e9b583c712b78ebaff1fbe11c90ee96972c2f24df340fc3a60c60ba411f6ea88

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 3.7MB
Sample260808-v2k63sef48
SHA256 e9b583c712b78ebaff1fbe11c90ee96972c2f24df340fc3a60c60ba411f6ea88
MD5 a47687ea2e6673fa3a06b00d2eefa0b2
SHA1 b2034c26e178d71c2beed245a664f47a79c422ea
SHA512 24ab8f3c53c62ef847c08a2b199cf7656eefbdf1722e63be3b4a73cbabc4dcdf39113d9933945b01ed72f6cc72a0b1436e77050de3823ed3ef063f38424c007d
SSDEEP 49152:8DPkB56REPtAxrCcGU8+kB4gb3OP1m8vPHve/idPYuAbRlmZF8gDYf5zaCpXxPuC:8IIxrXGxqvO/cPYMoDw/z
TLSH
T17906F6026BEC0418F5F32B388A7A99509A3BBC560B39D5DF01981D5D0F73AC29D76B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3348	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
3052	elevation_service.exe
3296	elevation_service.exe
2716	maintenanceservice.exe
256	OSE.EXE
2736	PerceptionSimulationService.exe
2668	perfhost.exe
5368	ReFsDedupSvc.exe
472	SensorDataService.exe
2324	ssh-agent.exe
2892	AgentService.exe
4828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aca2acb4b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff13877b5b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b7b6ba5b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003fcf3e7c5b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed02097f5b27dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000380a357d5b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068608aba5b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000806a1d7d5b27dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4168	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeTakeOwnershipPrivilege	3052	elevation_service.exe
Token: SeBackupPrivilege	5368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2892	AgentService.exe
Token: 33	4828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4828	SearchIndexer.exe
Token: SeDebugPrivilege	3052	elevation_service.exe
Token: SeDebugPrivilege	3296	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3348	4168	2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe	90
PID 4828 wrote to memory of 1268	4828	SearchIndexer.exe	102
PID 4828 wrote to memory of 2200	4828	SearchIndexer.exe	103
PID 4828 wrote to memory of 4140	4828	SearchIndexer.exe	104
PID 4828 wrote to memory of 1464	4828	SearchIndexer.exe	105
PID 4828 wrote to memory of 1528	4828	SearchIndexer.exe	107
PID 4828 wrote to memory of 2732	4828	SearchIndexer.exe	108
PID 4828 wrote to memory of 5572	4828	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\SYS2905099913\2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:3348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b6e6f0250e2a16e8dae7f2008650394ff984b3b7b11546a6c6cc566f41bc0067
MD5 4ee007a5c330b34345173247c962bd3a
SHA1 4cfa7fba63807a368a6ae3c05870a2b9575bb1df
SHA512 174e01c419e80ac9adf202bbf9ea646f3da29f56c24f875325a2c21bb21b1ebb0241f6e51458713e3b22a8e14b87c13a21f8423c51f105922c7d8a06064336fb
SSDEEP 49152:sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnTDYf5zaCpXxPuR6E9dA:W3q60jBKoDw/z
TLSH
T188D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cb82beb1f290f3ea1d5d481c2cc7eb3e12f3bcdd9754a99f35c2d4787d84dbf3
MD5 d8c2bc75137e31e446f907f97643f42d
SHA1 6a5065589ffd275718661d2ea5a14c442d03bb87
SHA512 faedf07dd3518c7edba1911a417d75682322884d45fb0d32a630b7d9526c189b523336009869d35425b17b49797bd265a1dc298ea414b452aae1616e48ecbd0c
SSDEEP 24576:8XYfDtczA70Djsf9nz4mloFQnpXUMPQDR6q79dA:7tcNDYf5zaCpXxPuR6E9dA
TLSH
T11E75F129A79404F9EC77423CC8A2C111E672BC5147A0FB9B03E499665F337C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 36d7ae707467e3f0658a6d1080519910a7b574284c1b5fa8ca472edebfad6061
MD5 079074ebc0566ecbef4943741b60363b
SHA1 52c7dfb14dd678fa67a94c22afd7fdfefa5a8323
SHA512 a6af474be8d02c19a32a81e3b80bddb421591754083568edd2c63d6e3f8add2fd32aaa44316975ee496146cefef8de5939ac48d983df508a76a8f36f4c7059d7
SSDEEP 24576:b0Le5ji0hmxNrMY0Djsf9nz4mloFQnpXUMPQDR6q79dA:bPji0A7WDYf5zaCpXxPuR6E9dA
TLSH
T1AA85AE16F6748331D073C0B9C5D2A69EE97130825B308ACB5286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e502c5bcdb97788737e741befaa665c78d6e2b384ea17f6ca1ea877faf21c66
MD5 9680050ba9f7452da20a21d3a3d70b74
SHA1 706eac5a5316a17897d04fd1d81b922d46f8260f
SHA512 200c68a0d305db9279b48ae16eeaa7549c5f59ffcde45a95e74d88f270c7bd4c1fd71f73c7d6c1ea882dd256878425b57d04e71bfb3ea44e12592c1d2237db25
