9381bfb6d71f8d73b732c51f214d26ead1860aeb4450303b6c726cdfbc2c7e2b

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 9.4MB
Sample260804-qm2s3abe56
SHA256 9381bfb6d71f8d73b732c51f214d26ead1860aeb4450303b6c726cdfbc2c7e2b
MD5 fc1f6b7e2b3f66d6bed69c8a67f672bc
SHA1 5ba2deafca9e18c136ef1c54a0cb01f1a7d97d74
SHA512 e66fe521a1979303bb7ec581f35b1c75467eb2630e471dba172886b623d880e4acfe5a5bff921f2d72681cb1e9558ecec098b1e53c3dc7df19379232472b342c
SSDEEP 196608:s/r4uYGnt0snLVQEPmpOdAmaeUW9Tg99b:Y4/Gnt0sLQpOdAref0T
TLSH
T1A4A66B307D01C136E99F01B2757CDBBB912D5A750B25A0C3B2D82E6A29BC5D2333DA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2676	elevation_service.exe
4264	maintenanceservice.exe
2140	OSE.EXE
3924	PerceptionSimulationService.exe
2120	perfhost.exe
5528	ReFsDedupSvc.exe
552	SensorDataService.exe
5988	ssh-agent.exe
5444	AgentService.exe
1364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6eaee2ef238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b12481c11424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002174c1c01424dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e36945c11424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073b4f7001524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f7c9e001524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008078e1c31424dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3576	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3576	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3576	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
3576	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2140	OSE.EXE
2140	OSE.EXE
2140	OSE.EXE
2140	OSE.EXE
2140	OSE.EXE
2140	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3576	2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	2676	elevation_service.exe
Token: SeBackupPrivilege	5528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5528	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5444	AgentService.exe
Token: 33	1364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1364	SearchIndexer.exe
Token: SeDebugPrivilege	2676	elevation_service.exe
Token: SeDebugPrivilege	2140	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2952	1364	SearchIndexer.exe	99
PID 1364 wrote to memory of 2732	1364	SearchIndexer.exe	100
PID 1364 wrote to memory of 2116	1364	SearchIndexer.exe	101
PID 1364 wrote to memory of 5648	1364	SearchIndexer.exe	102
PID 1364 wrote to memory of 3448	1364	SearchIndexer.exe	104
PID 1364 wrote to memory of 5436	1364	SearchIndexer.exe	105
PID 1364 wrote to memory of 2324	1364	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc1f6b7e2b3f66d6bed69c8a67f672bc_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4264

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15d86d38798ddfbd95b97ce4e7e77efb1dc916c2fd3876aad8de8295c5da527d
MD5 2ce049505fda67e4ce609a08e0ae021e
SHA1 97bb3c32deb69fb6b00a5370d388c7d9a3ce8ae7
SHA512 b125c54b3ee8f90a4d9f06143ee2ab607a3186f54da62ac3e1e11b8ec1d7c8c5853af3e0af00c1d3fa4b54da0ad457c663c67c702ca10f6fa9e93682e899a7fe
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnim+brLC2hTR9quLB:63q6HjBPmqrWETR9b
TLSH
T1DED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ed40aac036ac0dd77404f14c22260d2319d303952713d9595eb988611989c7ff
MD5 de9620081258edb38705e825cf31cd1c
SHA1 d333454a0e44474d4adf7315827b5616429e3bc2
SHA512 b30aeea394be7861c9333a737619d7010602c57b4378e6a96e250bf21289d6f2dd2fa60d23552a3d981406555946e63f7322688a472efaed96c8fb0d1cb855db
SSDEEP 24576:hXYfDtczAlRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ktcym+brLC2hTR9quLB
TLSH
T1D705022867E408F9ED6B827CC9A2C501EA33BC914760E78F03E499651F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 46b3e3f251d26de7a78de447874e95722ad6161c75904f95715fd2d14fbabb30
MD5 3e27bd8346aa34788851e00f2ab1e7c1
SHA1 9c03951a22ac2312f5537e4e073b90a34b8955e2
SHA512 45e0e907283d2f69b23bcec001bada438eb089d67dfdc4b7682c72dd59777e05389d1bfdfb3b139eddae96995ec86c5ca405f90833fb40ec93d0d33c6ecba1a1
SSDEEP 24576:e0Le5ji0hmxirMARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ePji0Acjm+brLC2hTR9quLB
TLSH
T15A359E15F6788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a644c6e4ccb4486eb7de962b91753f6845a147640811ae8823c658bcb6410ea9
MD5 ed779861b4eb83132d9ab0b64d80b579
SHA1 f94a0131bf54182799824ebf691642ae76bf8816
SHA512 f87b414a773a9f831403c07646a16f59b27a237f2e27ea883d1221dc6bd17a19e1a43bca716941fdf5d5ff045124cceb2b050a98b2f61a77e9ef85157ff63a3b
