9940b0863a7186005c0c58da10b4525d526317eca9d084201896a11c4d840a4a

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 4.2MB
Sample260819-2mgcxaaa53
SHA256 9940b0863a7186005c0c58da10b4525d526317eca9d084201896a11c4d840a4a
MD5 6fde67085c574d7bd463e39b9fd5666f
SHA1 a6d20fd47372a6804fc2cc6263a48330a4d2ef8c
SHA512 fa4fcc3c03cb2f3613c5b682fb0faf24c7a5cb86d844e6dec4c04ae6d51ca348be4edc466b7d1c92db2677c33660a2d92c51c95d75583aeffd1f76cc5850565e
SSDEEP 49152:rcZ4L6At8gMEB1eam1BJQoaUPa212gRd0LioaO2P3rdDB/c5KgGRQDYqILNiXico:TBoaSaEKiM2wKgsWi7wRGpj3
TLSH
T11B162B22F7520DB2C98340B0CD7A6B76CB5AEC780BF107B37772561EA4796C13525B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6028	elevation_service.exe
3832	elevation_service.exe
4024	maintenanceservice.exe
1048	OSE.EXE
4452	PerceptionSimulationService.exe
1328	perfhost.exe
5020	ReFsDedupSvc.exe
5296	SensorDataService.exe
6136	ssh-agent.exe
2440	AgentService.exe
3200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2936ff7238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000331d2bf42b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ba67a372c30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a8169f42b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f47595372c30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076c5a0f52b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003856d9f32b30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bd34a8f52b30dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe
3832	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5920	2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	6028	elevation_service.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2440	AgentService.exe
Token: 33	3200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3200	SearchIndexer.exe
Token: SeDebugPrivilege	6028	elevation_service.exe
Token: SeDebugPrivilege	3832	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1520	3200	SearchIndexer.exe	100
PID 3200 wrote to memory of 5144	3200	SearchIndexer.exe	101
PID 3200 wrote to memory of 920	3200	SearchIndexer.exe	102
PID 3200 wrote to memory of 5924	3200	SearchIndexer.exe	103
PID 3200 wrote to memory of 1104	3200	SearchIndexer.exe	105
PID 3200 wrote to memory of 4368	3200	SearchIndexer.exe	106
PID 3200 wrote to memory of 4740	3200	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6fde67085c574d7bd463e39b9fd5666f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4024

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 979d04d6a1d31ad4c2d43893d81c2daa667551a13a71fbcecd55dcfbb9d666a1
MD5 591fd1776e8e71b73d56271c59abaa2e
SHA1 cc706270c0ef7ed134d25532f7d2098301d918c6
SHA512 1d7b703d95cb71dd45c4bac43a69f8ebfa550c60026e05ed4b23afe3d1274901813f3c015c14082b8c73a2a3759ff0fb15126dd4e1eae0d3980f3b16d067bae7
SSDEEP 49152:qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjLNiXicJFFRGNzj3:c3q6mjB07wRGpj3
TLSH
T143D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9b6661da22ff7c954579abba3f8cecaf5c08a0cb56742646693b6b5527a99b0b
MD5 1fd710cd3ef2fb5b5b613839353c79ff
SHA1 a21110a3200443ca984f7c9d2f8ea5bad7587be6
SHA512 5bcf558224c1eda69cc7df021b4e6fcacced7a349e05d0b399a729ec51157e9190b38a0a2cb9a5fea22b354433d8a4f34b4ddc51f5e4bb79f0e3d0b58be896f0
SSDEEP 24576:nXYfDtczAG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytc3LNiXicJFFRGNzj3
TLSH
T1DC75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5740e2e530390f25ff8c579dd3464b56e47ab416c8cf23a8509d9345b621bb48
MD5 3205debe30cf1f54a200966c9d6b434f
SHA1 7dbc3476bc3a745a4c73aa855b782a58da7f36a4
SHA512 1c995b30499d2b6a3f2ed18f39447a47377441de52b9f495114863647a94c2ae064455194ad447b2071467cdd9b97a729657f9b32ab3ecefeb02b5ec44b55667
SSDEEP 24576:u0Le5ji0hmxhrMh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uPji0AzQLNiXicJFFRGNzj3
TLSH
T19D85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a5f3ef5653856b34a890a4a07b612d104566cc20c1bc1998f270dbbcadd5e9c3
MD5 41ab4a9926d79fb2d52f87f5e40bd90b
SHA1 d1cf178a457d8386755cfab92c5f465789b60520