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWr6q8wyuS0Djsf9nz4mloFQnpXUMPQDR6q79dA:4/ezSC6vUzPviHjyqDYf5zaCpXxPuR67
TLSH
T1C4756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b1f0bc1ad9d1f92ba92c1ee65ce99c04f992a8fb09e1e1a4d1967b40629bbeb
MD5 3cdc26e80a6c064d43fa87afc8d8c9e5
SHA1 aaf31ded4f7147e681112dada54336eb32d98303
SHA512 c9c0483255e46ea1b95660c58d263e3a5627374be46ef8c6e7b4c11b5dff8ccaadec7882e88b98dfc24cc346ca250d90e658c9c3f48b1cd4ef92436089721e77
SSDEEP 24576:yVbqPb88hv/l+bn0Djsf9nz4mloFQnpXUMPQDR6q79dA:yVO88hXl+gDYf5zaCpXxPuR6E9dA
TLSH
T14C55AE66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a195e3c20d76b78d6b8423f91635699ecaee052996caab4199043cd61f545b1c
MD5 8e527e4b9a0e740feafa7ee7487bf379
SHA1 1ac0eae979bed7304d0898c70fbc477824f5650a
SHA512 c3572aedca9c9c70ef8210619ee53d6956dd56c3394f2d1b5adfb71e47ad383e187740b3ed4f88d6501752f6fce6218ccc48f3f3ef1880ec89dfd1a1d5f0f254
SSDEEP 24576:EjE0Djsf9nz4mloFQnpXUMPQDR6q79dA:aDYf5zaCpXxPuR6E9dA
TLSH
T13A55238ECF0851B2D4722F3C28B1E225D7D4BD206D953E6A77A1F68ACC7474BC4A5983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ca3690da9da03cd119085cd18db3ecca852a485ec75da06833af76c860eb2dce
MD5 5b5bb6ae8a912b9aa4ae8daffd92b746
SHA1 a6161b517188baf6a2c709b5df863271d2c3bdb0
SHA512 0230ef8a1e7c78a6f703408c60d1a0753d896fea274e31c13e099d8b471ec0cf448e445622e6602f71a3124945c771ec9bbb2441036bd85c4501975707c07a14
SSDEEP 24576:bJIUP0Djsf9nz4mloFQnpXUMPQDR6q79dA:bJIUcDYf5zaCpXxPuR6E9dA
TLSH
T15B75BF7BEE28FCE2C27A5D785A91C200D7B278304F62A3CBE165820EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 08dc563fbc7b933854c0446f37dfeb27810804169ed125a96405cf29026eb871
MD5 08491c6e10ebe19c9fa0f336f8248d99
SHA1 dd39f0dfec840288f8decac6b1815cdbd367868e
SHA512 bebbf0be55c6acef69b32a6a6553b30d0d3f336960cdb97c441fe1c6b33570ce4298bab8a95cffcb8cfa2973a0d6d2aebd5ee6634b8fcbff28b8da2f5dfdee42
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH3:lQvGAdlCEL8c/RRNw5CFoDw/z
TLSH
T162266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 68efe17c703eda1db0e90ef3e85b90045e60b2885203cd7ddb7d1f6ed7f48b02
MD5 5394e85a8949367a5e9ef58b46633d60
SHA1 d0463a00a6fe1c78328494a4b401311e8a41a58b
SHA512 45477b0232b7abf79f320ecc2161d877ebc1e718cf54f73bd27cd24d259f60f6117e61aa5bddf7d7982b320403a197d892929ae1260e2857a48abe4c99061780
SSDEEP 24576:RSewsAjB0Djsf9nz4mloFQnpXUMPQDR6q79dA:8ljGDYf5zaCpXxPuR6E9dA
TLSH
T1ED75E031FE74E036C27B0DB51B36D716546CB9204F912AC3E3E89A9E99702C26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7dd662c806d65884959e165bc705accbe208c7f82528455137a4a0f111a51136
MD5 e5624429d4703ce6367210baf4e4ce75
SHA1 f3424fcb02c3de9111895ec00f7ad06876178b9b
SHA512 5d6d4fba49adb437b89ed79cea0b8ebf94b8c7d9325e38cd5dc0defe537a628f614b4b9680a887be8c12b50df7358030e6e35236b5b997d994f0372ebdb8ccee
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHNA:wUEtQevvqc2W1cpV2RI32N
TLSH
T1FA474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7658b66b23e44547a2e9b566f43b45f25981e5b95e57353f072a0a5275ce1b75
MD5 6d7a5300d1419637cf222c308ba6ed30
SHA1 cfbce988ecff16d07fdeb033d1fae051a536ac9b
SHA512 3b4d8a9712b02ce7b2d14772c0cd871758727ed8ecdb23b8371fd468dff32ccf3797d7f7b7082a0e35438f8af3fb817f447746e061797d33b29e4fc052bf0a44
SSDEEP 49152:dCbRquA/m2yL5zifFiV+XenmE3/zmDYf5zaCpXxPuR6E9dA:aoqHVjnmhoDw/z
TLSH
T187D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 25e9d6a4dccc78e8fece14f9f2407e44d12d6907cbee465d7d3f19344d0db228
MD5 2341fe6771d62c5a98b81e87d42adade
SHA1 7359be382caa7287612b7440789a11d4a0eabf00
SHA512 3a15f20cac9985142d65607740d03d4da51dcb2ab970842826bdb618f4cba1b10c7f02a940ddc6a7c0e68714f48c3781a3488ef5266fd0eeee6e843cb4a648fd
SSDEEP 24576:JAhGL2IFoiwtA5l7S53m0Djsf9nz4mloFQnpXUMPQDR6q79dA:JAM1Foiq5hDYf5zaCpXxPuR6E9dA
TLSH
T139359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cb3a87dbf873931296e3eda069948e642b5b66450ceae932f090bd39a1b62978
MD5 e7cdbeeb673db6b80ba843cf8a7e7059
SHA1 1190f8c871765595822233acb323f051fad79579
SHA512 40f34e2bd73c6111e02b8f87c9b6004b332a6289c88173c935bb38aaf8b7fbb1ab7bc067959c2c7895b68a4c1f97cf6a34ac2be96db31febab01e03ca0d5bfa3
SSDEEP 24576:CwuXOW10Djsf9nz4mloFQnpXUMPQDR6q79dA:CwsOFDYf5zaCpXxPuR6E9dA
TLSH