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuiRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:g/ezSC6vUzPvxHjy3m+brLC2hTR9quLB
TLSH
T17F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d05852c06bc8d00814722e36f8032dceb23ccc06410644ce68e3d15a1150505e
MD5 5bdb65e9249f8958a6fe6528b14d04ab
SHA1 837456a952d04c2dd9495de22fdf747b5e8035c7
SHA512 0c72d4e8b3afa25623fb107b18fd1e763e5e20068960748d193c2a058e0df7cea33ed9b55b62034ca6b00009c3e10b7222ceb01e3e356f492ac3d2943bd23f98
SSDEEP 24576:DVbqPb88hv/l+6hRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:DVO88hXl+km+brLC2hTR9quLB
TLSH
T15B55AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2f11da1b424bf6775b7ee7f95a69ebb862654e9a4a3dd5afae3e24a4377d6d6c
MD5 3ba8a1c04aa0d082ea231c8787371fa3
SHA1 e2b4e3988280f9abed8dc3af8dcf5c0364bd2f62
SHA512 46a86fc47d04810f1993ac014d85c68d3e23dfa7ea2518567b32cda87f982225ea9b7e1012a438b673b72cff08564987bb9aae3fb3f6a41962268fe9661cca18
SSDEEP 12288:VRxWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQob:VRsRmlh8t0D+7y8G2G9yL0cMoThTR9Pd
TLSH
T156C42358CF2D0081F39FA2B1B2E1D8C6997DFCE1E984AC0EF0817DE51674CA4963599E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d67d472f5a6aea20227725caa0b018843b8f90edf66b8ce4fbe27b3fbf1e33fb
MD5 89e3338c3e0f46e5b08befb2d0b3bdd9
SHA1 eaaec9c7da54312b54980a6a60745782f37a186f
SHA512 f72afe6c1a428431e3ad0ac976816cb62f9401b84328184b35e8e9906f77ff4a0b21cf47df469e18a5066a3df4fc3f64eab71b69fee658fc1a722435eee49868
SSDEEP 24576:+JIUZRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+JIUZm+brLC2hTR9quLB
TLSH
T15C05CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 47586804bde24392ee0234e537b831bf81971a59d218493fee64ccbccadec2b6
MD5 6d2f23c6f5bfea98c4894eee67d69357
SHA1 72cb7891207595d6a6acc30a92fc553902a3d49d
SHA512 c2b0b1aafd2708950c1692125db1adae09f96324cee03d4ed969722690a447103f936f6dec730255d00ae72767777bf5261ace4ad862de8618f0b8ead93505a9
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:dQvGAdlCEL8c/yRNw5CSmqrWETR9b
TLSH
T1CA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 71f76342eb5aea20e4eb1d9200e5b7fd9b28445948969a5dc4cf61f5b40e8145
MD5 42c072e3516a91c094712b6b6d8cd447
SHA1 ec618d347864827922ef62d8ec788bf7cad04afa
SHA512 18460044394dd02eec57a51cfe9890adc12627b24326ad096b37ef055918f097bb9d761d9aee7dddf55a4304b1bdc6160734be23dfd7edc41d7f0afee8ddee60
SSDEEP 24576:1dewsAjTRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQod:7ljTm+brLC2hTR9quLB
TLSH
T13915EF31FE74D032C3BF0DB22B62C716587DB9604B511AC3E3A89E9D59706D22736A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70dbb76ae87ef3f9a6b40b54db3cb33e28658676fb9f0c78c3d07bc760d39ce6
MD5 f0a8ca7f07d80ac22736af26fb3afad6
SHA1 5a6993eed2da6f187aa850d9d5cabcf05239a948
SHA512 78e444633835c0c12e795ef511caf276bf39d44af971b3270fd94fe63b2d90fcef8514adb76fe09e7cfc07f84b8a8f075b7de76d1759c4ae2599e6b775dd4990
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl9b:zUEtQevvqc2W1cpV2EI327
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 17a0c020fd2f6f14571799b3d1efef43ee062540daecf08958083a98cb54b4ac
MD5 08b56192ec4f3203dad86f1af39014e0
SHA1 4647f2b18ee6e0c084f5a7be64ff13b94e3c0be6
SHA512 5c71fe5357a11d3fce1ae68755c746c41f362a5b3a2d8b49dc17965841807e1db5735d8ab756b54ee644d81d9260b0364403017716cfb7ff63c880c552ac92fb
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zzm+brLC2hTR9quLB:QoqtVjnmmmqrWETR9b
TLSH
T1E7D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cf0eff541d67d71be25c4f0e48e5660f741af2eecedefc4d9f3ee9c67409d025
MD5 6258cc70e232f3c98b5e507dc87986be
SHA1 4654f5406246fafd94c194fe2a1b4284dd3481b8
SHA512 8d49bebfe4b93fc9e70c6bed8a82df29663752f181813641d7459de609f52f54b83d1e77ce1bfb49c3ed8134f6873a94a34ffd90690e221f815a4705235bf6ed
SSDEEP 24576:6AhGLJIFoiwtA5l7S53GRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:6AMyFoiq5Wm+brLC2hTR9quLB
TLSH
T1DC359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5c2a35ba51e2b2824e42e51fbde930590445551c6b444630a5b3b6db5e2e2294
MD5 438cd5dec1c2e8b4e1f2dd9e8b526673
SHA1 5205aa1cf86db26b4b30ea2517b5dd1dfc3cfb3a
SHA512 68737af8a9178cc452712b11990dc9e2c86ec63aa8e8d5f33d844400204912e7761d0eda4f3bd6ce37bbd86ae2d3f7cf80b5ce8779d9454b4450558f7b347cee
SSDEEP 24576:ewuoOWXRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ewDOam+brLC2hTR9quLB
TLSH
T13805F14976A80CF9E5679238C193C536F7F2BC122A21DB1F53A0C65B1F376616E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c2918d9ae8d8bdfdb84440e76afe0633edd068f5c9b2e0cdc79d59054a037b83
