1b15
SSDEEP 12288:IyPz5L8stM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Jzys6mctvE/BT76+1NCE
TLSH
T1F0F40143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a3e95ca265ebdf10846d2c4825f651b7a8ced8256e96e73623b18b1d8fd32e8d
MD5 df76bd8a36ad9984f635f58284946dd1
SHA1 9f77dab45eb7b6af1b990f191843cd3a28ae43c9
SHA512 9606bd91ddff9a8fae98cfc515e5b3a89c81313fc68d7be0f436e668a8ad6f716fcd773f160a4821ceb07516ca4289ee02efac97237ba6342bb0bc4ba420c7b4
SSDEEP 12288:zCd9MWYoaLHF3z0z04PDvhutM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:+T9aLl3z0zDu6mctvE/BT76+1NCE
TLSH
T1A8050295B35118F8EC67427EC9558506D6B27CAA1770C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e9714a3048fefea67ad0969fade3559c61744a14ce8303e8a63b9a97a7b9f43e
MD5 8c1c1b3f0c7d54580ba69babce39d609
SHA1 66ed5f71b018da8d8704164833174b9d734fdf2e
SHA512 a170d11759dfdf54631654e9535ac3d26d2941c2747bca8e9ea454f044a1ecc3957b7f8f2d3124a26c1455533b690803ccf1526b4f2a7dea06bf2cad7dec0228
SSDEEP 12288:3i4e7oRdTfgwCHKy7GLbbdIvvtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:33td9CHKy7GZS6mctvE/BT76+1NCE
TLSH
T10325CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 bd44c8f714746e80b08244b1faf94e25f20107dd4d21960abdd5716409abe735
MD5 a17ae263ba1f78873404ec6751e8ae42
SHA1 7406692199d0960e428dc958a9b74c3557dd6d2a
SHA512 d04788c7ecb2b5390d9192fef69e12eb2e028d64f1c1de97d02f4a8360f26cf5ffcd2d999e39f1571e67638be068c3508f0e9f055b3c55667d3b60b0e49c8a6f
SSDEEP 12288:p+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:p+6mctvE/BT76+1NCE
TLSH
T13DC42381981B01C5E9DF07F19355E29AE8502EFE74DB1881E326841FAE705A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b2280ab2dabe0ddfa3aaaa66150eb4cc2d7c7170c9fa7a24628a29153e7bd3e7
MD5 6e7c7033d6f764a275879aaa8325ffbe
SHA1 dbf6bc5fa6877c15ce3f61b6a9d0820faaaac7b1
SHA512 9d48b7d8585dae3a699659e63782c4914dbd473c89325cae096c91d44ee318482ad21b3b0fb7ce9cb51bffcd59d284af97d27d62de07b04c2cb12d7c28e7639c
SSDEEP 12288:MMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:MM6mctvE/BT76+1NCE
TLSH
T1AAC42381981B01D5E9EF07F15395E29AE8502FFE74DB1881F326841FAE305627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c121ed5617173605649ec6a34f639ff107784bd404a37c39d8e621b9083c9837
MD5 f9817cf20f20af303a13957c79c67133
SHA1 92f1fd81db545c7deeb6aa47baf99f9a5070a7f1
SHA512 ffb95de0c5df483286dbd21aaf161c35af1fd73cd5b230520a72ed180a83ea81282bda7a6a0fcf87d8ec4767120635117f4074443c3fb1aca8dcd312651b9469
SSDEEP 12288:avtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:av6mctvE/BT76+1NCE
TLSH
T16FC42381981B01D4E9DF07F19355E29AE8502EFE74DB1881E326851FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bb87049dd2e1ffaaace8659d5e2f919dbf5ef842d6231b7577ff7cf06024912b
MD5 19739a61f1c3c7d5f6f4504f9d71272c
SHA1 85bc70009736aa288f9bafab99617e30537c31e8
SHA512 d44fafa4c64515fcd064104da8e730b32b7ea072886ab58a7238ecdabd49e9465aeaf59ce1ebcdedd90832507e882e65125266909a34016298df45caff08c26a
SSDEEP 12288:WBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:WB6mctvE/BT76+1NCE
TLSH
T163C42382981B01D4E9DF07F19355E29AE8502EFE74DB1881E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 853a9d2b61d421a45b5ba45c1d5928b64e6a1d66dfab017a10a10530ab92999d
MD5 bcff031b1591c0d7bc7d127f3f58f5b2
SHA1 8fcd52ddfcbb121a0982569a847f5abc2f4e07dc
SHA512 cacfa488ffd444045b346695ec34c99985cf1310e2a31aefac4f89b23730558cda56b8f821e1b9daa2d3d1ee44bdb9f37303f61ef07a1150433bd7855dc63423
SSDEEP 12288:k+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:k+6mctvE/BT76+1NCE
TLSH
T131C42381981B01D5E9DF07F19355E29AE8502EFE74DB1881E326841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 79ba7098a39dcd30ac7f86861e0f3a9fbccd0c81c18c8653a8d7a87d2d5e4bc6
MD5 ceba229c9680b69863641d122dca1952