T1D565F04A7B9408F9E97356388597C136E7F2BC112A21EB2F17A0C65B5F33351AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 238e816241966d46b42d0978eb15bbca22d129c954a41f5eb6be81ff08c1e5fe
MD5 26fe5fc1cbc9934463a96abff740c390
SHA1 ac42abbf44b1dd967fc3d5974c4f09e9aa90e25d
SHA512 d260c132a2946fdb03d4b5a08095af37353810ced9adc57b5b0ed093aa642be790d67be3bb9460faaef7f574b4cdd88eb38bea61fd196ea2ae757701a3a878cd
SSDEEP 24576:zZuA0Djsf9nz4mloFQnpXUMPQDR6q79dA:yDYf5zaCpXxPuR6E9dA
TLSH
T19955128E6B9420F6E0B31B3C98F19215D3B17C226B7167DF2760829A5F32BC65D39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8167c8bbfc5174a72560f11dbdfefef7ee2956f753419c0088feecbc32d793ff
MD5 0ea523027e0ace4977e59ef8578b4e9a
SHA1 70dfb4b600d906a796246fcfda4013533e245651
SHA512 442aab295ad2c3cd2ef298c36e1513f7e9547c895cac0db11ea4f211ce9e787000780b66c7ad4c685adfac59458b5cb9b1030da3d7118f472e3e6edc764c5da3
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uj:/QRQyi36YOcPhLvw2gAf+PN3OoDw/z
TLSH
T153667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b87cef131f7ca643b6cc70ac91c25e560cb6331cee37b5942cf510618a78fc6d
MD5 1293b0d3db18b33fbeda8402b9e0deec
SHA1 023f0744b8f3c1f31d3cf2a78cdd2efafee51caa
SHA512 9a6b8b192f59dc7e0f2efb1a86abdd935ea467f4399d9bc189b81e1e7d1b56de876142ea6f5c5fa055820dddeca237688bdc33bd8df4c15a79e355f1d5dd8adf
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uj:9QRQyi36YOcPhLvw2gAf+PN3OoDw/z
TLSH
T1EE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8c7a8f4bb0290c3d2184de012d14ef453b35ff480e6fbdc2e4e1c27e2bf3aeea
MD5 987156022f4e9efd6b8e412f692f7551
SHA1 69fece09586b2ce0f06c9742c1f55c0254b91a67
SHA512 1f92692f35909981e53879a6635035338bc242168effe3158728cce6f913f11068e652194ead755b3d865902bd72745edaf9c1975a1531a772849b70524ba6a2
SSDEEP 49152:f68Qg55nhceWu7PNU3/WDYf5zaCpXxPuR6E9dA:ZthLRc/YoDw/z
TLSH
T168B54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4f0d2dd8a7986fab4e0d69d95633fb3233fea30ac835557307e482259fe2c1cf
MD5 536fab6684cdb8e49db4434b57e1ee1a
SHA1 e8a2052fb4ba64dbaf68498cde8b550ed814aa07
SHA512 4f92dd2e82c115ffad4a4827e1d686d93ce7d0728114aad539311ea8d8ab29bf44c9b4642aecbf99fa39aecc5f2e767a5a56a925b9044abfaba487371bc53159
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99Z:Iy5112gYy5azzVva69nLKnhZjoDw/z
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c302ef8a5a8628719697de3454bfa93bf62b5d30ad583b3de9cb0815fe5c2cd7
MD5 a7d32cef559c0bdf1f1c1d8c9f2fe074
SHA1 3ece6ed4259fe5f30f894d9b7e50fe959f9063c5
SHA512 54447bbe877d293355b9aad410038cd9ebb61df56a426bcf7676f7def7c2f3afaac1380620d2921929b4222e6a1ec568a8c9e08d101574693ced6a94fdf3dc05
SSDEEP 49152:xB+taZ3usBWOBr4tEG20bqx0z+n217aau1glmDYf5zaCpXxPuR6E9dA:nu6JmUxd2dooDw/z
TLSH
T1A9D59D13F1D901E8D06AD578974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1027ed5c8602a899ab19ebb836121f94686e29408539e08d1f3d1dd2623ee59a
MD5 ed45a88854d0fb3f764e0408522ade82
SHA1 ddcb7df4507d06e5bbe4e0a02e13b89f5dc8285f
SHA512 7b489e206eccecaeaee0baee42b22ae37aaf5b818fefe1cc31fbb350b10b8fed56fe8474a4dd96b49a90c368413c9ae5d80f1edb1eb66f3c9fcd781ed8321992
SSDEEP 49152:U1hpsNoJpF1A6BU44CwH7R4x8DYf5zaCpXxPuR6E9dA:UmifPkRhoDw/z
TLSH
T122B5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0722d2f52abc600f3ab52e736acbb8a9249f20c14bd85155169ee74923db3699
MD5 c960356bf4cd0a4f641011fea1bc09d1
SHA1 4e4a237ee841d82e6cd5f9bf38fa69abca135614
SHA512 f31d900db6b3363adde4e443f723cb22d342e52f5184acc9bef7b78ca774394925621101e8834d615a3a92d50effcc204755534403f049f991a95531d1fb7e21
SSDEEP 49152:wSuZQIY0Be2KNRVtOnks6NMHqDDYf5zaCpXxPuR6E9dA:q5dKvi61noDw/z
TLSH
T1C8C5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a22be2821c512966abb1263933131de602d10ca13a47392e058c0ecaa3657557
MD5 2060b2bfdc0c4d50eedbeb1b7d0af541
SHA1 c325a6b5242750564a8bbcc73ab66a7e0989f331
SHA512 4a7640333b1f316fd92a34efe230e83464113f94e545de4a522ac0b99acff54b6391993b2aa500161c913968ed6821be6148eb33b2e8d49df6889575f30ce757
SSDEEP 49152:DhtSn8EApI0figXgiDn0AP5wIDYf5zaCpXxPuR6E9dA:iX2iyphtoDw/z
TLSH
T1DD95BF13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5e629e8fa1b05e6fa6fe70627a821068e3c3019bc1941eed48a0776d3ed3c648
MD5 35bb83ecb45ed251d82ed6c6f8f41058
SHA1 05f8255dcf78a4ccdfafbb2053f44ef119d52c05
SHA512 aaf1fd2184c275fe339708deb0aae8969424a8a8df77816640b798c75bd0cab5313ba1ccb11c78d3ef7bda9540e45279c9baf4044af63c9c988cebaf7da41528