MD5 14050ea19561ca06b9394deb61681791
SHA1 a86665c6cd5b0e0675423c11aeefa9ae59a75d59
SHA512 79012d4d1e2220cc35457256b7f170634b8aa8cf6f34d73fb83ca3e400d6a71ff76d9eb6975db8a01cc8561e15de252c6f4ec3850a3f1e556e00f8deaffdc6ee
SSDEEP 12288:1BZ1IySWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:jZu4Rmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1CFE4224927AC20F5E2AB9278D1F18A85D7B6BCA2673183CF219056E51F33DD11E38736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4cd0f3196d3cd27778eda20f26110785cb2786e673279f113c6299c6c2e22cf
MD5 7438ede162d1562b9146791465e1785e
SHA1 4c8d7391a949a2b7b3c30e1bd0e36f93036e7a18
SHA512 4c1d36b6c35341cc2de3723b5b2b6a18ff31214e3019e32a39942bc0e662b2b2b88131bc3d774a14c88f32276e81ee3722639a76803c7c6f696c53aded8f8359
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN39mqrWETR9b:DQyiKayX+PN39b
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d25da398c797dfd62d973cc4c8b845559b9e7972d1ae37ed637b393285023cb9
MD5 5a083d3bfd5666468852d617032a864f
SHA1 51dc5ae9ef133ad39534c20ae1899c175b76b90b
SHA512 8d55fc6794834f07dba09c1e8f2b75cb7d675f4149182611aa295dbe78026dcbefb33cb9326eef30caeaddf75514fd28050d8715a44014207e12cbf5269623af
SSDEEP 98304:KQRQyi36YOcPQLvw2gAf+PN39mqrWETR9b:hQyiKayX+PN39b
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fef5c7569103e9f62ea81cbee68060201489a6a9b5ba724e489afe8a063e40a9
MD5 c628dfeee8916d1d26f05e172bc8aaf0
SHA1 cde93e1bd4d6f3df74b482a37574466ec6e53233
SHA512 3622909d765bcc815db62d0b1b87938ad011d98988e2ae5034b7927cd4e020663995c705244faa86cbd51e405df2ccb2ea2545698efd1da2620bca9b0c2d77ec
SSDEEP 49152:V68Qg55nhheWu7PNU3/jm+brLC2hTR9quLB:jthWRc/jmqrWETR9b
TLSH
T162B54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4339ec9cf332ed04cabc4f1ad1caa4278277d8863d571288c21eebce2400b971
MD5 184eb2743cfecd9a79b755e4e6a6d82d
SHA1 60c23d4fb984ce08f27cacb15970491517755107
SHA512 49d365322050fc23c6ee33228e1f49a9514d0b63db266b02d7fd154b43a03df3cd9af926b8f521ffae703d90394d47d05f748d37d5600cd9f5e7d410b1d33cee
SSDEEP 98304:ly5112gYy5azzVvL69nLKnhZsmqrWETR9b:ILIHmWhE9b
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6b77ea539aa8a969439138cfc0191aca3ee91db92ed80fd252081a5edc3363f
MD5 193e40ccf6472454968b3533455a465d
SHA1 bd7a93334e59dd28f126c307ad3d6f8761f89948
SHA512 d5f7fc38f3a3949830bc29338a4fa2bc65d678854016a42ecebca324118993e2f889f513eedbfd0c8452075a9fda7eebc03c2559adb3662482e7a8e25173b518
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7m+brLC2hTR9quLB:Vu6JmVxd2d7mqrWETR9b
TLSH
T1E6D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a272ab88cab2ec2cd38876dc1ea6e6e229f064af69bc65bc73b795e26f47715
MD5 3cbfb85a0120dbb6df944438ddc2269c
SHA1 c6d62f99fa87d80ace4a6e75a5d8dcab9c99e024
SHA512 b5b8b589d6e30dcd22713e34213c1d2a200af0307e3f8250714521d9526a70bd0c50606f043424d401d31f6a5d07fdff5f58f7c2a205b85559de7b87bce2eb7e
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4x5m+brLC2hTR9quLB:EmifPbRmmqrWETR9b
TLSH
T1C4B5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 68d19ef60334895c48c224bb0f95ff65d620a320d25f42ea2d8319e1eccd06ce
MD5 805f71ac91bd87ababd23dab28d1e2be
SHA1 2f514a712efb341ad41edb2b7e568d46283db6d7
SHA512 5db6eb02a3c7189c12fefb637ff6da3f908d43a93703ac97987c44da993cb8a1bfab0a4cfff503857d25b694cbd3afaf018a4e5a8de250e15a4b463493f7894f
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHq4m+brLC2hTR9quLB:U5dKTi614mqrWETR9b
TLSH
T150C5BE13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7bed938267128cf0fa70892fc9aa86de4aa4158fbd3c679923db778c8101ed29
MD5 9778950654d9d7085aa084141d2af33b
SHA1 9b4fdd4e14e478cb1da74af484d5d5e7a2eab93b
SHA512 15d83f0404b42d0d8579b40ba68813c3cebbb2b99cbac5fcea8ce2df12a4d40b535ed623f6b7de4eaea83c491711f352147fbd550a6b7dca5838302247dbc05f
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wlm+brLC2hTR9quLB:QX2iyph6mqrWETR9b
TLSH
T12D95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0b747c933942e2052c5668bbe74a246389702e5e6da4efcce42ee937d3e57b82
MD5 d3df6513de4eaa8a97ec72b06c08788b
SHA1 4b2b6b5c9919eda4cacddd30ad7cf570fa6ee042
SHA512 c2566f74b6436d834d20f4a2b5d5c0e0605d4e5f07903d6afd258c1a6905e1429d6bfe09081e121337f922728a65e637b13fe785d89686aa1318e922bbeff034
SSDEEP 12288:ZZWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ZkRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T15CC423188E6E00C6F24EA3F1E2E184C5D8BDFCE2FA85644EF1C578E11775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 54c1d1d38ea2c7f33e99cf8b0775d1ee0ef2895094a2e6a9308ae4ce21248054
