08fe98cfa8d31324c26ce99115d63368fb03586f2ce2179712f40ffbfb99a3d7

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Size 2.6MB
Sample260804-jjbddaal2z
SHA256 08fe98cfa8d31324c26ce99115d63368fb03586f2ce2179712f40ffbfb99a3d7
MD5 3a22eb0b7e6f44f3a354b317564e91fa
SHA1 1916ab999f48bee037b08d51e694ebdd837a36b5
SHA512 5c2d400745a1c5ea625f299a39e7c16d0d7713efa04c018691213f8d567140233e23510a5bb87f2e493870e28b5318f87aff2b8336666128015a65d7c27def9e
SSDEEP 49152:g1sCl64SkVTSiPpyZlWVrXPmFldgIYTwJzWegc3/kK5p6n3Jb5+Pl6bJTIZ5jdgp:gWCo4SkVJRgWVrXPmFldgIYTwJzWegcS
TLSH
T110C59D12F950DAEEC1130E33BB5CF379F1AFBB610A3D418752949A393D260439929D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1100	elevation_service.exe
684	elevation_service.exe
3728	maintenanceservice.exe
4872	OSE.EXE
5284	PerceptionSimulationService.exe
2812	perfhost.exe
3280	ReFsDedupSvc.exe
1940	SensorDataService.exe
3960	ssh-agent.exe
3176	AgentService.exe
5304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee49098bd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bca2a8b6e423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7ed53f7e423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c00aeb5e423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f61623b6e423dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b9427f7e423dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe
684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6068	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeTakeOwnershipPrivilege	1100	elevation_service.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3176	AgentService.exe
Token: 33	5304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5304	SearchIndexer.exe
Token: SeDebugPrivilege	1100	elevation_service.exe
Token: SeDebugPrivilege	684	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6068	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
6068	2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 3016	5304	SearchIndexer.exe	100
PID 5304 wrote to memory of 2032	5304	SearchIndexer.exe	101
PID 5304 wrote to memory of 3368	5304	SearchIndexer.exe	102
PID 5304 wrote to memory of 4080	5304	SearchIndexer.exe	103
PID 5304 wrote to memory of 5132	5304	SearchIndexer.exe	105
PID 5304 wrote to memory of 5884	5304	SearchIndexer.exe	106
PID 5304 wrote to memory of 5744	5304	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3a22eb0b7e6f44f3a354b317564e91fa_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 412bba81988c689d00af0790bd14a46c30c3d9b52671705e2a1e83daa83f4333
MD5 d252228aef220c7b2c5e71b4dc29a235
SHA1 0d09e0aad5b910e336ab046423446e05125f3c1b
SHA512 e2d2994592f4474b35b24d282468d55cd60e6e09cec0acd2d39d378d9f24978a7d1ba2c5d7aea60cf4be0aeef7279f5675c401294ea8a17c0f445633a45267c8
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzb5+Pl6bJTIZ5jdgp:C3q6mjB6slgJTIZ5Bgp
TLSH
T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 477a283ae755220d727af2df1927c6da1635b379b9b4d4d72555c4e0da7aa80c
MD5 186b51d690f7e672b0641d8e026f74b2
SHA1 2dc02a6b2b9497e9d1f9b73f8df9392a13f37e0d
SHA512 2def655b4297e2575e35fd6c5c378d252859ba51248417fcda948d42be0b0ab22cc6435fba477bc9e09cb636fa34d211f57f74f0897fc45da073c1fe4d0138f6
SSDEEP 24576:nXYfDtczA9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ytcJb5+Pl6bJTIZ5jdgp
TLSH
T14285F11967E504F9EC67823DC8E1C611EA73B85587A0E79B03B499265F333C86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 6db8e91065ee958b2b28c2afc626c2060b29a8b6f8afc0c00705e8f95eec3eb2
MD5 0c9dd72908b3c4ca5636e7262ab6df36
SHA1 5818f2738d76de3a99c4f1d71d8bf5f3d4dbf032
SHA512 ab0fc8426792b3586335ace07c0c5d98a3a501a866fcc3cf8a7124c0463307e6ede486c8a88ca871190737ee0bed6c05fc2f0e2921f54cc704e6bf24bff22a65
SSDEEP 24576:r0Le5ji0hmxyrMsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rPji0AISb5+Pl6bJTIZ5jdgp
TLSH
T17395AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 88f0dd92a963f4c348797fff0ab2491747f47c2aad1dcc1a2eb58ad106902d77
MD5 ad9e6a7e3438f4cc43fb15e68e980f6c
SHA1 197b17f111e249a94d486dc6e877cdf5053d8c19
SHA512 92a1aa054a674d37ebafc7aff64156de49e034a8478ae013a628896bd55fdc7df52ee3282361ea58f37cb2bd9702633ca416c7ac97b3aa9533872d05c787a9f8