SSDEEP 12288:3MOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljji:3M0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1A255238EDF0911F6D0312F3C18B1D324D2D8BE21BED23ABA77A1D14ADD7578B5069886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6e5d8d7d82b02ca21d3347134331a5e91f32fc680e28c34d261f11a3ca89b1e3
MD5 9bd931305fd741028069880e76970bd7
SHA1 950d1dc191eca647c43e16befb6188d7bfa18cfc
SHA512 a4b6aebe3c0406948cbc2411e1c63e725030dd339bde4f28d2d79a271e2f5a1c24b00734a9198cbf4caa10238ce82a3bbaec9d5aff42805a2e7259e322db5dac
SSDEEP 12288:dtOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj0:dt0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19E55238EDF0911F6D0312F3C18A1E324D2D4BE21BE923ABA77A1D14ADD7478B54698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b4a28b0c869646d01bb9225f024c090fbb481c9ea93a0fc92ebd5a5214a7f0c5
MD5 17b9399824371505d551545bf0550d36
SHA1 42155b6edf86ba22cb283da2b6d8adc466fdf9ed
SHA512 e84ed58600291dfe02fc6cea1ecee9bf527824450485a126aa96616b465b96e4c1b185d8e9537187efd4db265187ad774a0784dcb0942f1fd164d11defb2dcf9
SSDEEP 12288:m3OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:m30Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T11855238EDF0911F6D0312F3C18A1D324D2D4BE21BED23ABA77A1E14ADD7578B44698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1e5b5d0bbfbbd1b49cc16f1317bc6b6f006a907ff628daada6d1053d73ce4393
MD5 f162a60e4a40dff7dac79b1b386dd6cb
SHA1 be574b5638d0a10eddad16fb14725b2ce5f6d464
SHA512 818f50075152f6e82d01b88732bda9c964b70c57d37cc2009e26c79c7ad688b102686fcdf49acccd5c6c7b456ebd4c24f835fcdf6f4a4df14e8c4839170a3be4
SSDEEP 12288:eVGOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjH:R0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T18F55234A9F0901F2D4726F3C58B2D225E3E4BD20BF723BAF7750954A8D7178A9474E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3e35eafa8eac164263e733f9f568574fe399857b9b7c5c2b2976f44ad8b99f3e
MD5 348daad1cfa47f44d7eac69e9577677e
SHA1 b1c456f0666c6607acc5704a5ba3cfa716bed14f
SHA512 512d570591a75278a992fd7ff0fca5c725c58645fb00d18636dcbdeb8cb6a0c250f6902aebac8f10a2d21f7e14bb7b7d296a132187fa736f7cac2aee1a48b1a0
SSDEEP 12288:C+OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjA:C+0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T12A55238EDF0911F6D0312F3C18A1D324D2D4BE21BED23ABA77A1E14ADD7578B44698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5c8c84e37d4102b752e66eb7de7590db8113566c2f174afc7cd9a595b2453b8c
MD5 4a6d30b1ea3f28e6dc22271b47a884ce
SHA1 25a8965214b7c26aaaebbfa489af5f137744de7e
SHA512 2efb2bcb4df5105401a8a9db7bf23dd516041e34c5b56db5da1f546b8b0bef2ea1477b700519862e60fb2dcd6f1d2bf984e255b06a660fe2221a7140edc83581
SSDEEP 12288:dpOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjF:dp0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T16755238EDF0911F6D0312F3C18A1E324D2D4BE21BED23ABA77A1D14ADD7478B5469886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b3c1db29821e093d350fcd72a97e4d5c95867ce50ef531ccd5820bd7249be030
MD5 8bdc42a3fd945f60da06157406a8141a
SHA1 461d52add2479bfe9266195d9e4dc941c81fea2b
SHA512 09c547fc9bb9d40c509796f95577b939ac4852de1e3b387c9fa9da84f3476c2056770e95d38b2626b82bf3f40fb241eb3d40232aa01e831e5251a0fb9292bcb6
SSDEEP 12288:/FOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:/F0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T12555238EDF0901F6D0312F3C18A1D324D2D8BE21BED63ABA77A1D14ADD7574B50698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 524574fe74b5743958197092538464a637241b836cb51c98ce544eaf117e34fb
MD5 91c7368a8d6c839e54ed13c96f995c77
SHA1 b173e43cede91f163cee4e944fecf6c3649180b1
SHA512 8c79b3408f5c70d5617e155cd43d09d83647e2339ea8fe1ca0f90f495e708b0279966dd8c5dce91d32ec5ebc3b1837dce3a6cb50fc7bfecca8b1bf29130f629e
SSDEEP 24576:5ZMMzFVSON0Djsf9nz4mloFQnpXUMPQDR6q79dA:5ZMMzf+DYf5zaCpXxPuR6E9dA
TLSH
T17C75F199B75018F8EC73463D88618A16D2F27C261BA0DA5F13A4366B5F333911C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 63b2f21500b58d068b49a94da51c604aeab8447110c4d8ef19d75cc9260217dd
MD5 58c2c41c03e2d52e67e0db7d320959a9
SHA1 95951ae6ad77e8c72bd8fa85ff120ef7617cc197
SHA512 c7866f65f25ac4ff8f695d23ce6861b533ba128a498175d6ddbd23cc0da1f5c52e1157040a303cb4c8774fbd8eae432bbe3470dbbd10b407a42dd35161212219