MD5 1c10c0f858cdd637efcb8beaed5807eb
SHA1 aa90f96207fa4d255a2825abe02dcf9262ed66d1
SHA512 0bc844a51afba7e6a8b6dc39d864631bba8a316f399beb053a86fbddcb030deb370e8b4a637ae59fb21771eb21357bd576c8648118a9bf9f76d3f7c27999c6e0
SSDEEP 12288:feWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:f/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T154C423188E6E0082F24EA2F1E2E184C5D87DFDF3FA85A44EF1C578E11775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 08a8259e9d11b7cf2328c10e1055ae0d2b620e4ab666ec7d0366c560f7bc1ae9
MD5 7502f68fdf76185d019ff68f9ee90c2f
SHA1 80755b720c307d40e7817c29c43891e58717d24a
SHA512 9277607248fbf3fa42a81827c96667b4fef0d22077c9c7aa843755fb0d1dd3ddecc83f5bba6c999a854314add9e7c2e3587dec782faeb3c4f446350553072efc
SSDEEP 12288:5cWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:5xRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T195C423188E7E0082F24EA2F1E2E185C5D87DFCE3FA85A44EF1C578D01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ed087be443cc7a2149cf3fe3552edcfd4328df55538115a69d49de42c085d043
MD5 ebe910efaa5d96cc122ce570a28412a6
SHA1 3ba458f5817ec52967b6d661733abbd85c2e644d
SHA512 df47073803d2fd7139143ac0c821ce338fcce1c0bee654b57842d3d05a6e6042e611f9d6346f531a9c8a4114cb8d588a3c68630745e2f3bc6dd810cdc696bb5f
SSDEEP 12288:7V3WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:YRmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
TLSH
T14ED423185B7D00C2E16BE2B1D2E184C5D5BDFCE2EB51A68FF24028D50F71DA46A34E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7a02d3079dedc7445d27a7e5103688348b7f0957cd3ac26d1af83c828d08619f
MD5 55b04f3babeed4a594a1729c111a007f
SHA1 838212f720c99b9170a33884bfb3d144fdf7637b
SHA512 6a79e88808a0eb8b2a21ea23498a31433ae9e7a04562a0526bab8165a99949abd1ae029f3bf971a179f415484b4177cc61a3033e1bdf9726cf85517567e14aca
SSDEEP 12288:OPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:OuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T126C423189E6E0082F24EA2F1E2E185C5D87DFCE3FA85A44EF1C578E01775CA827258DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ae00abbb60316ebfb4f83072324a67a22b4668a84531d0d0764fc86f052a8f34
MD5 2a1f62ed39066206f750af339cbe185b
SHA1 348e09da2009f5425394d74c801ebba492c95261
SHA512 4ffa84c95c4cd45e73a47d0ab1246e001edeed0684ebdf67beb72d1f707aff39048cda4759bbdf8793955794252e26069f6fec3d52581791f22ab6975a9dcb33
SSDEEP 12288:bKWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:brRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T16AC423189E6D0082F25EA2F1E2E184C5D87DFDF3FA85A44EF18578E117B5CA8272489D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e41cf677feae8f4df08a4602a2b71dce29554eafecbbf209b70ca4740f56d042
MD5 44e0ac431c43e10d378346edc2a7227f
SHA1 2de0966c543a5712437987a131a99033b6cce0ff
SHA512 884ea710687b9301b310b0edf5d5d2d6a61752741e26cddfa4f6261c4abf330baa90ae659f44293241cbbaf6662fb207288aa16b2aa44803cecbcfe13b3e43bd
SSDEEP 12288:JWWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:JnRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1AFC423188E2E0082F25EA2F1E2E188C5D87DFDF3FA85944EF18578D11775CA42724D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1e0023ba3b1ad80ec6975ff1827e872b3f49d6850f27efaebb24f0007e544d73
MD5 86fdcb542089b1240afcf8ef32179639
SHA1 a8e9e4b78fe8fb736b84a798d625c4ea35967c77
SHA512 b477a89bf5ac060a2f6248265153397feb1aec43377cc7a481ed4af5c1a5030a46b7e4bf8fe47411d0b5864f311a2cb087d5cd74e84d9db5bee199d60bc69ca9
SSDEEP 24576:QZMSzFVSOfRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:QZMSzfbm+brLC2hTR9quLB
TLSH
T115050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 69a8c7b0da5c01724c2cb04bf180ad36fb0b3e651f71b83194631370af242508
MD5 54a596bf65e8f3dc97b29328401dcfe0
SHA1 cd8da4bd468e7a407515e0bec97a0dd3dc4b30a8
SHA512 79db907a9f698144d7c0ef82df4fc05a9a83d544224e3767155618583acd5c641cb25db930cbe5a4c02048b7ca8ab2563d4d3489d1b1b253f5728759598e1e2d
SSDEEP 12288:BdWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:BoRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T120C4235C9E3D0082F24EA2F1E2E189C5D87DFDE3FA85A44EF18578E01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f31ff2d434d5c685edcc646c09149d4db56220b1938445be4c23e40fe8b3678f
MD5 e032be2d8abe99e38699750bc993d6d8
SHA1 9a0b18962f7c6814b70623f4b497a87e6b9969fc
SHA512 44f7714894b13342dd56f8e2a579c920751dba838f0df438552f3be4f9da3cda75be7f9af98f3037f50453b99eee20684dd0ba649b4de4474dd191633986eee4