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyuWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3/ezSC6vUzPv+Hjy2b5+Pl6bJTIZ5jdw
TLSH
T11E756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 63bffe6daa7d846832e2cc691a6c6cb50293e055cdc36c1abb298d9503edd43c
MD5 b3a7c052771bc5de2b64d20213e3371d
SHA1 dd6c4749643415ed754c1883f05ff7ee1a939f3f
SHA512 12cc813d1f7cb55f053d0389767a79ee66b7651ac1c4c637294cb3b61ba7397423f0ea75b94f14f08982f5bc86221d65912714879a870e98b33e6fca950714f7
SSDEEP 24576:DVbqPb88hv/l+Bxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:DVO88hXl+yb5+Pl6bJTIZ5jdgp
TLSH
T197559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6613d3379a717a949020421e58500ff80b6af1081d738e342cf6a2b93859b299
MD5 f79673b8201f5522384e146a09655ab2
SHA1 e913cde2c2f3401a4173ded3abc270b4e89ef49d
SHA512 84585481231a399b3d5e05fb2f3b405477cccc356fadcb2336d0f58b4d9615cc1e68f987900c9badf012eb0c4e670ecf5d70ec516d6f22555b05ef1dfbb8af99
SSDEEP 24576:vFwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Bb5+Pl6bJTIZ5jdgp
TLSH
T1A66523838B6970C5E5AB1739E9CCDF00F87AEF55CD866B76C5752C2BE034249B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a6532e41d843c0d621d1ddccdd4c59706f533a4b3c34dec9d669ec3269d238b0
MD5 db904369c5f718c025499d23681b3b30
SHA1 9abd28f8902c6a5f5f90fb23d246f37669e61ab0
SHA512 f694b69810bfa596a645074485b97141c4e76e00ab31c32b0fa8bde99316d8cf07ac9becb756139c777239c400ff67e7172c34552c35fa7258990063318b2d54
SSDEEP 24576:YJIU5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:YJIU0b5+Pl6bJTIZ5jdgp
TLSH
T10385CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b87a6688f49725ef331f8c253528de8a6e78e21c4e6cb3e166ba832aef19eab0
MD5 d9d69d8336062df8af1a7e25d0fab534
SHA1 0b12ba24f11fc45b8cdc1834d14c9555ce3d96d7
SHA512 b95598c157bad54ba72cc309080d748c62be5ff1b1556c8c9bfd9e760fb9d151fc847f98074b3f6bfeed8ee69add82831419c3cd377c36c6dd379f0599474f1f
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:hQvGAdlCEL8c/WRNw5C1slgJTIZ5Bgp
TLSH
T196266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0e8cf8765463127665f9cd809215414b5d37cc7a58ef8bf6dfb9aab50047be51
MD5 6fc3b9e523398df991719879384fb9cb
SHA1 055d69ac36faca57865058ee1c7ba2d40adcc2b9
SHA512 11466320093f5d8054f8c1b7595ebca2c2c6851852396a22d549ce2d68051e051f57cc7e6cb9472863c5417c40f7de751fdf6d6209ec88cc77861c96b0e5cdda
SSDEEP 24576:VOewsAjrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:wljib5+Pl6bJTIZ5jdgp
TLSH
T14785E031FE74E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 337b0afcd02e8ae50dafa391045e587e9df01ec5d163afe00eb7796935035740
MD5 8b9d4701692aeea471eca671474e5d2e
SHA1 c73a6eb669efa65174a554316f6f63e289226d1a
SHA512 0ad6f3962467e2de7515af0973fbc7a7d7d3363937d08704c76119a58d277f5771d69976be7aeb75515a9836861ede8d461672da4b8c909481f31072113d9971
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHwsT6p:kUEtQevvqc2W1cpV20I32ws
TLSH
T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 544a153908284b93873438dc752a743a9e963822ad5b3d7679ca7e462436222c
MD5 ca2bd1d3252ce6bcb584a4cb640a1a05
SHA1 bd74332352434b1dfd2900f09b7bba12db95147b
SHA512 ae06da6ec61ee2efc8b7eb2e3bd416fa01fbb3f94700885043d570477c6e865dee9f2a5fe748ca1c38fc305c74b77504471989fbfb6428b214aa15f877fd7620
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zCb5+Pl6bJTIZ5jdgp:ZoqtVjnmpslgJTIZ5Bgp
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0ef7bba283a0784b5211ef38f7d5af88af74c981f78e1387f309a0ce84500437
MD5 f9be176d3af011a290fc32aadd512bb1
SHA1 a58ea6a086c556e413fb65ecd5b9d2e388d148b7
SHA512 7a184ef9dd1a23f72081a92e7c2e0abbd915e5f6c730c49435cae6993bae3504d2799b60143ef482f20ab1d9fa6e4f9fffb13f4d8de3d87337b418c2bc96e0d6
SSDEEP 24576:FAhGL6IFoiwtA5l7S53Smb57GBiOl6a8JTth/RWZvR6wQQ92pN3:FAM5Foiq5Nb5+Pl6bJTIZ5jdgp
TLSH
T167359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6b142eb65fd5933de3b892946dca0127944548690957a40200ed32f3f70d8e2a
MD5 480b6bb28b211f742852b504755f227c
SHA1 01f0db9e9ef2f818454cbf2a12d32d6f39bb5123
SHA512 511b27d9ce60396af51ddc84587ecb2fda168e0f3f0282c147d5571af6285e343a616e4ccdeadedbf44fc82bd0183940b2a8e769db6d72f1be7b44130fabdcd2
SSDEEP 24576:lwuGOWXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lwNOBb5+Pl6bJTIZ5jdgp
TLSH
T16E75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1f1685cfa65c87790ad487c1385316b52747a3a0a2e56387d87c18b684069a32