SSDEEP 12288:8wOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljja:8w0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19A55238EDF0911F6D0312F3C18A1D324D2D8BE21BED23ABA77A1D14ADD7578B40698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2c9e95c9bcb828dd9809bdee66a19e2312be6b8db65769ae11be407c6c5594eb
MD5 24f3dfe621729856e261d06670248044
SHA1 9e5d6e2bcd5d96a8f60feba145f187162ba71029
SHA512 7d7d6a30bad15df6f107712b262978e486fc277dc15b0133d829b4a5002d78995c4e875d5d75ab75bd6d8df3a386e0b8a1aee1ad8fd593fe3ce7254fe409b069
SSDEEP 12288:s0OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjX:s00Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19955238EDF0911F6D0312F3C18A1E324D3D8BE21BED23ABA77A1D14ADD7474B5469886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4c171be69a9a7f9d8545b8dac1588b2f5d274d92afb2342afc965d941eaaa7cf
MD5 b03044a168e4013ba10687cbde246568
SHA1 6526e162bcc613ea31d0d90486e1633b9a5e38f6
SHA512 c3da9b2a7a410f058a13132d542458f11cc147e749d6bab03eedda83c6afe43b50570ae48d9971ababfddfee01efe7ef06cca416192825e8a86a5a99fc74fac8
SSDEEP 24576:Szyx0Djsf9nz4mloFQnpXUMPQDR6q79dA:SlDYf5zaCpXxPuR6E9dA
TLSH
T1E265024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 20a025c3fb0888378a95d8089d775e56bcf24f3d2ba8c2ca625a807c432dcfbf
MD5 a2b5e8c2c458cda8c2465497bc286518
SHA1 19c2bbd621ee9e1446bad3ae842dc8f473b87a23
SHA512 cf6be399f1b5c8f267d5eb1f75ee177f1ec18866dedc64a86b3837ab2dc33634f5a8a2552319118162f2c4df783222f87720be5d05a5cd23666dc04e54003006
SSDEEP 12288:RwOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjW:Rw0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1ED55238EDF0911F6D0312F3C18A1D324D2D8BE21BED23ABA77A1D14ADD7578B44698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7cbcde2ee91882e48f1f86f8c65fce03fbeb1f06cf587a1558169e3af47d74e3
MD5 50ce7c3c179d677f69ac0ba11ba7426c
SHA1 6ce69f9a6384c79cb32a0b9c9da0e5e8cb4f02d8
SHA512 e0d7d65389b70bedab26e0645448cea08219928b7a37c8b882b3efed51ef92fce2ade583a4824ff6d6e85c7adf749948fb2b637478ccb4ca4bb6c9ae484db73b
SSDEEP 12288:EwOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjW:Ew0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1D755238EDF0911F6D0312F3C18A1D324D2D8BE21BED23ABA77A1D14ADD7578B44698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0f9212531b3de935e3dd6618a73be59de5b3a260f26b806f8c58dae819ad58e5
MD5 be5790c2e67f83af4a9c88c8d2ad21d8
SHA1 8f6f94828f0c0ededcc64e61415f6243e1a9156e
SHA512 b88df62eb408ebcf155556e05ddc820b810a08584d45db78cb0698eae1dbc7d992c123d1ba2c057e5b2dfd8a8bdefa8b4e7a4079b22a1ec0f9b591a356b9d9bb
SSDEEP 24576:azyx0Djsf9nz4mloFQnpXUMPQDR6q79dA:alDYf5zaCpXxPuR6E9dA
TLSH
T1B565024BBB5530F9D032563C88A25611F3B1BC325B606BAF27A0477A5E337819D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2bbd12154c61821182641e618059c1586da1585c176a55d5ef38dcde0f14df1e
MD5 0bcc730ba99b718460573398c4f60641
SHA1 a034edb718ee24e7848fc2fd042b3ecee8793101
SHA512 734e6ae1f83c75e30aa4fa0a26b7f9a13bc8d23a9e6a772613a13c939c112b67721dbd941a60fd882c2722e642d6e74e1feb2bcfc8cb831d6490f068425b907a
SSDEEP 24576:/T9aLl3z0zDH0Djsf9nz4mloFQnpXUMPQDR6q79dA:/TQLlj9DYf5zaCpXxPuR6E9dA
TLSH
T18675F199B75018F8EC73463D88618616D2F27C261BB0DA5F13A4366B5F333911C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 690d321480129e9aab842a650fdf0ecbf3f07ffa8b42101725468e01577a5869
MD5 9c17fa3c0ef044e4c911e9005ab24202
SHA1 17ba66c18a557b69255ce8a35028f36aef7d881e
SHA512 c03e54306a846526209daa10ffb321af11923fd808668f3b8c170f540e1c77da959a4cd403835fc6023da8ba8ffea19b84313acf5ec01179374f99b71efb90f1
SSDEEP 24576:C3td9CHKy7GZD0Djsf9nz4mloFQnpXUMPQDR6q79dA:ktd9CHKya+DYf5zaCpXxPuR6E9dA
TLSH
T11885CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b53e7a0c7139b7f24b16923473ba7ac93847a5e770ebbf20134167e5e5b08dbe
MD5 44bc3090370643f9af138d96bc6241eb
SHA1 79b82d07a01d8abc3f7d853bb97b5c2e0227b0fc
SHA512 1ad8b9a83c4fa47420ef998a92cedb16f515390630ef5497ab85e718bedd17e0b7c2c02311015206408094975a10d9cb61adad8f5c2a8272442941431a0fa783
SSDEEP 12288:kXOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljje:kX0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T14A55238EDF0911F6D0312F3C18A1E324D2D4BE21BED23ABA77A1D14ACD7578B54698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2a42379de82e2acd001bcf5d0e831f7aec9034e410a680198ef72114ff32e9c3
MD5 564aa5e4dd494b43de117ffedbb15a5e
SHA1 ec76251db3b4fa9ba5971862fde8c00ab9fcb2b9