SSDEEP 12288:9hWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:9cRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T12BC4231C9E6D0082F21EA2F1E2E188C5D87DFDF3FA85A44EF18578D01775CA827249AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 2afc8d841b3c705a22eba377f9b883233291b132e6638827e530491796d87925
MD5 8cf3de9d1c461c2e747fdfca6b806997
SHA1 f874b7110c0ec30f46e680ffa8a598d1c227215d
SHA512 ef71450b1b035a37fdc1b1975c95c4c22c872f3832f96f48e971691018752a96a573a7aebfa29f443cd0331aaa4398123b988f2c209d0e0adadf12877b170104
SSDEEP 12288:KyPz5L8SWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:XzyDRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T100F4120777A520F9D17B9274C5A20942F775BC725B208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e7e6961ca32722b8f43e7baad7e237b4741d17ab8a0f710ba093a87369dbd037
MD5 ae76e9215184791a8613424788b2c6c6
SHA1 3e8a899bf5b2c817c91e1f9f24f185c8db39eb05
SHA512 eda1e42091c422db52c6c88679aaf8b148f0069d1d7b2a5e74d43f0e49fd9181ae05c1ec96789c5c5b894ad0662a08b4a1e0d698916bb91e9837240f7531e447
SSDEEP 12288:mdWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:moRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1D5C4235C9E2D0082F24EA2F1E2E189C5D87DFDE3FA85A44EF1C578E01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f2156b514e045fe1b0247a91bb7421a3c11478f803ff3a8d9992295015a79677
MD5 a62e20ed164d4e9517647f36bd55ed75
SHA1 5c3690886f8013e8a883f48b6af3e0f3de0f1c79
SHA512 d10635adc8a3dbb86c9878d0a92f386eaa186443ff9a2f5fb71195108e1b9c2c2c963938d2d0dd59e8773c1c223881dcaaeac8f5f117fddf6d992f9d27b4891c
SSDEEP 12288:VdWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:VoRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T112C423189E3D0082F25EA2F1E2E189C5D8BDFCF7FA85A44EF18578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 83296e091df34b8d2a159d224cbe4137a022c164d4929ae8108b7a06c1e3da72
MD5 e04e3f60f1ee73cbbc496b80008869e2
SHA1 cca1beca3ce00b65398a05336d32bd0db8c15e3b
SHA512 c16f23ac8e0cde1950ca2d3385274299dbfd4511550a40135601438cf572a1fd219099c96f581a614d67a2585c09fc6f63dfde16f12f3d3d136978353589e415
SSDEEP 12288:QyPz5L8SWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:hzyDRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1C8F4120777A520F9D17B9274C5A20942F775BC725B208E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 749d0560d92a1b9bef8ebed160a50c9cb5ffe3da13e373e5badf90094f5b3904
MD5 6c9bfd9dafaab1f0d7cdc4c5b18d44a1
SHA1 48e2028c4ae8f4fc5c1fa01e00b72c33ef81597a
SHA512 dd60a4b1e5a7f9b10af86f2769b83632d07050d36678259c3d5d7eb7d2b2d8a5264c759b51647c9220ca89c1bcfdd9aac6546cd625e2d1b660539226656c1c43
SSDEEP 24576:XTHaLl3z0zDBRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:XT6Lljim+brLC2hTR9quLB
TLSH
T116050294B36408F8EC67827EC9618946D6B2BC6A4B60C61F13E436671F337A01D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4a5224bdea5e340984bdf0c5ac57f639d7623e18a8d6a872ba529d18d1fe2954
MD5 1e8cd972f0ee047429438823dd24871d
SHA1 1a52d61b23983ea0f53fe4d1f5fe3b8f661d9379
SHA512 86119ce7a45097788c778404724c43e5e09372f45aa584ccc8cb81943775707504c587c95c6e40532b2de2faf4f4084c869f3f9bff1be7eaa7d45da1bdda17e0
SSDEEP 24576:w37d9CHKy7GZdRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:67d9CHKyabm+brLC2hTR9quLB
TLSH
T18225CF90F3E810E4F1B7DA35C9728511DAB67C9A5B21DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 83baacdf2522e888dd7e22380cec8e244561ba7d13a77a960235902edb898b5b
MD5 e7d941913087b9b814f024635ab1f1f7
SHA1 c92865a43e3417b3ebde48c675da4ebc8f1b30aa
SHA512 0e42e3478b885b50974498db98939318b5e9c7d80944339f7dab76726d0e8cba313eacdf7fcb2ab4c015e662d42006ed1386b1d63468f41b8a332d092e80a5cd
SSDEEP 12288:S8WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:SRRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1E3C423189E2E0086F24EA2F1E2E185C5D87DFCE3FA85A44EF1C578E01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 583c0f4ccf1aa9e76579346d244defa9984a50281c5256ba9ec9cccd9cd3744c
MD5 8ee78f5ac8bd848124b77e9b59258061
SHA1 816e1c96e0ab4781250f96d56b717d6003bdbf24
SHA512 1fea9611d9ecfeca7f86a6735882f560c97dede1baad5ad48534ff51ee59f58f0b945661f1d7e34f518f56f20afabb53775986b4f479c2a9b4bf23a0df418d8e
SSDEEP 12288:4yWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:4jRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T19FC423188E3D00C2F25EA2F1E2E189C5D8BDFDF2FA45A54EF1C578E117B5CA4262489D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bae24ad4e80ee7fdaba205e7393bb849817eb5ea8bd957ba77482c56434fbe5d