MD5 3b0ea596787cc8682e18cf3ce86f22cc
SHA1 06625be7b6e2230648ec4791865cfe528bc1708f
SHA512 89454f120198a90dea449baa8ac542fe37fafe4ef99b80ac0e064353cdc9865a5e92478eda3ed01ff9d2716babf822f2c12420281ca74ef17dab3c360693b383
SSDEEP 24576:NZu0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T17A65128627A830F9E1A7523DCCE48B00E772B8529B7653DF4674456AAF33BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01129ec333163d847cd786202a33146e607cebdd80fd03e6eaeca3396f7a547b
MD5 b928f6ff44456feaabdf2a94f5cb5ef1
SHA1 806d411efdf8e9a6583d242fff3c981da598adb7
SHA512 fa51a6e9d5a8bb603ed4e7948823c18ba124fdc1fa5effefc6b8447ea74e3e3b21ef550bf46b8939ad12d65c5c9464ef46caeec4d065089b166f096e5f293109
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN3mslgJTIZ5Bgp:yQyiKanX+PN2sT6p
TLSH
T1B7666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 72f886dd5157258534fa08b6254c73eb01370573ea28ec26b85c4fa05ebab633
MD5 52e3940139318de7e23070ae4ae73605
SHA1 d8817026aa06db553e2a6957ce2bfb79b54667fe
SHA512 a3ca13cac94eff46210711afc74e7e427b0b0c80ce155aeccd5a58544efca7691607a7f1f7e832b02d1a3a57f9cd2b1c9ede66f7c472f9fc74f189766007ae4d
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3mslgJTIZ5Bgp:vQyiKanX+PN2sT6p
TLSH
T1DC666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 002a83bca351746d4197bf613de2c110c0621f385d6475aff5de0751e7f2c9c6
MD5 a32ac4b8fe65845fc8b9ac458bca1622
SHA1 5460d707f7edbbb750e64c5015f58275addaeb1d
SHA512 accf48477e7017abcdae687d743e9b122c5139baec46700f08c06000eb14883d797a092d0f4bd644431fa4b1e27e150f80ef00ffd132f26895d560cb2151254d
SSDEEP 49152:r68Qg55nhkeWu7PNU3/Sb5+Pl6bJTIZ5jdgp:1thTRc/4slgJTIZ5Bgp
TLSH
T19BB55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 96e7d367d5fac188fabb9b5509c656e3d7fa943d5b74b74f32e19ef57f569b3c
MD5 178a0e28843f73383968955b81e710de
SHA1 2b2554e56484002fe09bc641b3c0b3bcb5de8d38
SHA512 17ccf87b2693e72ee18386c611e32d689e3d09d92cb1ddc14a928abbba9ed13ed06918ada38dc25b9449a24abc6f3fb7c764fda3a8fed7be9d3d6f6fa0742a75
SSDEEP 98304:Uy5112gYy5azzVvU69nLKnhZbslgJTIZ5Bgp:VLIHRWhxsT6p
TLSH
T116167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9640d62b7ecb311e59f7c471cf3ab3e4c30d0b6680ea4e98f9975fd30b730fb2
MD5 76431c7eea6cd262a9470ec8e125fe9b
SHA1 6b1b472737c7aadf3525db44b651b05c6751bd4f
SHA512 b9a3b68e355f709c0d52e0432f58907ef0fdfc3c04d7d9368396371604d3719bb751b7eedb394c14bfd82b9186a2b0fe14bfc4a0772290ed0101403bdd9ac9ff
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glKb5+Pl6bJTIZ5jdgpr:ou6JmIxd2dAslgJTIZ5Bgp
TLSH
T174D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6998fb2d83e0f5178e6198e881dff6331c1822e52f4d6e9d506d9d5b3bf42ca
MD5 c556b36f3c4756400658afa50ab0634b
SHA1 7dcb6bd26073c571f2d84a39e5d05b88f37267da
SHA512 85a862eb419ce38deadb5f79d8cb00c74378c40785f52a937850f50c7617e517c3895d8d18ee53752526e3d0a74aafac9e84882f26ebc37e1ea8330fdaed41db
SSDEEP 49152:K1hpsNoJpF1A67U44CwH7R4xUb5+Pl6bJTIZ5jdgp:KmifPqRpslgJTIZ5Bgp
TLSH
T1A4B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3de36b176cb321c08b34d1b9c528189b32acca039d08afba157e607ef3913e7e
MD5 1853f6d08be553623d4405e663057918
SHA1 982a468ac355dc5aefb318c33ce99e16313a2b05
SHA512 55797daf9264695469152dfe792430e739716550673e801831d8f49f114add292c549a7e0e21c66f737d3ed2b41891e10a1ac54583d4094664f82e160cce7f8f
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqDb5+Pl6bJTIZ5jdgp:O5dKqi61nslgJTIZ5Bgp
TLSH
T15BC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 18e2ae2146349bb21facae3c16507b77a20d4c0c963790102d1fc002d66d5dd1
MD5 25d70fdb23b254602b59982bd4bc7200
SHA1 48ce98f29a9247fce393a49a3fcbfbd1a3e97b18
SHA512 52b557121d553df659c406ee23ecd5112b51a6052eebbf30b0baa3e57dd089bf6d7d70e20fa506d51a8e84b2d8d8cca49f3e5ef479491d8be3a20a5a4bd78341
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wAb5+Pl6bJTIZ5jdgp:DX2iWph9slgJTIZ5Bgp
TLSH
T13C95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 31ebe4891a729247117db9301cea4fe48a5f0a1352c990ead43277910cfe0a66
MD5 30b126d813047d0197f552901c16217f
SHA1 601475d48d8dcfd86bd1a3a8a868171c1f972c46
SHA512 18b7d4edde96752139be7abc535eaf6e94eeb12e1bf5cd11d38ad43bb60119df68f07ff257c279aef609ab94bfb806131637ea239e450cab6be18ca976f19f97