SHA512 9e35c6faea2915a0ba3bbf46527760e6e3335ddbcab34566b297d79da44cbb0f2851957cfd4766c3fdb06aac1ffbd017d4acd8c773b71a9594490e0c61d27994
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t/ezSC6vUzPv+HjyELNiXicJFFRGNzj3
TLSH
T137756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 882bae9e52eb3f421423f968f1486ffbe1e0aecd8f07ff2b0981f031e32ce7d8
MD5 bd8f372e36e5229c6305d6ec3a6162a8
SHA1 0fe3584b90e8144a886a2fb2571fd6a4b3cf30a3
SHA512 c077a3f230d279d749e2182e2a48ca87ab998abc29d83a3caaf25f9b1eacdf313c4796aea3c2be68f8125c8396861351ad71a50be0ff3ddd9a1bb4f3ee27891f
SSDEEP 24576:QVbqPb88hv/l+BS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVO88hXl+wLNiXicJFFRGNzj3
TLSH
T13C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1e090ff9b328bf36df5be63a09f03599beee5ac1f30c6e436aeccb2f2da6e4dd
MD5 a889468e93a48bc6fdd40260e2d0a0a6
SHA1 9053eafc2bc663af4c13557cf5641f9096c276a3
SHA512 cdc83d0b4f129f5d5de9b4360e9d2e2ebf94684c789c54d9364e72b7deb07d570706c0f904fc6bbbcffbfd646ccfca104fa855bf6edb371692aea832b4218a25
SSDEEP 24576:LGt/TwSfVcYG3K/cJHlnFR+IGNe8j3Izo:ELNiXicJFFRGNzj3
TLSH
T1DB5523D3468854F1FBFD003A867A5828B5845E2C8A595DE2D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7b0420b3b6ab7ff91464e44b4bdf724a6bd91708ed69e6f2b4c6abe70b9b2de1
MD5 30e87dd485dc11fa6f43a32703219109
SHA1 aa16109a4c831c959af4d15fdc6e8d1416c145c4
SHA512 f54d9496657a0a4392682956d78c59be6d17d87264db7a34f2814d259ae8590a9da440cb89185ee96a1cef3c2b242336325d75bb9075a9aba2b0565b9ad90265
SSDEEP 24576:8JIUK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JIUKLNiXicJFFRGNzj3
TLSH
T16E75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 09969cb7e603b2681d64b3042f0713c18456e41717ae18d53deb01ad8472d78d
MD5 e8fcf49a20e73d4dfd8c54fa713c4944
SHA1 34481a17599a7c340d457d9242201dfa139fdb5d
SHA512 643023e477872aa2eab38221043dcdb54190b5ae6eeae4d43c2bf3e871c1f4accc80940e895405b943d0567d48cfb6223966c18dc5d044a661dd4f12e30e4776
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH0:cQvGAdlCEL8c/WRNw5CX7wRGpj3
TLSH
T160266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 11ab13e933044cbcc5d35e3c4524c72e755277997e0a081c8937ef307d201c8a
MD5 7929fc64795b7305fded91204fb6d2e8
SHA1 76321c67cae3b8be92c96f06f23cc9e4e9bf3bbe
SHA512 882bd75573433b4c628763d04a5948a1e199ead4da4a87623a0526923cdd8eeb199310ce06389208f1f01dc4b841e8c52712a5a262076b1bf6da3d2c90e3f1de
SSDEEP 24576:GfewsAjg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz+:0ljgLNiXicJFFRGNzj3
TLSH
T1E275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 475d625b9f23b92c7d4194b99bcefa80df4cd792d5418bd21bdded860e85bcca
MD5 c11d223c50ba2da5370a673826b401e2
SHA1 ec0ae66cc59855159edf4d1e0a32a872283cea66
SHA512 62c0d2ba249b51fee0f223f12f72dd21a1dea96cbf655857032bf9b054e6a6d6dd5497123ca377e42104c580d82f11f502884172da177e3c8bc14f80ed660a50
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH0F9:IUEtQevvqc2W1cpV20I32o9
TLSH
T107474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c8d3c0e18a4768a9b1fba43057cd8974d5404631407d36be046269b7c1d5c703
MD5 4b9ac7fddb8d730fc0887fd83f132fd7
SHA1 5491cbc2933779c7f69575fb822032a346f86541
SHA512 f4440dd96a2e6258a6fb743ffac088dbe56a5f039d9cbf95edf7db9be2703979b545457552850992750a7b855201472c380c85394a35a4976b1e05ff566a3a37
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/zALNiXicJFFRGNzj3:Doq2Vjnmb7wRGpj3
TLSH
T1D9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3017e21fd75ffa7a117072f89975a66c3a1f6aeac0462f81c42d0c9bf31179fd
MD5 bcccdcfa0454ac75d7da77396cf71689
SHA1 bd78e21a34be2f199e1918bacb2051a09cf32fe2
SHA512 5cf157dea66b50b98988f40292721c6a423e3e6224d5604d1a070e8398a59872ceadda2a3ebe6d67b00f6d73103ef0b1eccd789832d451d2fdfe3f431a05138c
SSDEEP 24576:HAhGL6IFoiwtA5l7S537/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HAM5Foiq5rLNiXicJFFRGNzj3
TLSH
T1E5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2220b5c4882390653501b5b2b5360928f3354db8093eae22474505249380c4f1
MD5 a0342234618e71f6299a958c401528b5
SHA1 8cfebc02abcba2d480dae67ee7e0a269a7fca232
SHA512 ea312a3455a29351ec08aac9d0029153da4df4f88f3155cf0f185aa1488adda7e2f370d7f89af72e29a02a84c5f62a9da269c51bddbce9753f1f86696e484a7c