SHA512 956dfe0fa3227df575dde759cfd4b9d8c727d418581a98f73d84819409e31ffab267f4a41cd58a6cdee41fdb2e100b4c0cfdb1bf5ee4776c811342c2ef7cfc64
SSDEEP 12288:AROFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjI:AR0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T10855238EDF0911F6E0312F3C18B1D324D3D4BE21BEA23ABA77A1D14ACD7574B5469886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f195744a52e48b33212561277c84d8a304de62d247cf5d3b564967800b20e7ab
MD5 b2f69ab5a15cbd1d535d5d0809a8eaa6
SHA1 916c1b67ea8bb613a0fe0bfa359ffe2b10b84ed9
SHA512 23f63dd532005158861504fc636fd2836dc852af87b211c4ff24769bdfbf7d5f196317bbefe7731bec89c202e970de4e2daff2328bc32ab051b1bc97a5fd2d14
SSDEEP 12288:oKOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjE:oK0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1EF55238EDF0911F6D0312F3C18A1D324D2D8BE21BED23ABA77A1D14ADD7578B40698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d47eaa4d88d87ad8a21cdc640f273aed8b9a7ef1050ed7cad15145acf6840a46
MD5 d24717975c488a0a611cc189c4941aaf
SHA1 eaf34f8f2d77af79e9358e757fd0859d77299e50
SHA512 2bc322c729f807b652f898f2f6dee5a4a223581443bfc48d97a255625e2497e7cb06ee71299d24552803f0089aeba8dc022dcb2878bb1d022845d7220e17ddd4
SSDEEP 12288:SwOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjf:Sw0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1BD55238EDF0911F6D0312F3C18A1D324D2D8BE21BED23ABA77A1D14ADD7578B40698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 44c1201abe292aac9cd7b2c93da0fcefe1ce8171f8b045ed50ca9d6db73b7fa9
MD5 b6feadc072c7fd60e77281c96a2d8d5d
SHA1 4bb4c227bcfd92582730c4734d589dea913fed8f
SHA512 a0ef18d7f18e4c0afe63280caca417b51955722fee6b32726126d44b6a756769c119383650f53cd3130019934c958ee5b124c25ba6009f84044802285babe3a4
SSDEEP 12288:QXOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:QX0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T17755238EDF0911F6D0312F3C18A1D324D2D4BE21BED23ABA77A1E14ADD7578B44698C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7b44c51a804b44d13929fd15699e634fa07ce3c95364539249e0b68237921151
MD5 e91afb900f3ca0bf33a948d27338bf04
SHA1 91aad720880b2aaec612918923dec0e72821f031
SHA512 cd000e14ddbc7d23f68d45f9164a9c421e86aa35365cc3a98d1d8c987c38ea61ea47b58e4da9d1138b4ee63b866e8416a7a75dda106b67cf3d07310bfbcaede1
SSDEEP 24576:Gfwvok9RX6wkyAIk0Djsf9nz4mloFQnpXUMPQDR6q79dA:yMnYInDYf5zaCpXxPuR6E9dA
TLSH
T13785CF29EFC804E5E0B7923C99B3460AF2B178691B31D6CF129A53AE0E37ED45D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 80ea9fdbaf9d98daa6c31dde552a3b4dce00177d2c5f386c02ac06615ecb0fa0
MD5 2c5f02c3d62da6a87935064ea54044b7
SHA1 66708a1663f6737cf330b873da8c29876f40aaf5
SHA512 e10f7ded9f2bbd9f6516e044fcc76cb36c56f7c8e1933ff5a6545f50fc50656d64df31cc1f1d63c0206c50069b3c84fde8e64bf03760dea97991322218a57945
SSDEEP 49152:3YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oDYf5zaCpXxPX:hySzPuoDw/z
TLSH
T117066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0556d47e95e6aa86289c63867a8efc38e2e17bd6ca4d69502692a51ad89789c6
MD5 1aec7ed194d8d3a5cca9c473d13994e1
SHA1 b58a2c059b2a1b18079c23685bb0b22a6b5cc994
SHA512 a5d28266c831ab79b3ac1d5d60278ccba2d931ec1eef8e9f6a624b556bb268e00d2df9550a6a421f985ce1d75f2075f7e73e7de816028278eaa301d4290d2105
SSDEEP 24576:t47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY90Djsf9nz4mloFQnpXUMPQDR6q79d:t47JUQj4irIhCnDHUPfF/YDYf5zaCpXp
TLSH
T1C665AE1EA3EC01E5E1BA92388555861AEA71782D1F31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5c0ee0ee191b468b22c946e4f84a527a65cb800f168aa3e5b06e9b8196f393ce
MD5 80d1068dbe45bf82d1ca6ede1650c9d9
SHA1 b892efcc216a7a825c1ed659d562735a2aee1a32
SHA512 1e865b7008807fdd6e263d5f519357228bcdf8bb1bd647b42ea87a5497fc965fd770b547eb68117f753d61234443bda243e0b52c9956b39c3224197c942a9d73
SSDEEP 12288:aGsfAOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj8:WA0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T15165F14AD64802E9C07E2638CB529601F3737C219BE1A3CB67D0F57E0F766859DE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f18a56405a185c7f261a33a940d241a56722aac05b3d02dbdaa9558f5d88ae9e
MD5 69a43d399613cb54a7514d2a42fbd6fc
SHA1 2d83a1cdf2854cff0b8408341e005e50ec61eaec
SHA512 e3900f6b4c3b9713688697ddc90b47bdda613e61b32ef75e0844499ab9a86f5f18e422a437070c9d0e1be0f22fb23376b87c01e67de49db3fa87a5ae62e93e2f