SSDEEP 24576:sYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
TLSH
T199652343496B60CAE45B5739D9C8DB00F87EAF96DE8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 58aedda151817701a5848793c6b83e2e480d5014b6a2ac91c84302e1b57250f3
MD5 58dc2bf41a644c700e1438fe4482b9ea
SHA1 2621df6884cd57c3c648b72b5ff8b5e0c89f798f
SHA512 ce4fad821533ec81993ef18c1e89586b405c09927ce613404d45b3fd4604af99cab8383627577085655a885c73710d2bc1389d0391cf8c036c6eb6c10658892e
SSDEEP 24576:8vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fb5+Pl6bJTIZ5jdgp
TLSH
T1126523834D6B20CAE45B5739D9C8DB00F879AF57EE8727B6C67D0827F131789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 473e26a379ca33235fa62bb25e7ca4b8dcb309b11f69a18f37e6d4f89dc3a2d3
MD5 5f01063e5ac73ac983b1d86f529034ba
SHA1 557a10dd112ede00aabaf5799849794532abb2c3
SHA512 739e69042581bc6b2c8cf5ebb1bee5a61f9326bd05d300230f45b0dee4d1acd103239fdfa7e67d903491ed18d6553c812c3715fb91520e85f624091d82dc8706
SSDEEP 24576:nhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
TLSH
T1736523424D6B20CAE45B5739D9C8DB00F879AF97EE8727B6C67D0827F131789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c37b00ec4fd9dd8e0efb12ca0712637a657762153345d95ba41ebebdd05525cb
MD5 f7bbaed1ee2bdaea6eda503fe88f67a1
SHA1 0644bcfd571104012c48f56858d66acd45a0dc13
SHA512 06496edd7bef7791f9ffbe2940bba5bda1be60ce5fdb8e432b12165ec872bb69557da36579a3f6a61bdd13fdbecdd34a735be2eee988a75be2f57dffcb582fca
SSDEEP 24576:3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2b5+Pl6bJTIZ5jdgp
TLSH
T14D6523424B6A20C5E4A79339C9D5D700F4BABE95DF5667FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 442e4225e0a45de2159fb67c36af2caf40ce43e7b3354f9a0decef2eee4e8116
MD5 dfea3146f945d92fd6faab0169e91e2c
SHA1 a823b4e471f880d8eb40943a02e31e6a67585984
SHA512 54b716499e6e2aa97bbaf6c50522cf8532f593670196d57f54cfc34856e589c5d85cff7b5de0be814ef25a4c636b7d619bb4bf7da8f583502da20e4015b26e33
SSDEEP 24576:LKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Zb5+Pl6bJTIZ5jdgp
TLSH
T16E6523428D6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D1827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0b190a2b26c5c5ba94a29ba7c96946be76290db46054f1f0bd6827f963a6da7d
MD5 c903ebe52098e31fd71e6a0bf0ac694a
SHA1 6ff8f3226ff0444cfb012275fc04e7e374a45c0f
SHA512 e77a13b1d55257109bfe6a684920d808c2bb0427848ea1636e9d84769f552618eda22e770962e03ae040e43f2d79e650460d54de7085aa9b4e986433e7ea6643
SSDEEP 24576:1Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
TLSH
T167652346496B20CAE45B5739D9C8DB00F879AF97EE8727B6C67D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5f462b6067629153062c73fd40c4ef7d7d1efaad42bc734e596d14eeda6c00e3
MD5 24fd9a5c971c3e6d5c0cdbcba370b87f
SHA1 d48f2d50f37fc35ba97fb1ee7883d7712084946f
SHA512 a64aac1ce7f5048ccce0b9c251dc97b6e09c03536b776b64fea9a431d440bdaca5fc1b38d877d527ac1fd3e87170b9410b99246494fe166a5f565f0b815d5d81
SSDEEP 24576:THmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ib5+Pl6bJTIZ5jdgp
TLSH
T1876523478D6B20CAE45B5739D9C8DB00F87EAF97DD8627B6C67D4827F231349381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 fe1a9b90e1a0e149d4787325cac61f0a8dc53a4c72d444fe7868133993ffe002
MD5 69780116805601212f145213a974e48a
SHA1 9185c19976fe699f81e57e8d34844fc7fa84d3f3
SHA512 f28331f6e0afc04c101f303db43a08bffa6dd198e2337e23bd703b2d24c107fc4c09b62c10ad04389540cde836709ff869789b971e7b897418cb187e08f0e728
SSDEEP 24576:qZMazFVSOPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qZMazf6b5+Pl6bJTIZ5jdgp
TLSH
T1D885F195B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 45f3f4fc48e6309b30c768e373c15f99e88271850491445c713f5d2466982c83
MD5 be3f0e09c4302a3785349e0bccbbd4ff
SHA1 88b0f67357735d0e0ddc8daf9ff3163b7b6aaa2b
SHA512 cfc1ebe583085ec7496fc7385567d1333dc769f4e34823dd60f05763ac2994bb364c584005270bf66df106ac34e289113c662f7f89e433712681fdd33354b8fd
SSDEEP 24576:kEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Eb5+Pl6bJTIZ5jdgp
TLSH
T146652387496B20CAE45B5739D9C8DB00F87DAF97EE8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c48fc114acf0689fd9a90b8ccb7568db4228c4390e94cdf169c37a56e74eb7ad
MD5 2f3792f1927a2dcfccfdfccde39d88ed
SHA1 abf1a41c42b177ad3d82575f1b08c6981c1f0b8a