SHA1 cc407ade3de54680ba0d3c2e8eba3c53ace6aa5f
SHA512 e894cf8285e6fc3736367baa46df10d5221087b1536956e4130ea9756e75fd56d507cdab57568da957d76149fb9b1e0d9ed13f11df8d4c1f865be70ccd5ef46e
SSDEEP 12288:S5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:S56mctvE/BT76+1NCE
TLSH
T1E4C42381981B01D4E9DF07F19395E296E8502FFE74DB1881E326851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 033ef7328ab66da5bf1c0af766bb931dfa54e6be862cddcf27ad64afdb34aaf9
MD5 f2885c70508aed063b523ca74c65a2d8
SHA1 d65e1393a6c2991c7b9f8904877037b9d1fe87c4
SHA512 4a3ddd55cc45ca19af421e26a94cbef264c08676a80a6be5801d44c1ba279daafbb645f86044f1b3dd5275aece4393e9221a88a878922e2734172943bda16738
SSDEEP 12288:q7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:q76mctvE/BT76+1NCE
TLSH
T146C42381981B01D4E9DF07F19355E29AE8502EFE74DB1881E316841FAE305A27D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 183f828893e9dd3e0b318a801e62f139c1e8d127900e9430c894764b9d3da28d
MD5 881309ebd9642ba59afdebc07fa39cd7
SHA1 b731e470fe506232aa055048cadd1e9b987fc4ed
SHA512 329ba65d2c4dbcd58ed69b299d8f1b5e4eeb1f724d52cb009c95f403799b5428e1825da61b9959e0aa92ac1cac31daeb08bde67e756875a7586bfc06357ad213
SSDEEP 24576:lfwvok9RX6wkyAIt6mctvE/BT76+1NCE:rMnYIt6mGvKVO+n1
TLSH
T15635D029EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 017a65b498cf08ddb775c381b59731b4adfd3b0bf97b6c73cdaf48b1b03537e5
MD5 85cfa25609f4060e84d1f560465ef8ee
SHA1 58cca084600d10e9f378694ae10e205b3ae88621
SHA512 4c2cc74a6bf567f417fff9ea29ae6848ba4481fd4318cd6106efa954c0ef5980ca10b04d0ac5b69864985da0e5b23b73c1dce9d0a7c0db4086a2f11e400c20de
SSDEEP 49152:2YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0q6mGvKVO+n1:yySzPSXeN+1
TLSH
T103067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 16706fa7072fae45546dc6fb84702b6345b5b8aa2d0d36fe8a705cdfe7f9c03a
MD5 93d8cc3e00831487e76deb8d019c5f45
SHA1 b8148a70785ac8b5b37ed4a86c2c99431a80fc0c
SHA512 32ac6734df9e3834d658c17be022722eec666bbfecd9d800b1b367521fc78a6ff930f81635b8ddfb1c9c220fd631115bb05a61a9df0725c3f0a234502b7d1a1f
SSDEEP 24576:R47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYQ6mctvE/BT76+1NCE:R47JUQj4irIhCnDHUPfF/a6mGvKVO+n1
TLSH
T15065AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7d891cdaab2eb41992d3dc44058662d0cb56ebdd7e3150981903577d36670ae5
MD5 82b74b26a514a825dafbe15ef5fa10b2
SHA1 88223ab88bc4736b4dc641f8a3990536571d7697
SHA512 5a6c26c8d983461b9639b86a1f8927ec46dab2a580a6167e917d4fff2229abf84abf244cc98677038a44fb56f5d9825ccb507f9b4260c71088ce15f4c5b71416
SSDEEP 12288:LGsfRtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:RR6mctvE/BT76+1NCE
TLSH
T1DBE4F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB53D0F53E1F32690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b81684a5bb6e041aa9bc950b00b52e4740e65b70f07a61c38fee444ee517f9d0
MD5 85e6874d88d1a35d8c458e35f3780b11
SHA1 3324b0c2c0618d111e9d5765ceb0cfb5110b07eb
SHA512 946ab3dc4dce610bf7949ae0b7c3bc5ca7c2fee4e8b35edee664dc050b49ccd00d71fdc9d81dbe90f4fc217758fc5740717fc50a820a294732119dafdec5ee4d
SSDEEP 12288:EkSshvvHU3fQiCOk+RGOnEEswnwfbHgSQORUNWqiOcyB+NzeF:EkvhvvUPX/Ar9QcUNTiFyB+NzeF
TLSH
T19D452841762AC75FC6A950325E36D6CCA7707C05EE48AF0373C9873FD476668BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 10464a48b067db8357acd0e22b6efddedc6fc9697d282220f8c2d0d66d1bf40d
MD5 bf9aade0d8c51cb127accf5ac036af9e
SHA1 f2304582730f6a78e646a906f8beff41602046b5
SHA512 b4cf9631aa0deacf3e91851ba4c2e20ec46891eac0d702e504f6b4e6a141b0000512677ea3b7071da6320b6eedcbc5b3a001cfeb1146572120832256109f66ba
SSDEEP 12288:GvQnMT+hQ1Us9rVwUTZgJBt9l4c4NqLz11c4oYjopZtmAhrJwlSjcsoLa:GvQSt9rVnZgJBpb+6ZrBm7oLa
TLSH