MD5 578bde7e608d60f14d2d31084d33af62
SHA1 c72127fda03a165ae833c909d35814cbf037b9fa
SHA512 04a2a8b340e2209006f01c901b3225ddc109aa59c4636a72cf52b0132348238b5d90137a4100725fa1ccf478d1840b9a02d73aff3ce36ba36c17b6f126fb4f92
SSDEEP 12288:+LWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:+qRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1C1C423589E3D0082F24EA2F1E2E189C5D8BDFDE3FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 13a227230f2dfb9e49013754aec067665f842d5537fb3f0e0dbe6f8b741e854c
MD5 358d02f053d1895c23c3dd333cec3014
SHA1 2eab8896e4729216579876dc3be2f20ce38c4174
SHA512 e36500fa625027bf414d428b1d2da8cafa18fb1c09a125ae1503ed57379672c2a24c69332bb765f8b06906432c137e58770294d6d422c13cde3faedd1939a993
SSDEEP 12288:AdWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:AoRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T119C423589E3D0086F24EA2F1E2E189C5D8BDFCE3FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 4bb05084670be5ce1d3d86ff3cf17326195d248bfb2d7ef5f11a5830251db2e7
MD5 eddf95a941af1efc11115f352e565dcd
SHA1 2ca1614506e9dac23967463b0f03dac9ce57ad42
SHA512 e9e0e39700cf01c3d5f5d5097c4029de9ff8e60c3eb3f5aedfd88d37dc2f762de9e87ddaae29d2289c77c9da5fb4d772e00c395d9d304832fe7700c0503e80b0
SSDEEP 12288:o8WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:oRRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DFC423589E2E0082F24EA2F1E2E185C5D8BDFCF3FA85A44EF1C578D01775CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a5824999eb45a484268b6c4c993b1cc0ed4318e5224f3f062a0ab971893d38ba
MD5 d36c5e12d781421ab29eb74a122577a2
SHA1 72c968160857196ef30fd1aa7f1bbc68ef3ba1c0
SHA512 b173c57ff1e91d25900a98eebbc65e47de7789be5d7e31ac4207cee485fda6d6ba070f535eb64c5c68dbbcd4c95f1df2a8e041420bca7a17750e08477695d0f1
SSDEEP 12288:e1WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:eQRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1CAC4231C8E3D00C6F24EA2F1E2E189C5D8BDFDF2FA85A54EF18578D01775CA8262589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 6cec11959c3dc6a45ece85cda41550939e49084c4daddc34dc0b1c379c18185e
MD5 426b61b059057ff1366465aa6b1e1787
SHA1 a6eda3c9a44cab69b37fa3e77727a4867fd35b5a
SHA512 7ab4141754d53b063f4af695201e4c6442da411f3958ae57182a0776510d0ef3a02334f29c3d977a302be3121693ad25ba19c425d77051d49a6b53e876558fc3
SSDEEP 12288:iPWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:iuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T16AC423589E2E0082F24EA2F1E2E185C5D87DFCE3FA85644EF1C578D01775CA8273599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c4d7dd9e87f94dedc7f17c70ddf65733e71c5274d254c14ee8c7b25a2f0d27fc
MD5 ea854a7033079ea10f4a2d3b5a6b639b
SHA1 a5133199c40745a92ee517cd7a9bf465360e48d1
SHA512 4b870968f80fb56d920cd7193cf7affd935e515e64d2395e213ff9005b6c78686ee757d3951590866c2e333bab18919b6fc9a1b23ce03ab7f436ca02f6ee97ff
SSDEEP 24576:gfwvok9RX6wkyAIMRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:oMnYIMm+brLC2hTR9quLB
TLSH
T1DF35D029EBDC04E5E177923C99B3460AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fc55765814f853eae85c93e32879ecabc8cd4f6034197eda6a54427e53410da4
MD5 e08da370aa0b409baef4d933a0daf444
SHA1 91d4c381f8d237d3afe937a36c9aebc5a1a6e07e
SHA512 70937aa5fdde4476a62f65bf25e3dc6c06aa89ea599523224b3e5dd48f202a85f19738ec9fd0de8b4af1b0b79ddf726a3dcf7a1fb6f8f932c9a481fd0bdbdd82
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Fm+brLC2hTR91:0ySzPdmqrWETR9b
TLSH
T1BC067C96A16801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1fb667e5c7559a555d124c9d81736b7f7046e6d5a11b3a6833b273ac812b87d6
MD5 e9843aacfe23d418f75cd59a962ba680
SHA1 aca7076db4e1736f4d02d130263315394451b422
SHA512 25b1783d4f0cc4e0a57a39c528db276b513c52316c5d48a7f9f32025074862cddcdbf1a64849edca09585062d20388392fffd87d6d560870326d5dfd7eb6f4e5
SSDEEP 24576:p47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPRmlh8t0D+7y8G2G9yL0cMoThTR9PN:p47JUQj1irIhCnDHUPfF/1m+brLC2hTd
TLSH
T1D565AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 cc1ae205a62c7a28de5aed8c95c5a64cf962926643ecbabe1a181592145a00bc
MD5 4e666a77541b6192999e6bebafc5bc57
SHA1 7374c3af45a2d7b507459751af3c9ed560aab9e7
SHA512 0fbe1eedb519f5d5478a222ae61589724f1ebcc15c841e2929db2faea795c40f742ddfcfd014e7979c3da757ea2687153880db1e5c7d35c1ec2016f53fe82fe3
SSDEEP 12288:4NsftWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Z4Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T146E40119D2A801D8D06EA275C3928A81F3377C6197E1D3CB62C0F87E1F769905EE9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8f1c43f00b3e396b8460ee1ceb5399c4c1a483d159f9f548b0a878430c055d94