SHA512 b35aee1fa1f5a21bc1aa9ef724469e1bb9765e4f6688a8b07049d53297416fa1a4ec88fc578c00cd8dd2ce13ba31f6309e05cc0c136bef0c8ec703984a921aa0
SSDEEP 24576:eAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Cb5+Pl6bJTIZ5jdgp
TLSH
T1A9652387496B20CAE45B5739D9C8DB00F87DAF97ED8727B6C67D0827F131349385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 dab07f55feb2c87b313a3eaeb7ebe795e01b3d553fbaa62aa5e082b160c6f653
MD5 4e97e2825b8a7f31b06bd5a6b60dd5a5
SHA1 7fcb023b29114f88f726fd1df585bd5c6c24e086
SHA512 fa6133e3068ee3165bc6b023462946b669fb9d5b80f8d400a79ce46caa5bfd2f3e706b334477e9b032e3fa0d24588a7cdfb0a3d915a8a2955d7f2c9a22818c49
SSDEEP 24576:Azy7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ahb5+Pl6bJTIZ5jdgp
TLSH
T10E75024767A630F9D0679239C8D15B01F776B8328B619BAF47B4063B6E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0012d094bff46dbb6101207ba6f3ae8b12112c4df37b3f346694cc092e7082c2
MD5 9d954cb0c5c714e9a7c861c6177da205
SHA1 4725bbbb90579464d206bc20bdf9e2e53813e02d
SHA512 eec3a1608f45445ee688230ad2c17e42ead9397db9c094ada7418b6d3a54c7e56e484d60e2a50996c2f26de60780e32495b14f25d8a091f642b4e521f0a7a002
SSDEEP 24576:wEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ab5+Pl6bJTIZ5jdgp
TLSH
T1C1652387496B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 091e2b0d8063041a5db513723e2d0c8e3198186b5173c16061e16431109f9817
MD5 6d63362bb2b2cbc457f3876a97738e04
SHA1 a35ad275e15fa5b1e8c86b328d890330cf4323fe
SHA512 567bfeea8a5715a48c87450514a5893e1c238771583683ce772a27335ba3b109c8fab421a10b545cad02aad572f72d63d42e19a8d5bedf2c333cdce438dcea05
SSDEEP 24576:FEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tb5+Pl6bJTIZ5jdgp
TLSH
T1A86523874A6B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 4807eb7e371b073a292d180b3aa2321dd172c052e2015785f9c68702c4685510
MD5 5fc5d97368fcd291dc89853801679a9a
SHA1 e81dc95e6b48ff4b74eb5336853680cd72141245
SHA512 31545b945a8ec4a3239586412b705be079ea2f4b4f5dfe3a1cb59b693099864a3a0b2c0f99dcbe55ab36b9bd60ed0a153b0580057dc58844c375e2c7daf9028f
SSDEEP 24576:/zy7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:/hb5+Pl6bJTIZ5jdgp
TLSH
T1ED75024767A630F9D0679239C8D15B01F776B8328B619BAF47B4063B6E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 033e9304fc23df9d212c5743ca02e435e39c2c0b09ce903de0e6393686aa530a
MD5 485cf57da6973a05ce1494cfc7df8564
SHA1 46095388ca0090ecf466555a8a1d38416e2248f6
SHA512 1473d32c86803a19538fa1dd325f97699e544c85bb4e4e0d7d8e5191d493d106ce7dce4f420577a0b57ee561be9774a334ab6a420d17240cb8f0ad7f94d82644
SSDEEP 24576:bT/aLl3z0zDRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:bTiLljZb5+Pl6bJTIZ5jdgp
TLSH
T13985F195B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 769f9fbb23804db26fc6436df087b27321fa590bc4dcfec36b354d4e1ed6acf3
MD5 c8849a4defd4f3320bb97dcec18a1a1e
SHA1 d6b4b227d7cfcc5394bb0202867f3e6095a61b6a
SHA512 1917533cbafef52a59a7d2651e9efc628234cc4263a0f14696c29af7e9f846f848a184a8246f7e485239ff622e549ac8ef7853959eb61ba886b6128186fe35cb
SSDEEP 24576:E3Ud9CHKy7GZFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:OUd9CHKya6b5+Pl6bJTIZ5jdgp
TLSH
T1CF95CF90F3E410E8F0B79A35CDA68511DAB67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 91333034c8e95c3f21d2a1b2fedd4e9e48876d1e307da4b6eb68d4afa0735272
MD5 4900d43351a13c5e383be0d82005abc3
SHA1 783434745c3cc5d36023b035b8b64bb1c752a183
SHA512 1740c04c0f1d718702b47be39ec490a66391b01b1ea54568168b023e7f2931508d9adc527bb5745ecf8835d7e324a21a074bd81817c5940798a817a8efda70a4
SSDEEP 24576:IBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:xb5+Pl6bJTIZ5jdgp
TLSH
T1586523428D6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f2249c3299b86305a1cf377580682846323121cefafad3292cdb583ad704831f
MD5 84c96dd6e66bc0570200355cf7a7bff4
SHA1 d46d6ac280e1509ff9e8c12f4326b52306369e88
SHA512 327c113242e88fa85f69670be207d99216c52d3422ef2c18dd9b73aadd4c9f1d2d6d192ba8c68e7cef25f3d3cd331d75ee6d93ccea2e8bb283718eff777d1748
SSDEEP 24576:zbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2b5+Pl6bJTIZ5jdgp
TLSH
T10E6523824E6A20CAE45B5379D9C8DB00F87DAF56DD8727B6C67D0827F235349381220F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 778620debdf20d2388a5e84c3726413c6a4c438ac934fdfa4709226e8ca0ee6a
MD5 ef8309c49dddf943f9ba6d5308944b9a
SHA1 5f7a70a10a047c6f1a278b2893ad82fb4be18b50