SSDEEP 12288:mqeKKDK+U3fTpOwKKuM2jP4t2z9ndvuVp3:mqFKDVUPTWM2L44zdxuH
TLSH
T15F351700766AD75FC6A940325E33C2CCA7707D41EE05AF0772C9873F9576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 33d49ecf8ffe27a26f9beb2801dec1420c4bf592e8bc9ebd0cd502ff4cb010e5
MD5 ad2ff93ff3d7cf6d1d58af28dc1dbdbe
SHA1 a151c012791e68b9b31398cf71edc772ccbc0aa0
SHA512 e81d02c23d5777f0297300417bdfa49d54706cd3e29fdc319860ddde3d149591fb1c8001a28cba7ff5afdb556915cd8da3b796f32de7db7a5628573e33f526a5
SSDEEP 6144:ec476bxZWp2wFjfnIRPC3tMxgW6C3tMxzDNx4bBcSYu:ec476leqXb
TLSH
T15755E9815137A38FD1FB2032072A5B4DA7A4DC06B7056F27B3D9453AD826B66A1FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\SYS2905099913\2026-08-08_a47687ea2e6673fa3a06b00d2eefa0b2_amadey_darkgate_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 1.7MB
SHA256 b9657fd24e47a2d0025ae2b8fe169a4caf248c85cc1a11dc25241b6f61e44d55
MD5 094394805942d929c90d4985d63f8eca
SHA1 ac93c3b38e57a2715572933dbcb2a1c2892dbc5e
SHA512 bd9973831602577af7c318a986bf5bdb4d419d4ffe34c921a86c921e3bed3d06399b76d19440b10191f4eb6e0b0a9d56190f300ceebd89067e4dd18e2b59b9d3
SSDEEP 24576:s4Apb3OP1GGI8vP0kvNKBdNk2+3OlOa/03SiPDN+lqpAMedEK3D:s4gb3OP1m8vPHve/idPYuAbRz
TLSH
T1B785C30267EC0458F5F36B788A7A8841DA37BC560B34D6DF01985A5E0F63BC18D7AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6ffdae97521b65caa0ad2f75cf45a175cd191d7217ecf30754b72a900fa6528f
MD5 e22cb8e7ee9db010b8e083eb98067e8b
SHA1 e64d756645422ce6cd02805a4c75d3b3165b5bcf
SHA512 e80817b97bd3763b8316c2a52f8803f2478664baa9f604fbc53d9e232fa5128ed0bfd18368a6b33f6d109d2ac2c75407667b3c46e22f96b5e9ba0ba516e595b1
SSDEEP 12288:Wz74OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjA:040Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19255234ACF0951B6E4712F3C14A6D234E398BE206F907AEBB751928ADC707CA8C75947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aaa37a8250dcf9b2a010eff3785bd1133f441760e7a8e2cdb9d9e00c1d0b7541
MD5 a1cd9afd3e491bb84069790105d120d9
SHA1 fc7e05644a4a28b0b55b8ea3a2bc9ab1f22d17cc
SHA512 cc5c223637bb292ee34aee87e8b79ab24d167d69bcca6526042513fe82a77f075537f08ce4952b218eed5e8ab07222730f15f2783764b5e09d1f1564d345e9d8
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYS0Djsf9nz4mloFQnpXUMPQDR6q79dA:ugb4mBIBhGFSDYf5zaCpXxPuR6E9dA
TLSH
T12565AE1E22EC02F5E0F6E3B89DA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 215d311a9a38bd200d9582e2c94a84ddf7b36f60f337c5746d45ff9865b4212e
MD5 bb927ab1d0ff1ff0d9730685ae2d45c9
SHA1 c9f18b9765270911d19215da61939eac7dcde123
SHA512 f554b99b26cf8e5a6256e871f828ab1e9a0958771e3634566ce3c038944ecba6e1540ec169645c04e8d9809998adc0e33c9f68e511ff2b980e060f8558ed7f01
SSDEEP 24576:SG88u8FpJqH1Wzria7/mN0Djsf9nz4mloFQnpXUMPQDR6q79dA:J7ZFPqVha7/1DYf5zaCpXxPuR6E9dA
TLSH
T19085F165ABE101F1D477913889828663F6B1B8211360FFEF07A88A551F33BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2491c18e3d470dbadb2cb822ecc8eac37cbed03761aacef557febf3a6035e04d
MD5 ceee269e2301aac8ecfb4ac346d1c8fe
SHA1 e31f8e03497d75b0cdfd8e0b20e84d48a915352b
SHA512 a5ec18f48205141e479af2db3a091f74d1b006c2add75fac6226c718d20fee1acd9abf2b372d77083dc051e7d9435709c7056c5a956cfa2ae597b1721428e189
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjODYf5zaCpXxPuR6E8:LG05lO43bLoDw/z
TLSH
T1B9D5BF6E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb0230a16005c7e6e67839637cee2ce9b8e1a911dbd7599c2b980be949506efe
MD5 021aa248a7fe5eb26eef04649dd64c6e
SHA1 50e2bcc4cca67364c631b038913d5789079947e0
SHA512 e4f1395ad1fa71ee02f4ab4e0a6c9a5fc0ad390f65d41e82aae61a5bcaf2596c65e6e64495d0bb7ae8ce48a7e90cb5babcbafbc69f9b884a76e82a661b0d0857
SSDEEP 24576:Efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnb0Djsf9nz4mloFQnpXUMPQDR6q78:ca5POZ39Jt2pasx2+mWDYf5zaCpXxPuC
TLSH
T1B265AF5EA7EC01D5D5B5D17CC583861AE5B1342253329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 61161d89eed3a2efacf93bda5ce69a79aa6d70ea89cf2f770ee41b0542e8bf77
MD5 1fdf89b3c687d0ef5f2b4142e57fde49
SHA1 178c12308ea4ef4bfd4318b439c3daa653598c60
SHA512 57e7c86aa3528686b970fc7331c7cfba8e5218c16448d71196dd8d1912296ce54348d8b79874d35d3ce2796a7918f933e67080db79af41fbbfe36ffffe4572df
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkV0Djsf9nz4mloFQnpXUMPQDR6q79dA:ONc/zEOVHFVDYf5zaCpXxPuR6E9dA
TLSH
T174858C1623E901E4F1B7E1BE89779646FAB1786517309ACF0291811F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 35de22793e8f6d4e1eb3afb8ebbeea2e960b0fecfe2d0a716dfa86ff9748a1f6