SSDEEP 24576:dwuROWk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwSOfLNiXicJFFRGNzj3
TLSH
T1A565F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7090f628a8ac804b7ca07596bf8143e30becd2372e2fe2da14c7e6086473e318
MD5 d3cb7daedaa972e6888004166c92ef1d
SHA1 dca7817ae956469bfe2b5b218c12efb292187a81
SHA512 76d488e604abed4c6e770584894cfa76f2de603a80fe5565b0a41e26c39dce2cf841665c5105d886786f9e0463dc02634e018b3fed10f64708d749329bf2afc0
SSDEEP 24576:sZu5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TLNiXicJFFRGNzj3
TLSH
T1C355129622C420F5E6BB003DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7f9c236b980e1118ec9eb141224f675fc20f5295dbac3b2bf6d397e3f424bc10
MD5 4a82ab1eff35e0f2536daf25b5e77fde
SHA1 7be00c931a8162ca2d9076bc6aa97bfa467f0709
SHA512 67eb33812f5988b612648388f425457cdd27527358763fc0963eafa778a30dca5c618b149855b408d708de2423d573c55f7cfa465c2be24e6e299c47cf2abb23
SSDEEP 98304:3QRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:mQyiKanX+PNCF9
TLSH
T1CF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6cc0cb1c7c25aa9aa1ede2e943c23000d687a8dee35fbe94ac5da90078601fdc
MD5 d7f63a04a40e46d4d39d06e8cc95cc51
SHA1 63e42b30f99e1de401cfaa80b4d8da0048e85c67
SHA512 a3cbcad1d877a45125bfa2bc5ddb8645111520b0076fee0b16a15ca170ca6bab81cf95ddde250edfe7e9f7265b80a657294caf6ac95fb000eeccc193ce9161aa
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:nQyiKanX+PNCF9
TLSH
T11D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c3868c53640c3983aab3e712c25ff45ae96924cee7b9d979be86a4d1278f65a6
MD5 0eeb396fa2a2ee775b017d9e208352fe
SHA1 def33d6d0fb013780969439f9924096f245fb0f7
SHA512 58e8db37c02d34b995d7542f5254ca93bd658f0aaf5046ab393f674ad3068f709e017ecb22df673789c0a3cb4e88b85ae33d60cced98eb9c4066303b6ca3098d
SSDEEP 49152:k68Qg55nhkeWu7PNU3/QLNiXicJFFRGNzj3:OthTRc/Q7wRGpj3
TLSH
T1EDB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b30217e333c9d223759aa2f19f2448648480c820e3a2574f84e2d606a55dce0
MD5 76d647b27a81e3ee9055a5af24b3c42b
SHA1 22db13fb60c2793f55f564d288cdd07ca6c84843
SHA512 00dabd5b37632e7a14d4308f33dbfb7ac1b95a28ce9b2f658c56e142154ae1a5e390a09c313c0a27f72f26bca4dbe6878161cc2dabe8dbe115c5653727b39d2a
SSDEEP 98304:qy5112gYy5azzVvU69nLKnhZt7wRGpj3:TLIHRWh3F9
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2933e85bbdb331723965d6cd8f1f7746349917ba6e33c690a52de355a7640f74
MD5 a0b4c8a82ec23c8446982164b168abba
SHA1 7f7e3c1255b6f22391b7540810d3e04812936729
SHA512 a53130251013f71358196aef1e9e4635bcc460c76e354ce5be01c26acd9a533dfcbc0409fdc8ff531e45f3f026a90112331e5a30d28c3447fa961e403964f513
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl4LNiXicJFFRGNzj3:su6JmIxd2d47wRGpj3
TLSH
T170D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d88f74cf1a7aaae6c7356d23bea82ad2d9d8f1f64b337899d60b2af3b85e55ad
MD5 9cd9fc3775532e869eff8edfdc78ed45
SHA1 e250d56784bb92e3c83333a6ec13294907061090
SHA512 50264e065fb057c30c8a08b6529423d93fc3ca2d040c92f6bee3ece8b1c338eb044d00a0180b9d5d2e30bfd2398cfadc79dd226e90b8a02fd20278cd4678a168
SSDEEP 49152:T1hpsNoJpF1A67U44CwH7R4xqLNiXicJFFRGNzj3:TmifPqRb7wRGpj3
TLSH
T19AB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b6df9daa90836c1a58807a2c646596df6f6d017769c094ac19ecd2b27b7ec6d8
MD5 614002a71b39a2c8c3bdbaab3bba151d
SHA1 b415c336c8f2cf57ed0afc4eac9871bcddd1bdb7
SHA512 174d31905744e922494259632745f1b1865ae816b3080d11f0a5fd5fa67a6f5643619d634bc97bf33cfe66ff4d4dce82635cf915d5c299e300f8faf1e710f973
SSDEEP 49152:cSuZQIY0Be2KkRVtOnks6NMHq5LNiXicJFFRGNzj3:e5dKqi6157wRGpj3
TLSH
T1C1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32798b85bc6479fd3790e5e6660927b0211a4854c9422def0aed3b5a8ddca256
MD5 439f42bfbed8386ad9f686d8cb79883b
SHA1 c098635687882d9f19615af69b103115c555ad21
SHA512 837b024ae4582a243baffc3e8cd7c4fdfb2e09b491cb5163a4260b441580ac3c1329fac7a6406ea22bf547178ce84637ea206531f32d3b9baf6bb6b84479f90f
SSDEEP 49152:PhtSn8EApI0figjgiDn0AP5wGLNiXicJFFRGNzj3:eX2iWph/7wRGpj3
TLSH
T16F95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e4ff6eaec9dd887a760266c3c04fc966de54f964ab0606e2b3d11e165273fafe