SHA512 7f36a1d6d4c56c5d4988e4952d51772f5aa703916691c441ed26f1e36f07a857249e6ca019d20e47f1c2b6691e256664ffed905234a4e06e466084531712e332
SSDEEP 24576:/Omb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pb5+Pl6bJTIZ5jdgp
TLSH
T15F652387496B20CAE45B5739D9C8DB00F879AF97ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 aa51fd5eb532981882bc053494f8f0ca31c44808012cf27313c8d549d5f76757
MD5 c1872263c0b4f98089333e12674dd024
SHA1 1c1b348919cd89251f24c9c415830aa0357df14f
SHA512 0fb706fbeb005fc5eab2b68c8b12f1851fee13e463b431b3194e1747094dfc08eb81f18535d1c1834f2e88519664e054a295c87d5d330210d347fcbbe68a0c25
SSDEEP 24576:8Emb57GBiOl6a8JTth/RWZvR6wQQ92pN3:cb5+Pl6bJTIZ5jdgp
TLSH
T1AF6523874A6B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 040f7ecbaf8f4bca8188fb9e9381fc74643c2b585128aa7b118f9d89c8278a94
MD5 b7e04e70101f0b446aebad46b05843a4
SHA1 84bb0da8627e208139c4289d8277dc07929eb393
SHA512 6894e5c2dc22a9ffbe6a6cc5bafd9762c080e19858ec6bf76a49d134a3eb065676a7264cc4a98d38d3b8501b23a2ea4044280215bdcdf9d94152392999c828ad
SSDEEP 24576:4Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Bb5+Pl6bJTIZ5jdgp
TLSH
T101652387496B20CAE45B5739D9C8DB00F87AAF97ED8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 31682894122330b87c041b5782921938ef52d34bea33c9b55cc87c81e0dcf82a
MD5 abfdeaf7394f993b9a0e66baf613ce2a
SHA1 a9e1a0c7afae5ee61f5653cf3f12a236666a6013
SHA512 a0df4bd0fdea68cd5473fb1aa88259354175c2a57815975524bec825ab4592b02734d82b6ecfa9eb18ccc613c377fc437cefcd0f03ca982e4e49b5ff3b0ec73c
SSDEEP 24576:Jcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pb5+Pl6bJTIZ5jdgp
TLSH
T1166523864D6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C6790827F231349381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2ab101a2ed0c39c3660e0a2f2e7c317517df26daecf703d708e833933181b9aa
MD5 48705f67d07fee704305836745ab1c09
SHA1 202aee57d6b1240967c721a35ea1dc372132a371
SHA512 12e395280440f139eb42bc64f907602749b6032684846b5ae2c6781143c69a6d466a90829e9d8fc6d5155dee8f98bc7e1b03b20eb05ceb0424a0d84e56a6f18c
SSDEEP 24576:rKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5b5+Pl6bJTIZ5jdgp
TLSH
T1856523424D6B60C6E45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 97f5862958c66aedd2d75c122f3f16f97fad67169bc720d0a30fb92f7c5efb18
MD5 803d0f6c80619fc00c071b76fbf0ede6
SHA1 a4a83c663d35b4d66930eac16ae87b5487e23209
SHA512 ed8e65b22358e33c4f94300a42e38a936bee8f417b88b6899e1eabb45579586792308af0205d0db6cb6bd33f772e04b25a30c4e604c1e562e1d018124dd73dde
SSDEEP 24576:Rfwvhk9RX6wkyAIQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2MnYIHb5+Pl6bJTIZ5jdgp
TLSH
T11895CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 68eb846e21aeba915c91fae33382064ca988f41fe2a15aa0ca64752ebe521064
MD5 48b12fb6a659cbb16bb246c6ddeb356f
SHA1 a5ac76e2a95ece8137554732da39302c0f2ab3e2
SHA512 a7510ce55a46b6a0e381eb8bbbdea2616476c9cd5fdfa405479e3a9ba8903bde3f70306dea86063292c3b14a65eab0df6b81afd1576e32fc0fcbd9cd885451b3
SSDEEP 49152:aYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gb5+Pl6bJTIZs:FySzPGslgJTIZ5Bgp
TLSH
T1CC066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6265bbdd792065846e14f05a9e48e75370ea9e420f1d387091eed2f6ad165881
MD5 e0a199889aac4d8ec7eb0f31f76609d0
SHA1 c4e296e2660f2cb351a136fc6d8b3f201ee65546
SHA512 2557174112e9fa52e9da48d1f2cf6ba8ce87083665855e8e3e6c0f5ffa9474c97ed063d607fcc4d97a3cebed1672683716839952ca7d1a8fca7087d8f4c21919
SSDEEP 24576:747Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYfmb57GBiOl6a8JTth/RWZvR6wQQ92X:747JUQjqirIhCnDHUPfF/wb5+Pl6bJTl
TLSH
T19965AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b90d9c7839f0ec796b0b2dcd49baf3e0a1c4ed5a1945b2c4812762e08b9c9087
MD5 f913d850880adb2db26ce1261f9271f4
SHA1 5c4815eca5af149ed821bfa5fcf896a61675c9d4
SHA512 74c6ce57cd0d71197e7fea87ffa5878d52d16137df32b18621b889952066d2b7854363c5f2e0405b76229d4dc157b2ba4428044387a72f6f22a755f5d1a09f0b
SSDEEP 24576:D0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Xb5+Pl6bJTIZ5jdgp
TLSH
T1AE75F14AC29811D8D06E6279CB858A00F7377D65DBE293DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 32240c43317c94c84a57d46aaf35d75c95d84cc5a315d47ebed29079b04171d6
MD5 67c6e116363630a591722e491e3c11cb
SHA1 635142db81140f1dbdc500a7b149a606febe11c6