T175451941A5B7E31FC9BE50370732868DBB749C06B7892F057344893C9867A7EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8b6e0a475962a18b89bc1cd271457949e77fd2cfa674d16a8482adec4ffd7e6c
MD5 e0c7ad5c68fda52d97538ace32ed0f7c
SHA1 0e330f3eefde71715a2117dd5298b6b3f6a4dea0
SHA512 5bc8a9952302fcdc498d283249cef81c11727442b051076205b38e9e7d437e4a8a854353b2d4d5fcf6a56eb9e127c69e0c8d35a84f693c51b5f9c451f6cde289
SSDEEP 12288:WM7JtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:TJ6mctvE/BT76+1NCE
TLSH
T154D42382991F0184E9FF07F0529AD265E4157EF93B9A08C3F212851FAD305D1AD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ce19c3c1698798be588b57a46310fd0ed19d1af9b0c157ef5eb6ca6ce7fb2e57
MD5 6c46f5b30f2ff55dab595e1bb348281b
SHA1 9c2b8e49c9d4eadbb07c5489ae4c1c43e93ba3a2
SHA512 28a9ea7228c187d8508f846b7df67100bda08aa1341edee0de5052fcc580e4724c60e3c27b83145577902d78ce17ea315428688ebd24fef3c57a93a5745820b0
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYX6mctvE/BT76+1NCE:5gb4mBIBhGFQ6mGvKVO+n1
TLSH
T151659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 13079de4f6e5f9a9ef89efb3a930add6a1b25f228efb7885d2a9b9fcc1472f63
MD5 8ef946eee00774a4eb7bd198c8aa374d
SHA1 0ea1c26ac051cf3d4c6b8550dd6a0323a5384bca
SHA512 69bc6434fd1b2741b7276aa1a5399c5ffc8f4ee621646935f912ca22650bf458d34d89a582f54c101a7641fe91ed943993a7f6ccdafe0472419d3ca85786d840
SSDEEP 24576:RG88u8FpJqH1Wzria7/mg6mctvE/BT76+1NCE:07ZFPqVha7/P6mGvKVO+n1
TLSH
T19C35F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ff58535124bec50291acf9a8cf26d3ce3e43cfa545385575e780ee7482af6cbc
MD5 a3689192648c80032dd8d562dafad44c
SHA1 54e495863b2d5a69ce89571d7dbf3a152dfae99f
SHA512 007a3e495672355d6a5b96f5d50b841174621acd8b5d90135f80bc1594d3acf81f54c16ab5a8d87cb4e03376a0d3c46c23a26e98c2532401ce3bdaed1d928216
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjk6mGvKVO+n1:xG05lO43blXeN+1
TLSH
T168D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 70f99a06586f22a04e65044eb40d975666c8758dc6477e28eb6d513bea823465
MD5 a346653c552927490ec00a80541b9698
SHA1 692403420dbab0e79f74a15e127671dfc1da3c50
SHA512 ac850d4c4317727a3883723ca28bd34928a56ca1900fb4ae0ab06fd1ec60b50e30736f5c05923c1088e1710b9f64445fa098dab578726bd816b63de6ca8652d9
SSDEEP 24576:ofa5POZ3dpqWVM50JicR2hG0lasx2+47eidnq6mctvE/BT76+1NCE:Qa5POZ39Jt2pasx2+mM6mGvKVO+n1
TLSH
T16A65BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f15a564c2c822c82b4997e8099f2a92fb7c6357288b4887ce06387bd85d4a438
MD5 17c360e21e6a1b157799351d4e264ef8
SHA1 c7e5305c22cf48b2632e21d78076d95b31649f59
SHA512 090ff2f9ffe45240de077b6c4041d4743e1ee3af068f31245e77a4f5b0851b40ccca68e2b287f71334d091dd334d1bb133c2d3fc7b7a6f81374bada942af9715
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkI6mctvE/BT76+1NCE:ANc/zEOVHFv6mGvKVO+n1
TLSH
T194858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cc0155a9b1b332b033c5b3463edb63d4b3af0bb03ef5ac57695c1f095bd5111d
MD5 5e4cb11b260347ceea326819b2bc08f8
SHA1 6ad3e32ee66936f1b0f98ef7a421a577830e5ccf
SHA512 dd6170eb022030470b33c05af224a0c4903a3bb9716d43fb9014a95cc872d5bec58b1b0cfcd1592cde2950d46c07b2aa374857f447b45df16f58c4400f8bf36b
SSDEEP 24576:ntkNvNnaFeYhJNtmZBm66mctvE/BT76+1NCE:ntMwBtOm66mGvKVO+n1
TLSH
T1E555AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 96dda586526aa80e36bc52637d107c2e42e83ede154a07e4f3b46d053bd11e73
MD5 153b8be0cd4fa4577539fa2dacf0489c
SHA1 85bcac576bc53d8eb8d49415e5d76818cf043160
SHA512 4d28ee800e5974abbfd558bdcc6fbf9e3379ce2f33e942b9d0f82b467e9ef5f2751fd044117cc97e38b08685712350549f71ceb2167423d2d440a6403abc564f
SSDEEP 12288:1HvUrBFrEjwaQUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:1PUr+NQU6mctvE/BT76+1NCE
TLSH
T13305F21F65AD18E4E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f6a1919138f6a9525b16c29e32b4b20003ef3826e23d78d93ba659e40df9c35e
MD5 02e4f09eb77011ebd36c9bc859df959e