MD5 2c48dbd8c9ad03ba03f66cfd6113384e
SHA1 05689a2a6a6f7a3feca5570e1158611190b2eeb7
SHA512 0769037d822b6592caac9a72dde7e8445c259f95ef585195e41d0b2ff132c7b517180860eeeef871840d6b63d15ce27bc54621f48a2f07a920bed15a2ce9fc7f
SSDEEP 12288:YZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12D5523D3558955B1EBBC0039C6754428F5882E2DEB5618E3E348391EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a92863ac1cc52f1efd6b5eeb85dc5c25254d99c1d00024c8162409fb1184781e
MD5 a75f92749d2e4733021dd502d804f7e3
SHA1 5fb0670276630b94866f325ed4980adfa820bd62
SHA512 e6064961cf056a6be0294e0b3577e45c58d88f2fb71956f9cdbb5cd6abf2dddbb49dd8dc08e8aabe0b7aaff16e344c6e7e71afe2c986ca3496f3001f50549149
SSDEEP 12288:vKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11C5523D3558955B1EBBC003A86754428F5881E2DEB5619E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2888d21883dd8ec1cc25215f694952fdac630e8742ab2f4011dd0a154f989353
MD5 dd915741da4381ae6a33719a015e1264
SHA1 9ef78c79762f3872f10601cffd7d8074603f04d9
SHA512 015e7522eac43426d93f20e40bb31062486c31c311f680ab9d3d0f8d1fd9d7452452634b05cb315ed36377cb19d1f88487c27ff39bdeaf92df0a1a0e4a1f85dc
SSDEEP 12288:tQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D2558955B1EBFC003A86754428F5881E2DEB5619E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 db897a7c9ed3cf053180ac47c580dd83dc7342560ac6596741b88f4778bc0ce7
MD5 f7620761ae7479f0ae574c0aef5f345a
SHA1 cb16b660f560334b883dc93a70260810f26ce933
SHA512 cf3ca559f0109d839682cecfe492c73b7da99d32a130cb777be1d8fcdc969a2ba7e7a8b6d0f3845881c862758cdb75eed6dcee960734a16670764fa67cf081d5
SSDEEP 12288:EVviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C7552392168901F1EABD803DC6764424F2947D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eb7ad5ead35e36c6346eb8024449239af97980e1d53d8ece39fdbed4aab67d14
MD5 09c0c916de094216ae929ea842622b0a
SHA1 d89d263089383b59491abd9fdc71e67990caca73
SHA512 be8a2aa073c46a564944a3a5d457a9bb93b78ee6985e7170afbd038b3b658d3c52d985f6631146526911ad5e085ea6afe43aa1107ccbe58c071c351aca27490b
SSDEEP 12288:JXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3558955B1EBBC0039C6364428F5881E2DEB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0109954ac963c24b874884b6fde3ab936c1d13ca8ceb0f18e2c7fb18a231de61
MD5 c59054abd4bc22efa17e81ed4d7e07a3
SHA1 d0fce965d7f2f53bfbf30b89a7415bfd8bf6411a
SHA512 97c8132c243303d2135dd1ebc08eef41aafe917c46bee6aa510ea95830074514e3b1fc08e0b010bfeb773d32e9d48d1b41c83d539c2c7fe2eedb124430103395
SSDEEP 12288:DOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:D4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D2558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 457c82f167cdc0c7e2c778446be3dbf580f8b0191f2ffaa7915c3bafda04311b
MD5 182f222a2f5752581712f56a95b4aa1a
SHA1 59e05fac816890ab626cf5f31ba73e8cb0855bb5
SHA512 96e980f39af38092f8692aa9d035b0cd184a82d102620ef29d11475430e3ea6435c137b92a45aa5e0598cad214c17e023f5ca6ace70f25c9a408a31c673b3275
SSDEEP 12288:lyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D2558955B1EBBC0039C6354428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a3d5fef5ab261e00fa00287e302cc994de181147270629110539a5a2a17bbf3c
MD5 b198497199d25f472a458d5e7e47bd08
SHA1 a188044006ccb61418d91e5afb93400fed64de78
SHA512 f57039cc16c422c7f9b88f2ced3368558ba593481f9538345001a22f15939586132641c281be0f7f55bfcddaa7112d1a63c86431fdede689ba112a48d82b0bd2
SSDEEP 24576:RZM3zFVSOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RZM3zfILNiXicJFFRGNzj3
TLSH
T174750295B39018F4EDB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1bf1a164e0a2e99e2ffdc557d108a64ef9ba99fd67e85937adfd27f0cc0c3dc9
MD5 4342f92be113d210b85e33212079d8ef
SHA1 f6149f3120327eac93d2254418bf1eba4ec4bbdd
SHA512 1213934ffdccd185a93c8b872782d09a2faf33079c7305664b2e6c7d67397beefc7229a90ace10d27692c23884709a6cf8da4f0b7607e1a6e1cc2597a4a0c370
SSDEEP 12288:cFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E05523D3558955B1EBBC003DC6754428F5882E2DEB5619E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ac9cb58f420f5c80dab36c8faa34081a6f0b9fbdfacf9ed476104e9c260b9413