SHA512 f3edde09322b05b35f3dc043acec46301126a560a76f0f875c0a2f098a04cde1bd2fefb5a3e164efd0364b5e878cdae98a7c5756eaa424f2e52baa9d3179ed2e
SSDEEP 12288:PoKqfcxU3fzY08QuBbZWj9XRZf+u9cNH06TRSaDl8ByH:PohfAUP/AZW38ccO6NSelrH
TLSH
T1F7352901B66BC75FC5AD40325E73D2CCAB707D02EE055B0772C8972FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 18855253639f15288b711115a3c704069e3b640a17d7c854b4946d862c758bc3
MD5 02507f8fcb4046877629ebbab432d0ee
SHA1 7b3c911c14f44e383cd509b15d792f2f626e1c28
SHA512 4d719bf0ab5bc2c9d03c3b531fa688a3ea2e0563d2e7f5344589783e9f05664c8682d8415808b433d47cda25bf1ef2c4fffe95e9206cd0ff84fc87ad996c89bf
SSDEEP 6144:tN9mZ7TD3g2TwoV4XTeURMyA2opDIaQcbvCopDIaQcb7UopDIaQcbq373PJZ3zGL:tN9mZH+64XTuHI9UqWKF5sPX5j
TLSH
T17065D8819137A3CFD1FB2072072A5B4CA764EC16B3055F27B3C8453AD86A766B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2417a6e3203bcd0fa66d92d7940812ab9a2e614d37ab99485f0edd443fefdccf
MD5 0a4f253d5e0e2e0f3e5173462166e796
SHA1 721699390e077ec01a8587320cb3e1fb2c7463de
SHA512 3078edfeed17012dae2dc7105efa5562f9e42c4825e62c0154fc8f8d5c7dbfb7ca489d3ed6603c641d1e7451485c358df258f85429dde9b70b7721fb3a56609a
SSDEEP 24576:RMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Rbb5+Pl6bJTIZ5jdgp
TLSH
T1D16522428B6A6086E4BB5738D8CDC710B83EBF65CF8566E7C579142AF1316C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 645cbf1a01429213540c3956cc558bd4ce1e530347faa47e2475d81194a34419
MD5 69302e3dd1a378713689b083c7c93695
SHA1 e176c7bbe1cf346a0919848993edfc0b3915cc19
SHA512 c59c1d9c7bb0603dcec08a71eda0952b4c45677412a25a217f6aefa867ec0fb01ea6e9ec54eebcdd40fa6c3a098513fddb927ee2fa517b5ea456d77f5ad3996a
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ugb4mBIBhGFeb5+Pl6bJTIZ5jdgp
TLSH
T153659E1E22EC02F5E0FAD2B8DDAA4417D6B278165731D2DF0151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 7fa439c394f826824273f4d57850c2fdbaf3f849d86b8cb868b7cac24621d0e4
MD5 345a1f3ddbb50bf376c58a801724162d
SHA1 87eedcd663598b6e516071d8f3b14150a9f592d5
SHA512 d1f3f5f7c59264c1cd554550c370d4da30a72ff1658c32c29586ea8998c6b2d7b3b68de55b71c56f1e7d391fbac85ad366206fb9896821b548c4349a3b20f604
SSDEEP 24576:VG88u8FpJqH1ozria7/mPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Y7ZFPqVXa7/Rb5+Pl6bJTIZ5jdgp
TLSH
T1E295F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 34edb16a5dcf83087388c59ab29fd46f5f752df7f4065570843a9ede97b1d341
MD5 4150d68748e598a1ad969019919861c3
SHA1 78e91b2c49125f7b8ebd182000e00e915c528f3f
SHA512 aff2f8409b5bcfd9189cd0da0202a88f5a2cb94a037a076460d64f4776dd4c8ac95f1325b2d49cd3159ef6ab83f7d087b8bd71504152013f738de7adba1b3f90
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqb5+Pl6bJTIZ5jdgp:EG05lO43bjslgJTIZ5Bgp
TLSH
T18FD5C06E62EC11F9D0BBD17CD9C68A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f5de8cb6c0fa59168876bb4597593086505121c8b4c1480e7d9d14206b02f8e8
MD5 3409edf3f6fc42cb092b9dbf202f015e
SHA1 2091e799f3a34627f2a4863a83b6e3e4302fdf2d
SHA512 a7f5a4339e0a2cee4482e47028426c241ef919a46d0769e94f971b43f34adb029cb32664dd22a6e485c63aad7217478c9248d1bf7ddac2d79d4e2a3156fd1b0e
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidndmb57GBiOl6a8JTth/RWZvR6wQQ4:qa5POZ3lJt2pasx2+mSb5+Pl6bJTIZ5G
TLSH
T1D565AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 642a85e316fbaf8df1a8f52c41ecb1da8e0d9041d6e6fb3338bce95564a01e0d
MD5 d962af688cef6953ec0421fbb403edd6
SHA1 bcdb7066071f63e63e08746aaee42c9ce31d9dce
SHA512 11f30f267322ae9b97ebe5851b1e05f6c42a86604e2a6f63bcd95bf13b65da895e0e78da40c49a217bd7940b7550ca15bc3d69fb91b445704bba5f86e50513eb
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fk3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3Nc/zEOVHFxb5+Pl6bJTIZ5jdgp
TLSH
T171858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1daed1eb3094e6ed40eca8213092cb5f2f0731c7cbb8c55cb19fa6e1401ab54c
MD5 ca9651dd95a5d15fd0466677ae0ba6f3
SHA1 f68a31c82d0d9b0916f1e3d17ffdee4303e97158
SHA512 2d8c8d67d64d5b0ec32502c3172833de97c0f39ffd14bab2e006562cbb4271ffc8b557d4073aa98078ffc0e56230a93d4c45df403e0d550e98b617ea4b868519
SSDEEP 24576:nzkNvNnaFeYhJNtmZBmPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:nzMwBtOmOb5+Pl6bJTIZ5jdgp
TLSH
T15B55AF6EAAB805E4D1FEC6B5CD238512FA727861073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5704ccf40487caa98e3c9345d1591c72a75bb24001f34282513f2b139258040c