MD5 255ac27a3654e737dc0d0b492f678aa9
SHA1 33faf1f28181fc8df27b89e8254a00bb4ebc0faa
SHA512 e00c0453e6c3b3cbaaafd45a987d84c1de7a26abc92152d5aaebc610056c363986c9598552497b9f1602a7f0338fe568d43123f417877ad5acf85d91d1bc1e98
SSDEEP 24576:4tkNvNnaFeYhJNtmZBmN0Djsf9nz4mloFQnpXUMPQDR6q79dA:4tMwBtOmiDYf5zaCpXxPuR6E9dA
TLSH
T1CB55AF6EBBB806E4D1FACA748D238112E6727861173253CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ce5b2e1e04fef031662570fcbf7f1c45ae215097714d0eb5fbe571dbe63ceef3
MD5 f7cf400a362e8ead99b988b1e8b28e8b
SHA1 8a4aa8bafa1b2acd644d8ac01e072ca05fa358a7
SHA512 4f29e44599817750c399d7830c1df63924e677f254b8adbeee2d3231ae518ef58462fa7eb85535b3d88381d2ee63d6f58223b938b3e0c91d6cadc795240cf567
SSDEEP 24576:jPUr+NQZ0Djsf9nz4mloFQnpXUMPQDR6q79dA:jJQ+DYf5zaCpXxPuR6E9dA
TLSH
T1E565E11F669C18F5E676A13C89828319F771B8621712A6DF02E0817E4E77ED8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 18e60c0589af31927fb76b26f7db8730ac58ee3a615e9ece864e8aa9a38ed60c
MD5 0ba709ecbcbdf17bec1d4453ee016277
SHA1 e03bdf31dbada2add28a0311a2face2d42fa912f
SHA512 c3fb904a1297d251b2c6860885e4339d2316e78c7ed434edabb5ab5cc4cf0f7dbf9d31f74e180061bd91fff06b92f58c202bb8722c419665de94176cee872e70
SSDEEP 24576:TD3FHshBIYQgAs0Djsf9nz4mloFQnpXUMPQDR6q79dA:TDVHeBIAAPDYf5zaCpXxPuR6E9dA
TLSH
T14475E17EEB5C00E4E476D27C99638606E7B138A9072266DB12D0C1BA5F6BFD46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/256-68-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/256-212-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/256-61-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/472-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/472-319-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/472-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/472-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/472-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/472-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2324-318-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2324-121-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2324-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2324-128-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2668-90-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2668-84-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/2668-301-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2668-89-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2716-46-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2716-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-59-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2736-275-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2736-74-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2736-72-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2736-80-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2892-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2892-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2892-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2892-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2892-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3052-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3296-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3296-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4168-0-0x0000000000400000-0x00000000007B6000-memory.dmp

Download

memory/4168-28-0x0000000000400000-0x00000000007B6000-memory.dmp

Download

memory/4168-10-0x0000000000E70000-0x0000000000ED6000-memory.dmp

Download

memory/4168-2-0x0000000000E70000-0x0000000000ED6000-memory.dmp

Download

memory/4828-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4828-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4828-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4828-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5368-334-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5368-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5368-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5368-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5368-101-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5368-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download