MD5 34ee3c567ef6e112ff1bfa898f64389e
SHA1 b32f5b58288c1ef275411ebf50ca157e61b05432
SHA512 6781609f76e0625a84dfb415b52f873ccafe8e950097e2d9d01b652ac93f7ed337415931f7d6c6a402388f248911e6c921bfbb322461ac18d74076cf704157ec
SSDEEP 6144:PyTsBC2na2LkilrERmfKDexHA4Xy5a3LkvSLsGHwTY4Iz9knAS6ooHq3BKO9zIyJ:Bjud4y5a3hAlT9APooHqxKOFIYcaXl
TLSH
T1F7350701762BD75FC6A940325E37D1CCAB707D05EE45AB0372C88B3FD576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 64e0fea93b4d98ec62f6eed51114145780a210948f32c039529c209d8ff9df44
MD5 49976c14f73232ce94344bd5c3cc53e0
SHA1 78994d008880657ddaefebcd36de2127dd563e92
SHA512 78356f3f08cbd6838b70fbf44d58449ac7ad931f01d11bffe22e57f0ed6444dcd1df876fb8b965d07e24a0680a847bf980504f6a3c858da91d593a86aafa7ca1
SSDEEP 6144:Za/o3p4bkz2EfU0l2sp/QJkvuVkv0+L+rAifNZjKDexHDgN4jgybtXu5PLju3HTS:ZkEhY0/Q0+rAamy5U4lDC
TLSH
T14165E7815537E38FC5FB50320739AA4DA7B4EC167B056F2673C8043AD82AB25B4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7cf2ad85a753bedb6cd1a3232ef948cbd0697bfefb3f2c0689c91f2a61246931
MD5 badd33b2fc6359c9ea3e3c73050b6449
SHA1 ee5159b03179cc7e2144c2caabad57b1418b1d2b
SHA512 325fa731a112b02907de9650e8e9c7f874930c9032803631ad44e2743008502355dc54dbbc89731a40e65d04961890151ccef70c9d83fd2d0097dd5c55337a83
SSDEEP 12288:9M7FWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoA:2gRmlh8t0D+7y8G2G9yL0cMoThTR9Py9
TLSH
T116D42318CB6D4482F27EA2F0A2E2C495A57EFDB1AF40D4CBF08179D12671CD45E34A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5393965f88713c6d0b1cddade532eebf77158519ea620e92322dddd796d53def
MD5 3daa28f2366873e1376ce8fea58f29aa
SHA1 74410075e13f28ca64d7f8a604eb2b3980776d13
SHA512 a0aa2a1a93868c87041356807a0d80ff8962068cbda6c258ecb3a19fb0d2f8bdf65603e1d981697fc18d106d9f765a886b779bfc712edda336f26b3f47c8e266
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYiRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:9gb4mBIBhGFPm+brLC2hTR9quLB
TLSH
T19865AE1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b31c910cd973dc77028ec6a59e0d3ad7c0307fede341bfc2245ab11b5777a9ec
MD5 15ad5ad099b9190eb0dcea11801bef0f
SHA1 b76ec883d924f0ce3035d9d609c58a51d202390b
SHA512 c52756e59d468ecf2eff17ce722a7ff9713f359481a533dbbfa073b8e64f3bf0c374b347a681077595489b8b7c4cbb17911a6b31978380e2270b3ccbfecbd3a5
SSDEEP 24576:zG88u8FpJqH1bzria7/mfRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:C7ZFPqVea7/Km+brLC2hTR9quLB
TLSH
T13D35F16577E501F1D07BD138868246A3F6B2B8251364EFDF07A88A511F23AE50B3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 f5c5ea2343b559c7d7fe00a58e56623d97ebd267958bc653b7e0eedadfe346c2
MD5 455571b264e1e82c9f9a8594047818a4
SHA1 ce9e7131544eb331faa77ea51fb4f4f34617f507
SHA512 bfe0373d60c6b94ee5c32d8096cc84a583bfc1187c1fb076902bfeae1cba5247269ee92be30f1f60259490120d5adf835584526de1d78fbee54f516e6403136a
SSDEEP 24576:hPUr+NQbRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:hJQbm+brLC2hTR9quLB
TLSH
T12A05E12E66AD18E5E27AE17D85828609F771B8621712D2CF02D0817E0F77DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bfdff0a26fbf10a9c69892b246fdb62b2660e4554b53ada38eda90a855487548
MD5 083bf96582c859b1e808ef2605976ba0
SHA1 d6065dfa61c34c4fc6f831c1715328544836f214
SHA512 4affa40292beba9fba995b6f8e1be21e62d8729bb4d23c25ccd025a75b0f4e92301c93c25b73d1f5eea9577062b31d6ffb13c794099bd26505f311110a0a7009
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrm+brLC2hTR9quLB:XG05lO43bUmqrWETR9b
TLSH
T193D5C06E62EC01F9D1BBD17CDAC64A0BEBB23825032556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4dcbb5aa67710b7d8d4fe27ee7708166167d686d28adcf44abead06085adc31
MD5 e69efbc6769b94b056620df4c00a0192
SHA1 bc75cee58580850aaac16692c28e1528a42c4d7e
SHA512 47c19cbe4c71a6623d3799e2a03e47a6d8517e3bc4676a4b1df7e84b2725247870dd97b92dab48ed9bbadf218b77d17d82efe12a85bcdb6a1e13ae99d63380ba
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFRmlh8t0D+7y8G2G9yL0cMoThTRD:5a5POZ3+Jt2pasx2+mjm+brLC2hTR9qU
TLSH
T10765AF5EA6FC01D5D1B9D17DC583861AE5B1342253319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 489ab530e333293f7c99c91dd774c2a90dcd65c6a109c1b57401adb82be309a1
MD5 0cf8fbab80225f4f96e6ccb6e4ad4bec
SHA1 99774d27ccc1647a8c85f84044a674574747c5c0
SHA512 2492688cbe4b43f79c0d56c6d25a6bf948c8b6bae0313d8391801580d376833f290e8ced8e6fc9571fcf4297e59a6194f60b881a52c24495b165ede029d0b9c0