MD5 ebc1ce338f3f8cb088e27d5510617efa
SHA1 ac7fcf5fb1d4852deaf76d95617167bd3ea68246
SHA512 391f2e4c55ea0324e8616477c2eea0fa783be76e48014cebb6edbae0da3b7273b8d8b81095262e3812ef443400444d18c788b13f2a586a91876f8698d1be09e9
SSDEEP 24576:PPUr+NQjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:PJQ6b5+Pl6bJTIZ5jdgp
TLSH
T1EE75E11F26AD18D5E67AA17DC9C68709F772B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0b727e83438c7ad2e1d2351e5487ebc1e4758308e1c9984f63321065fe90c7cb
MD5 28daab20e5402bed58d1c9258c6fa419
SHA1 6a17b97109bd294b0e7256a55d27df1248c54328
SHA512 c1b7497fbeba1ea391bbf81c23a3b161905ac28eb520388d1cbdc34edb1eaa95f48276a95bb254a22ef7a61fb8e6bab1d92a750456eb6d7529cf17b28b669811
SSDEEP 24576:7D3FHshBIYQgA4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:7DVHeBIAAvb5+Pl6bJTIZ5jdgp
TLSH
T1C385E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/684-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/684-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/684-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/684-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1100-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1100-17-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1100-23-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1100-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1100-24-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1940-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-315-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1940-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-110-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1940-104-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2812-81-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2812-86-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2812-80-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2812-311-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3176-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3176-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3176-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3176-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3280-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3280-330-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3280-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3280-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3280-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3280-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3728-48-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3728-63-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3728-55-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/3728-49-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/3728-42-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/3960-314-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3960-123-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3960-117-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3960-115-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4872-279-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4872-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4872-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4872-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5284-70-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5284-296-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5284-68-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5284-76-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5304-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5304-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5304-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5304-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6068-0-0x0000000000400000-0x0000000000694000-memory.dmp

Download

memory/6068-14-0x0000000000400000-0x0000000000694000-memory.dmp

Download

memory/6068-6-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/6068-1-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/6068-7-0x0000000002480000-0x00000000024E7000-memory.dmp

Download