SHA1 52a255a8ad9b42f1b2e62f57ad22c2d49a7d59f9
SHA512 026cd0721727ff6b7b8b50bceb5a7a778dade1bdc5bb1cab2abe618c6b78a9d8ad110c5ed4c29124d6be22d49ac0c3262ae0fe22cbbb9ce2cb64e0254d59a486
SSDEEP 12288:WQcMxWDXN1Dp/fshBItT1IQgAVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:sD3FHshBIYQgAV6mctvE/BT76+1NCE
TLSH
T1A025E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB029481BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2388-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2388-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2388-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2928-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2928-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2928-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2928-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2928-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2960-78-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2960-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2960-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2960-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3048-7-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/3048-2-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/3048-66-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3048-6-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/3048-0-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3472-409-0x000001B6FE260000-0x000001B6FE30E000-memory.dmp

Download

memory/3472-321-0x000001B6FE260000-0x000001B6FE30E000-memory.dmp

Download

memory/3716-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3716-335-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3716-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4108-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4108-38-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4108-45-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4108-44-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4108-48-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4108-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4220-118-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4220-126-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4220-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4220-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4408-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4408-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4408-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4516-410-0x0000023F43FD0000-0x0000023F4407E000-memory.dmp

Download

memory/4724-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4724-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4724-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4724-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4724-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5284-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5284-56-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5284-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5284-280-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5624-89-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5624-83-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5624-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5624-84-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5972-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-317-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5972-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-105-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5972-111-0x00000000006A0000-0x0000000000700000-memory.dmp

Download