MD5 d7b9eaf0d151798172a5323ab1083c56
SHA1 3ecf04fdb05835bab218f608569e5543fec186ef
SHA512 3543220a4fd4ca36138e4d13e67967e095c40b6d8794a40fc79b54aa4f7cab2db304a53a6e1eb0a2590d82e3c17ef48686f0af2fa0553d360f5b4489b2b6ce99
SSDEEP 12288:lxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558955B1EBBC003986754428F5882E2DEB5619E3E3483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f7461032a92e4ff367f7ad91d1d1abd1b0313aee3c92563bfa0e8ff86e8f501b
MD5 c872a7bc5fdc514559462afd17dddcac
SHA1 ba980f4b2e08c809c974a6fa2905bd778a7ffc8d
SHA512 9914e2ff4d562a26d8070b0298407eea89b1e4de823fb7467e289ab641a1768d61c45872d4e1fa2df63e9b4df0557f4486804c1bbbca401999ef1682a9ffd27b
SSDEEP 24576:fzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f/LNiXicJFFRGNzj3
TLSH
T14C650147629530F9D17A4139C9620911F3B17C364B208AEF53642B7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 05a7dc0c8399aa24b0d27cf6ca6dd8cf2c8ab23da12ab70d8a861919cf87202a
MD5 a500557f26e74f56390798a24d1d5f70
SHA1 984f78b3fd7bf9c1c3861ad3e1d337cfc9bc6bc0
SHA512 fdd7a5ba3364394a5e717ffef35fb64a57b51a4350c8afd19424e14744e78431f75e36fd9fcda3a1c330914e4f4e5cb0518958d0a7364b2ba05c8ee2d00372a1
SSDEEP 12288:3FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fa3974621f8373b1de8c8b3a0e1f99b03d19a6a9711c10438929b90a7d777b66
MD5 7e054c509831a3db8fe930044fc17cf1
SHA1 85a0309e88c772b7bb1ea2f80a311a214924f39e
SHA512 4fe9fe66acad75c131f97a18ddb548511db458f56581bf2b415b0f8b47ecec4f4ef2e03ac094d513db83dc943053a87c31da887f80c905adcfa7ec29613a50ce
SSDEEP 12288:yFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f8683d19a51d576c39120d90f77684ae2c7cdf581809ca61501d2ed1c83fe436
MD5 3e838d3e0ded9e5802128c7949197901
SHA1 05e473ce1f7b71aabb94555fec09571da806af31
SHA512 6f4865374d61abdd76f1bf92aa501028bec0bebda30facafca4b7b588efc83b6d5b6084be38e79ce926b9853da91ce2982d50fa08b53e0982f3cdf34a4badea1
SSDEEP 24576:Gzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G/LNiXicJFFRGNzj3
TLSH
T15D650147629530F9D17A4139C9620911F3B17C364B208AEF53642B7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8f455bff38e9b4d36aef1c51f6619fab2436d5e30480d0ce19d3ee8b95790bfb
MD5 d9677400f9d10c0851a00bd8deed244f
SHA1 fefbb30ab8dc0bdf37517e6b78d311b2d9455123
SHA512 387cf9b5ad57bff340ee5d9b2c4c1e650625a633b972e20edcaff2d8a955e37130493652a52eb2ec23bdb2e377cb9ced8e7f2f980b610edbd4dc894a331cd352
SSDEEP 24576:RT8aLl3z0zDy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RT7LljHLNiXicJFFRGNzj3
TLSH
T1A97502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 bb915898a78956207e25b9228b669a3274167130dee75cd69c9484ad4441e44b
MD5 b550dcaa9a6e836b7484c8c709935f37
SHA1 e97a246d9570f1d2133de08f0b3769fedd26413d
SHA512 6a9a0446c1354d8c0e52f9e69e0b509653d4fc4253d203c00c2ac6a8ddc8c76eedcd53b41fc29523984a96772a8b02200967981bd980052fcc92e56d97d1ecbe
SSDEEP 24576:t3rd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Nrd9CHKyaILNiXicJFFRGNzj3
TLSH
T18D85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2abd54060dbdb498c4feaf33846ba3ed9e16de0a8e1a7913a7ce2fcce350fb8c
MD5 0e71e42348ceed76e10e747547609413
SHA1 7cc29f995ff1468909343165666269808deb940a
SHA512 bfc582480934b5767b74df79e5a8c90e60eecef493a7cdd48ac80b8bfa1f03255af2949e391d4d357d650249424c6b4fe2c7b03dec80a765baa41b40e4a8ee82
SSDEEP 12288:ewiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ei/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D2558955B1EBBC003AC6354428F5881E2DEB5619E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6c2d729380942b65630e66d49215c17a6b3a63c5c9c2fb211c997bf9a7778295
MD5 aae3d61e31f833d238510490cab72d8c
SHA1 5a0093d5f195aaf24b88d7610cf119d8b66e9c42
SHA512 53c3b2a80a344c89bd3d98b1cc164492ef5b58e11707c9ddde31feb2e5cdf9d1a4e0b3168936517e2dab03cb017aadb36fdef592fb7b23b55cf327957e70bb93
SSDEEP 12288:xmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D2558955F1FABC003986794428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 48248794bc529842d9a88fe03242673334e4f8259e469733557399eaa02daf49