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fk3Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:DNc/zEOVHFqm+brLC2hTR9quLB
TLSH
T187858B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 befc8bd7abe23bab55f2611d28d7ac83426416bdaa09738ac360e5ac568adccb
MD5 0ac5be70c8c00beb4a252f927a3fd3aa
SHA1 4969cd93fb8eca3b8de0d15f8710be9ebf26f95a
SHA512 f0939aa46abfe937ad1de3047d0a838ce715ea5fb81142677a18aed3c118437fc6c2b4302d870598d4c1f19864767d2f3a9c72fdd0f3b0612518a06c8ff50e07
SSDEEP 24576:X8kNvNnaFeYhJNtmZBmnRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:X8MwBtOmnm+brLC2hTR9quLB
TLSH
T10155AF6EBAB805E4D1FEC6B5CD238512E6727861173293CF5290C13E0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 7dd911c64d80fd8b28712f72a67c745a4e8ae2dff4ca7c4d5586706315330027
MD5 ae2085be1f2e25873f40ce9b3f2e4417
SHA1 a06362409654ca64140d38e048d82e36f99bde17
SHA512 c581142bbb3435ff21265c71ba502bea67a870d094313279d5e453e0f89cd8d03af8b9b8293f08c586f652882b4e3b8869db24c0b70785230fafe3f3f3a504d6
SSDEEP 24576:zD3FHshBIYQgAERmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:zDVHeBIAAEm+brLC2hTR9quLB
TLSH
T10125E13DEA5C04E4E57BD1BCD6A38A06E77178A9032265CB12D481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/552-308-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/552-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/552-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/552-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/552-97-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1364-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1364-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1364-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1364-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2120-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2120-79-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/2120-74-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/2120-290-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2140-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2140-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2140-196-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2140-51-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2676-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2676-16-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2676-22-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2676-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2676-23-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3576-14-0x00000000039D0000-0x00000000039D1000-memory.dmp

Download

memory/3576-6-0x0000000002BB0000-0x0000000002C17000-memory.dmp

Download

memory/3576-7-0x0000000002BB0000-0x0000000002C17000-memory.dmp

Download

memory/3576-32-0x0000000000400000-0x0000000000DA3000-memory.dmp

Download

memory/3576-0-0x0000000000400000-0x0000000000DA3000-memory.dmp

Download

memory/3576-1-0x0000000002BB0000-0x0000000002C17000-memory.dmp

Download

memory/3924-69-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3924-275-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3924-61-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3924-63-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4264-34-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4264-35-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4264-41-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4264-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4264-42-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4264-46-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/5444-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5444-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5444-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5444-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5444-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5528-84-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5528-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5528-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5528-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5528-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5528-323-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5988-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5988-110-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5988-116-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5988-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download