MD5 001c19e3a60b65a7b3a81e4968e2f560
SHA1 33e4c3ba32b6eb402076005765e843f0fa4e0754
SHA512 41966475fee0cb1c42d70a1d022ce167dda4b9a1af3e9affb29e542a69c286895244cdef08130d6342c46cfbb599bea5b6328d951362d519bceb7f801ac72aab
SSDEEP 12288:gbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4eef1d265dbeeeff0b1f2bf13dfe45832894dc96356aa1deb691dd40de041eb4
MD5 b2155a31b4dbd3ce17a2b49a057e86fc
SHA1 f9d74f9d1b25804b5ba1435ed7df5bcaf850b7a2
SHA512 d86843530fac2ad25cfc5d3f8f4b319f00e35add60711352d443373149986da2efa486532f695b05fb303b09d0f32e18f33f4f9e47f5b5f923af1a6ef847b181
SSDEEP 12288:pFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3558955B1EBBC003986754428F5881E2DEB5619E3E3483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4a231266c9b238540ea6c54229cc88500fd5a1c17adaa9c392e52ad318168844
MD5 833d6fc5acfb6e0bd68cc7c749d1594a
SHA1 965eb214bc995113269bd71a98dfce7c808cfcae
SHA512 56713558f76438f67009e1f04b1f42306c531d1843529e99113157418f42a677a795707b113eed66184cd48ec888de0eb784ee54131ee0fb9f210381a8b21744
SSDEEP 12288:IwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D3558955B1EBBC003AC6754428F5881E2DEB5619E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 660454059e7744affef4bcb6827abba84a0a2790e6f3aed9bf7a65ec4c5a992d
MD5 9c31404ff9f3347373fef484d6ab455d
SHA1 6d51f8456383eeedc3c009edac115c9e0062a890
SHA512 517ba2c793f6b61b82ccc44c630d340767b7b5ca33389c11b1e5a7264f685d278153c306f4029fc7cfedd5c8ce6db285e540353e215c1d1bbef93b0989f6f97a
SSDEEP 12288:yNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523D2558955B1EBBC003AC6754428F5881E2DEB5619E3E3083D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 185ea1eaddf0dd2285eda21cb2bb82efa4275b19a27b305c6d4cdb6ea94792f1
MD5 f3e28b97091b86a75bb5cefe0d9a1f8b
SHA1 b121cf1968103560b2f680e9fe401eeb136eb427
SHA512 8b5710318fd9b441fe8cf417f3a0a0afc9ec24139f678cfc19c9a553c87f1e56281a5788ef51cf7a43d017ac424b44170983a0ad27f2b6e0b8aa859515a278f4
SSDEEP 12288:KXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D2558955B1EBBC0039C6764428F5881E2DEB5619E3E3483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 fbb0d7d8141a985913a0c352e779f9a17954bab17ccf4fb8cc7696830d73b026
MD5 bc48db9102a5289bca3abf506ce6e0a6
SHA1 e52c838f904b0402b0daaa55b4c96a2e2494c30a
SHA512 6b0ef9287bba87e18f846a02d0965519750e2e917af6099ecd30331d7dac74263939883ec20d4716f95c13891bbf3fe522a28b1e3bf4dd9ad7dfaba2ea632e9b
SSDEEP 24576:Cfwvzk9RX6wkyAIN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pMnYINLNiXicJFFRGNzj3
TLSH
T1D685DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d80d2b386cec08e1034501118d5a7faf03118a2038edb1ed9d94fb15cf0e84ef
MD5 bcdc00a48fe4a381442f7b24784261a1
SHA1 8a7e369392f01aaea31f1537e5ddb6ba4e62b1b0
SHA512 40b3923f86ebdcb601a6533349bbfc858910a25a6042e4bcf213a9f975c0d9da83f20479fb17c4bf9f5037e9e5592544195f3a81f3c5b02528ce35c48196d03f
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mLNiXicJFFRGN:mySzPe7wRGpj3
TLSH
T11D066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0566566a43858f3091e1e4ec185a43937883afe32990b113b725121c15ab42b9
MD5 6ecd980dc3709001ba97e8b74d44eec8
SHA1 5f785c69b04345887d18ef8073ebbcf6a84bfc59
SHA512 0e6a98c618f56f0470b8b56a877d8f7f5c4f12f383493c7b79daf79f18cd72d241e701f2ed91235aa22007e50bce64abcaa6fdcbbeeb99064316755b89b94327
SSDEEP 24576:B47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B47JUQjqirIhCnDHUPfF/2LNiXicJFFS
TLSH
T14465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8d661a8808025e8c557833560dc43409902efdc0701728a5957fe3335de2c262
MD5 5236c8579d2e61955f71ed057ae9e11c
SHA1 b198047ec38341576cb0703baecefb1abfde0ca5
SHA512 8ad9f21c98732164c806c297b0f8f3493ac63c8c53bfe0076f37b6744aab8891c94cd9845819294417518a344467536b808d80907cf1d84d9d4d609c744e5911
SSDEEP 12288:0psfViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C665F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB53D0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 5c48b63552ba7543891507b4da8782c417819a63b0b800d7381dc5ed1a644b26
MD5 e149e4675b113f50be5293ceb6d87a2b
SHA1 d2a4c807fab2bff2fe8035cdf620e97b37444859
SHA512 f07855344b06c2b4daf8ed3f8fc369806383ca3b19883d5e62288705f2ac1f3374585d035d06269e39cb5f535db0712745f9cb1b556d45e235e8d63ee4890117
SSDEEP 12288:PjDn4y5MGqfosXvbr4svg7DYLKQ2SBN4MC1vUpARM16dJwCz:Pv4zysXDrv89Q2ENLC1spARMEE
TLSH
T174552810762BC75FC6A940325E32D2CDAB707D05EE456F0373C8873FD576668BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 196eff476155f90cc3f2ea5225093b3efd5a229d38151af76ef87230ecbe2fc9
MD5 d894ed45c0c01fd42849c6cb0874a6d3
SHA1 19e239b9a8301d79ab7dd63d869088b95476ca63
SHA512 2ea91b491fdff69ab900d41febbde531a39445a83304dce061a98577a90ba7271d42e8d426b82448d82d5ac294063acf584307847fe5b097584f4e6c7302ac67
SSDEEP 12288:Nf3faKf0f2lfhExH89g7bfX9MfV7tfUfBferf5fG04EEXZSS:bKH89g7m4Xx
TLSH
T1916509416137A38FD1FB6071072AAB4CA774EC03B7456E26B7C8053AD86A725B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b3b02ee8dc75a04fc17bbd20d47f7e08afce61205662c4e673e4df36635da93c
MD5 97d8b88aded3b28fc21cd78ce1538ffa
SHA1 9dfe738ac54634b2029d59b7dce655942ca8e379
SHA512 2f9e2130ffe0776b65a03b767c6d9549c859a0782f6b92da5b9f1a2220284d5c9fbe9dce1f0711e76cec1049a1d7935c576e744393d43a7eebabbb23a2b07fbe
SSDEEP 24576:JB/TwSfVcYG3K/cJHlnFR+IGNe8j3Izh:JBLNiXicJFFRGNzj3
TLSH
T1CF5523A3528959B1FAFD0039857A8434B54C7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e67fe8819fb06a3c3e3bf9c697b75aab2e5491b88c73169ea6550ecbf3686d9
MD5 be275c53d39ce0d549d29df2628359f0
SHA1 62667c83fd7ac3e7991fd5ddb4224ccd4641f2d6
SHA512 379df805841e0602928bde647e6d5b347347f123aee9c87488ffd457bda6c8161c56dfd4ba91c753dc35e758cf21a987e7f0afa83647a3f6fc3a8f4b226711ab
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xgb4mBIBhGF8LNiXicJFFRGNzj3
TLSH
T1BD65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e77f7d0a41f74969c1407f8ce56063b59276ac14eb8308735db06f000850699f
MD5 c123345cbdd0e9a6f4a05841fdafd56d
SHA1 4c1ab8c6cd3567e77e0d08add6a9fcbe3bd987a1
SHA512 ec2474205d1ffd3ab82a668d2d6d5b20844c668359af9c7bdb050aee11a9b79c81f26672f6a68ddf89a3dec590f9cc8a6ce9ea241297d27706e11e43c769540c
SSDEEP 24576:LG88u8FpJqH1vzria7/ms/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K7ZFPqVya7/vLNiXicJFFRGNzj3
TLSH
T16785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 16bc08315a6bd8c7b2ef9d5a432ca375d89a162cefb80b9f36e3dfc9cd9214b3
MD5 954bdc8bb56a9a11feafc8ffab6ddb28
SHA1 a721c3f6e63c3429fbf26839073a1e5d3795832e
SHA512 5fe7a167b0283c42b87deb391e00766a4daf1066868e3e14de16bbf9ade5e320603e25ae11ce0409b84b0486b53d115811072666488c97a680cfa95ac1d2dec2
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4LNiXicJFFRGNzj3:DG05lO43bV7wRGpj3
TLSH
T172D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c92b4efd178b63729544f01e9dec471bfcfe9a470368e0bb8c23be44d1244e7c
MD5 a9f9f3164920c60d915adba72f1813fe
SHA1 75e6ddd30f822dea145c9bb273574bc9521e6ee3
SHA512 19411289eee9d8672882c44ae6fd4afd0877f1c45768b727572d718aa1a86aa8b23e0ea77bc35666f82d1fc15e424007fd4fdc0f1af2479cc36cc875d53cfd7e
SSDEEP 24576:bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnm/TwSfVcYG3K/cJHlnFR+IGNe8jg:Da5POZ3lJt2pasx2+mQLNiXicJFFRGNf
TLSH
T17665BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52b757a97ac1e4668525575f7f093f9e190b0e299f9e4ea01d7b19b99bb60221
MD5 b8ab613e11bab22dd6d53d2a50df1d23
SHA1 fb4ab98eec2ec5c5db40cc03564f6bd46bd68705
SHA512 a62a7ffa84c8143f8ac2f433a5a18dcbbb65f0ed3231c6b9d104a0a8246ba09113c5a60ffb74288a076eea79ce1e884f7c1c692b082399cbdb7a0bc42cddbc03
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHFPLNiXicJFFRGNzj3
TLSH
T1D3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 15db31053761d6020abe524ba589ffd9aa1f00fc5fa31f47d913360d681883fb
MD5 90d06a40031ac11c5934b3289b3dd5ea
SHA1 63f4668f80df3d83387c8f2b695dbfbe8ee7728c
SHA512 37d6c7ae0ac41004954ae799eaf6330f5e4818a666430ad59dd75dee91704aa2e3ae81d284601457efad4d567467ec34ec8c121b1c827d0d8bb96b290a000d05
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OzMwBtOmcLNiXicJFFRGNzj3
TLSH
T10655AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ef4429be5f350103d030dbbc12c0f1a94e7cd120a3bc5f36fbfdbdd3661f8647
MD5 b7b26a8ee3f097f932237f453fb96c0f
SHA1 1bb1b3a236b299f1679dd2e03deacc275c914f72
SHA512 ac7c50c94d80a65ab87d2c89357c527bfc1a4477735820ee759278cb86b616571c91c3046f24e54cd9cc2e9ba419c6dbc975ec19c5c845257eb8d671b497b2be
SSDEEP 24576:dPUr+NQI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dJQILNiXicJFFRGNzj3
TLSH
T12365F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 018cdb5e4d784f886e05c75035d9ae89a6e3fd49e7ae2e500849232ff43431c8
MD5 b172f43b9104d6b928ff3ebb82dffa84
SHA1 de5c91b9163ded24690e7231be2a23382668a10e
SHA512 5586fb93d5556cde670d3e7734a847413de961bad8593e34a00e34296d7faad50b3c701ab61d7d0bfe9e0fdfd550301642a41a57d14142671c84737f2bdc0da1
SSDEEP 24576:FD3FHshBIYQgAl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FDVHeBIAAlLNiXicJFFRGNzj3
TLSH
T14C75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-328-0x00000255CDC90000-0x00000255CDE13000-memory.dmp

Download

memory/920-398-0x00000255CDC90000-0x00000255CDE13000-memory.dmp

Download

memory/1048-58-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1048-308-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1048-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1048-57-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1328-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1328-80-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1328-81-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/1328-86-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2440-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2440-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2440-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2440-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3200-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3200-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3200-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3200-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3832-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3832-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3832-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3832-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3832-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4024-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4024-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4024-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4024-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4024-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4024-55-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4452-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4452-68-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4452-76-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4452-70-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5020-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5020-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5020-331-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5296-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-314-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5296-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5296-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5296-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5920-0-0x0000000000400000-0x0000000000835000-memory.dmp

Download

memory/5920-28-0x0000000000400000-0x0000000000835000-memory.dmp

Download

memory/5920-8-0x00000000026B0000-0x0000000002716000-memory.dmp

Download

memory/5920-1-0x00000000026B0000-0x0000000002716000-memory.dmp

Download

memory/6028-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6028-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6028-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6028-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6136-122-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6136-159-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6136-116-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download